Bug 216485

Summary: opensuse-updater shows error message in tooltip
Product: [openSUSE] openSUSE 10.2 Reporter: Christian Boltz <suse-beta>
Component: Update ProblemsAssignee: Duncan Mac-Vicar <dmacvicar>
Status: RESOLVED WONTFIX QA Contact: Jiri Srain <jsrain>
Severity: Normal    
Priority: P5 - None CC: aj, andreas.hanke, harbrink, security-team
Version: Beta 2   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: Other Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: screenshot

Description Christian Boltz 2006-10-31 00:10:28 UTC
(using Factory from last night)

I just updated from 10.1 to Factory and created a new user.

openSUSE-updater shows an error message in its tooltip:

    Error:
    helper program returned:
    setuid: Operation not permitted
    Forgot to chmod this program?

I'm not sure which information would be helpful in this case, so: just ask ;-)
Comment 1 Christian Boltz 2006-10-31 00:11:04 UTC
Created attachment 103118 [details]
screenshot
Comment 2 Duncan Mac-Vicar 2006-10-31 17:40:42 UTC
chmod +s /usr/sbin/zypp-checkpatches-wrapper

That should be done by the package by the way.
what version of libzypp and permissions.rpm do you have?
Comment 3 Christian Boltz 2006-11-01 13:04:15 UTC
# rpm -q libzypp permissions
libzypp-2.5.2-4
permissions-2006.10.16-5

(I chroot'ed to my 10.2 installation to get this information, therefore I don't know if the chmod command fixes the issue. However, I chmod'ed the file now and will see the result when I boot 10.2 beta again.)
Comment 4 Duncan Mac-Vicar 2006-11-02 17:19:16 UTC
Ok, please close the bug if it works.
Comment 5 Christian Boltz 2006-11-02 23:41:16 UTC
(In reply to comment #4)
> Ok, please close the bug if it works.

Without having it tested: It probably wont work for a long time...

# grep zypp-check /etc/permissions*
/etc/permissions.easy:/usr/sbin/zypp-checkpatches-wrapper                     
    root:root         4755
/etc/permissions.paranoid:/usr/sbin/zypp-checkpatches-wrapper                     
    root:root         0755
/etc/permissions.secure:/usr/sbin/zypp-checkpatches-wrapper                     
    root:root         0755
(just checked: these values are still used in the current Factory package permissions-2006.10.16-6.i586.rpm.)

Needless to say that I use "secure" permissions.
What's the reason to drop the suid bit in this case?

BTW: I can't access bug 211286 which is mentioned in permissions.* above the quoted lines :-(
Comment 6 Christoph Thiel 2006-11-06 09:24:13 UTC
What's the security teams point of view here?
Comment 7 Marcus Meissner 2006-11-06 09:47:23 UTC
in secure mode the setuid root bit should be off.

in "secure" mode we do not trust the user with system administrative duties, so an admin should use su or similar to do administrative stuff.

If you want to override this decission, adjust permissions.local or similar.
Comment 8 Christian Boltz 2006-11-14 17:50:32 UTC
(In reply to comment #7)
> in secure mode the setuid root bit should be off.
> 
> in "secure" mode we do not trust the user with system administrative duties,
> so an admin should use su or similar to do administrative stuff.

Hmm, what about zen-updater? It even grants _permanent_ permissions once you entered the root password ;-)

Seriously: Now that some test updates are available, I could test opensuse-updater a bit more.

The only thing a user can do without knowing the root password is "check for updates". I don't know why this is considered security relevant. (He could also call rpm -q to check for outdated/vulnerable packages.)

(Before actually installing any patch, the root password is requested.)

Anyway: If you don't set the suid bit for zypp-checkpatches-wrapper in permissions.secure, at least implement a better error message that is more helpful for the user (it should at least contain a hint _which_ program needs to be chmod'ed suid-root).
Comment 9 Stanislav Visnovsky 2006-11-15 08:24:23 UTC
Yes, a better message might be useful. But for the rest - if you are running
in secure mode, you should not update the system as a user, not even an applet running and checking periodically over a network if there are new updates.

IMO there is no reason for the applet to even run in the secure mode.

The reason why we need suid is that ZYPP stores sensitive information in its database (e.g. FTP password) and checking the update status is using this information.
Comment 10 Duncan Mac-Vicar 2006-11-20 17:16:10 UTC
closing, better message in future versions.
Comment 11 Andreas Hanke 2006-12-14 12:21:46 UTC
*** Bug 228518 has been marked as a duplicate of this bug. ***
Comment 12 Stephan Kulow 2008-06-25 09:19:16 UTC
mass reopening all 10.2 LATER+REMIND bugs.
Comment 13 Stephan Kulow 2008-06-25 09:23:27 UTC
close all 10.2 LATER/REMIND bugs as WONTFIX. Reopen yourself if you still plan to work on it.