Bug#501576: [Fwd: Re: PK: suid binaries, libpolkit]

[Michael Biebl]

I'm forwarding the (private) discussion I had with David Zeuthen.
-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

--- Begin Message ---

David Zeuthen wrote:

On Wed, 2008-04-23 at 01:22 +0200, Michael Biebl wrote:

1.) 1.3 has /var/run/PolicyKit-public, in 2.3, 3.3 it is in /var/lib

1.1) Why is /var/lib/PolicyKit-public not root:polkituser 775?

I think this is explained in my other mail. Right?

1.2) Why is /var/lib/misc/PolicyKit.reload not writeable for root, i.e. why is not root:polkituser 775?

Root can always write to it. Also, is it explained well enough in my
other mail?

Yeah, I wrote the email before I got your reply.

1.3) Why was the group named polkit*user*?

Mostly because it's not used as a traditional group but more as an
implementation detail.. it's a little messy, yes.

And I also forgot about the second topic in the subject: libpolkit.

If an application links against libpolkit, but /var/lib/misc/PolicyKit.reload is non existent (In debian I have libpolkit in a separate library package and /var/lib/misc/PolicyKit.reload is in the actual policykit package), the initialization will fail. As an example, ConsoleKit will fail to start.

Why do you have it in a different file. That seems like a packaging bug.
Or am I missing something?

libpolkit2, where libpolkit2 contains:

/usr/lib/libpolkit.so.2.0.0
/usr/lib/libpolkit.so.2

Ok, I guess I have to say a few words about that. In Debian library packages are usually named $libraryname$soversion. Atm this would be The reason for this is, that library packages with different sonames are coninstallable, which makes library transitions (i.e. libpolkit2 -> libpolkit3) easier. If I would put /var/lib/misc/PolicyKit.reload into libpolkit2 and libpolkit3, I'd have a file conflict between those two packages. Is /var/lib/misc/PolicyKit.reload the only file that is required by libpolkit, or does libpolkit also expect /var/lib/PolicyKit(-public) to be existent?

If ConsoleKit requires a complete installation of PolicyKit, and on the other hand PolicyKit requires ConsoleKit to be installed, I was wondering how to avoid this dependency loop.

PolicyKit should be able to gracefully handle ConsoleKit not being

available.

Could libpolkit be changed, so that it doesn't fail if the complete PolicyKit package is not installed? What would be your suggestion to solve this problem?

See above. I'm not convinced why this isn't a packaging bug

Cheers,
Michael


--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

Hm, /var/lib/misc/PolicyKit.reload could be split into a separate package libpolkit-common or so. But that would be additional effort and overhead (a separate package for an empty file ;-) )

signature.asc
Description: OpenPGP digital signature

--- End Message ---

signature.asc
Description: OpenPGP digital signature