Sudo password required to show updates

[Stuart Langridge]

The Software Updates applet requires the user to enter their password just to see what updates are pending, when it shouldn't need to. Ask for the password when it's required, which is when the user decides to actually install those updates. The current state is bad for two reasons: it violates the Principle of Least Privilege, because it asks for permissions (sudo'ed root) that it doesn't need (to show the pending updates), and because it makes it awkward to just see what's outstanding (because it changes a one-mouse-click process into a click-and-enter-your-password process).

[OlivierP (unineurone)]

I consider this as normal behaviour. When you check what updates are pending, most of the time you will install them immediately. If a daily reminder is too frequent, then it is possible to define the frequency of automatic updates checks to a longer value than daily. It is also possible to disable automatic update checking, where you would then voluntarily launch synaptic and do a refresh.

It would be better that update-notifier does not automatically launch itself for non-admin members, as this causes confusion.

[Stuart Langridge (sil)]

The reason I filed the bug is that I don't always install things immediately. For example, if there's a kernel upgrade on the list then I generally wait a bit, because that requires a reboot. I'd like to be able to quickly see what's outstanding, and if it's a few things say "go for it, install them" and if it's a lot of things or some big things or something that requires a reboot, wait until I'm not doing anything important. At the moment, it's a bit of a pain because I have to click, wait, enter my password, rather than just clicking and seeing what comes up.
The point about the principle-of-least-privilege still stands, too; the program doesn't need root to see what updates are available and therefore shouldn't ask for it.

[Gabriel Bauman (gabrielbauman)]

I'd have to agree with Olivier. The user should not be required to enter their password unless the system absolutely requires superuser privileges to perform the action the user initiated.

Until the user initiates a privileged action - no prompt.

[Adriaan Peeters (apeeters)]

I agree. Another reason to delay the upgrade is because you are on a low bandwith connection.

[Michael R. Head (burner)]

Correct me if I'm wrong, but hasn't this be fixed in Edgy?

[Sitsofe Wheeler (sitsofe)]

Michael, I agree - this does not appear to happen in Edgy. Resolve fixed?

[Philip A. Marshall (philip-philipamarshall)]

If the update manager icon shows new updates, you can now (edgy, feisty) view that list without sudo. However, if you click the "check" button, it prompts for a password. This is annoying, because you can't check for new updates without typing your password, even if there actually aren't any. But, the system can automatically check for updates in the background without your password, so I don't see why a password should be required. (again, principle of least privileges.)

[Pertti Uusiluoto (peruus)]

Password is last 8 character and numer. First lettel is low letter then its
ok.
Pertti Uusiluoto
Finland.
======================================================

2007/5/18, Philip A. Marshall <email address hidden>:
>
> If the update manager icon shows new updates, you can now (edgy, feisty)
> view that list without sudo. However, if you click the "check" button,
> it prompts for a password. This is annoying, because you can't check
> for new updates without typing your password, even if there actually
> aren't any. But, the system can automatically check for updates in the
> background without your password, so I don't see why a password should
> be required. (again, principle of least privileges.)
>
> --
> Sudo password required to show updates
> https://bugs.launchpad.net/bugs/30583
> You received this bug notification because you are a bug contact for
> update-manager in ubuntu.
>

--
   TietoVerkkoPalvelut
____________________________
Name:.Pertti Uusiluoto
Tel:....[phone]
Finland
TimeZone: UFT +3
Finland
____________________________

[Sebastian Heinlein (glatzor)]

A password is needed since you modify your system. If you press on the check button the list of available software will be updated and all repositories will be queried.

If the check is done by a background job, it will be launched by the root user and we can trust the root user fully. So no need to ask for a password in this case.

Keeping a private cache for the user would require to this for every user or perhaps every app.

[Adam Niedling (krychek)]

I guess "apt-get update" will remain to be a sudo. Read the last comment.

[Fred (eldmannen+launchpad)]

Well, you could ask the root user to update for you.

[Sudhanshu (thanedar)]

i am the root user... if I open up update-manager and leave it open,
fetching a new list of updates requires a login which is unnecessary.

On Wed, Oct 29, 2008 at 4:10 PM, Fred
<<email address hidden><eldmannen%<email address hidden>>
> wrote:

> Well, you could ask the root user to update for you.
>
> --
> Sudo password required to show updates
> https://bugs.launchpad.net/bugs/30583
> You received this bug notification because you are a direct subscriber
> of a duplicate bug.
>

--
Sudhanshu Thanedar,
595, Galen Dr.
State College, PA 16803