Ubuntu
policykit-gnome package

Insecure PolicyKit policy files and settings or deliberately viewable by simple users?

Asked by Savvas Radevic

I just noticed something while browsing through the policykit:
$ ls -l /usr/share/PolicyKit/policy/
total 72
-rw-r--r-- 1 root root 3766 2008-05-06 12:31 org.freedesktop.hal.device-access.policy
-rw-r--r-- 1 root root 528 2008-05-06 12:31 org.freedesktop.hal.dockstation.policy
-rw-r--r-- 1 root root 1504 2008-05-06 12:31 org.freedesktop.hal.killswitch.policy
-rw-r--r-- 1 root root 843 2008-05-06 12:31 org.freedesktop.hal.policy
-rw-r--r-- 1 root root 4283 2008-05-06 12:31 org.freedesktop.hal.power-management.policy
-rw-r--r-- 1 root root 2644 2008-05-06 12:31 org.freedesktop.hal.storage.policy
-rw-r--r-- 1 root root 573 2008-05-06 12:31 org.freedesktop.hal.uinput.policy
-rw-r--r-- 1 root root 1177 2008-05-06 12:31 org.freedesktop.hal.wol.policy
-rw-r--r-- 1 root root 1894 2008-04-18 18:08 org.freedesktop.policykit.policy
-rw-r--r-- 1 root root 26422 2008-05-27 17:15 org.gnome.clockapplet.mechanism.policy
-rw-r--r-- 1 root root 884 2008-04-14 19:49 system-tools-backends.policy

Are the permissions 0644 on the files deliberately set as such? Shouldn't they be 0600?
Also, from what I see, the menu item System > Administration > Authorizations (aka polkit-gnome-authorization) is accessible to everyone.

Just wondering, isn't this an insecure way to present administrative settings "on a silver plate"?

Question information

Language:
English Edit question
Status:
Solved
For:
Ubuntu policykit-gnome Edit question
Assignee:
No assignee Edit question
Solved by:
Gord Allott
Solved:
Last query:
Last reply:
Revision history for this message
Best Gord Allott (gordallott) said : 		#1

its perfectly secure, it just shows what applications *can* do (if only root could read them then how would they know what they can do without being root).

no data is contained within these files that it would make them insecure

Revision history for this message
Savvas Radevic (medigeek) said : 		#2

You do have a point there, thanks :)