On Fri, 12 Feb 2010 23:04:22 -0000, Milan Bouchet-Valat <email address hidden> wrote:
> James: Do you know whether it's possible to allow users members of
> certain Unix groups to perform certain actions? In PolicyKit's docs, I
> can only find auth_self and auth_admin. If the program needs to check
> that the user is member of the group itself, the whole purpose of
> PolicyKit is destroyed. Or we should get rid of all those groups then...
There is only auth_self and auth_admin, correct.
However, the system adminstrator can do overrides that are more
finegrained, down to the user/group level. I believe it would be
possible for them to create a policy (on top of an Ubuntu default system
that just said "yes" rather than "auth_*") where the default was "no",
but anyone in the netdev group could do it without a password.
On Fri, 12 Feb 2010 23:04:22 -0000, Milan Bouchet-Valat <email address hidden> wrote:
> James: Do you know whether it's possible to allow users members of
> certain Unix groups to perform certain actions? In PolicyKit's docs, I
> can only find auth_self and auth_admin. If the program needs to check
> that the user is member of the group itself, the whole purpose of
> PolicyKit is destroyed. Or we should get rid of all those groups then...
There is only auth_self and auth_admin, correct.
However, the system adminstrator can do overrides that are more
finegrained, down to the user/group level. I believe it would be
possible for them to create a policy (on top of an Ubuntu default system
that just said "yes" rather than "auth_*") where the default was "no",
but anyone in the netdev group could do it without a password.
Thanks,
James