software update did not ask for authentication
Checked for updates via System --> Administration --> Software Updater. There wasn't much to update, only something for the system. After pressing 'install now', however, it did not ask for authentication. Is this normal, or is there something wrong? Thanks in advance for answer!
I am a translator!
I am not an expert on this, but I understand that Trisquel uses a component called polkit that is designed to allow certain programs to perform actions that normally require special priviledge, without the need to be superuser.
On my system, I see the file /usr/share/polkit-1/rules.d/com.ubuntu.desktop.rules that includes rules about authorized actions. One of these rules is:
// Update already installed software
polkit.addRule(function(action, subject) {
if (action.id == "org.debian.apt.upgrade-packages" &&
subject.active == true && subject.local == true &&
subject.isInGroup("sudo")) {
return polkit.Result.YES;
}
});
From the comment, it seems to allow updating already installed software without the need for extra authentication. So maybe that was the case?
From the details and the manual page, this is only possible if the user is in the "sudo" group (so a guest cannot do that) and when the user has an active session and the "seat" (no clue what this is) is local. Maybe that would be false for some kind of remote usage? (not sure).
I am a translator!
Thanks. Looking at https://www.freedesktop.org/wiki/Software/systemd/multiseat/ made me try the loginctl command.
I see that:
- my local session has a seat
- my ssh session has Remote=yes
- the session I started with machinectl from my ssh session has Remote=no
- both the ssh session and the session started with machinectl have no seat
That makes me wonder what a non-local seat is.
> both the ssh session and the session started with machinectl have no seat
My understanding is that they are in fact seated on a remote machine, so their seats do not exist from the point of view of the local machine. From the point of view of an admin or someone writing documentation, they are "non-local".
You could start a VNC session and see if Software Updater lets you remotely upgrade installed packages without asking for a password. It seems to be the default behavior from a local session.
