Re: D-Bus policies

[Diederik de Haas <didi.debian at cknow.org>]

[-- Attachment #1: Type: text/plain, Size: 1936 bytes --]

On Tuesday, 25 January 2022 23:15:07 CET Denis Kenzior wrote:
> Sure, but the chances that the main user on a single-user system isn't part
> of 'wheel' or 'netdev' should be pretty small, no?

No, but it is easy to 'fix' for the main user.
When you install a Debian system, you can explicitly use the 'root' user and 
then you specify root's password. Next to that a normal user account gets 
created. Alternatively, you can use the sudo system which the first user, ie 
you, gets added to and then you can do all root-type actions via sudo.
So the person installing the system does get full administrative permissions, 
which he/she can use to further setup the system.

> The original intent was to disallow access to iwd for remote users.  So, in
> the scenario above, if your friend is not part of 'netdev' or 'wheel', then
> their control of iwd should not have been possible.

Correct. But in the restricted scenario (option 2), my friend would also not 
have access if directly logged on to the system (locally), if not in the 
'netdev' group.
This would thus be a change in behavior as originally intended.
 
> > And Option 2 is restricted access.
> 
> Right.  We'd be 'breaking' the above scenario.  But, as I mentioned before,
> how likely was this scenario in the first place?  Did someone really want
> remote users to mess with wifi on their machine without netdev/wheel
> access?  Arguably we're just fixing a bug.

I think we're indeed fixing a bug by allowing only netdev/wheel users the 
permission to change the wifi settings.

> > For which Option would you like a patch?
> 
> I'm fine with either option.  It sounds like you're favoring Option 2.
> Whichever you go for, I'll let it sit on the list for a few days to see if
> anyone else complains :)

Yeah, I do favor Option 2 ;-)
A patch is coming your/the list's way (probably tomorrow, CET TZ here)

Cheers,
  Diederik

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]