[Oneiric] update-manager installs packages without authentication

Bug #814331 reported by Sam_ on 2011-07-21
66
This bug affects 11 people
Affects Status Importance Assigned to Milestone
update-manager (Ubuntu)
High
Unassigned
Nominated for Oneiric by RedSingularity

Bug Description

Wait until update-manager in launcher calls for attention to upgrade.
Click on launcher icon displays update-manger and a list of packages to upgrade.
Click on install downloads and installs packages without authentication request.

Regarding security and considering an upgrade an admin task it's expected to request authentication.

## Similar Bug #811166

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: update-manager 1:0.152.6
ProcVersionSignature: Ubuntu 3.0-3.4-generic 3.0.0-rc5
Uname: Linux 3.0-3-generic x86_64
NonfreeKernelModules: wl
Architecture: amd64
Date: Fri Jul 22 00:20:09 2011
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Release amd64 (20110423)
PackageArchitecture: all
ProcEnviron:
 LANG=C
 SHELL=/bin/bash
SourcePackage: update-manager
UpgradeStatus: No upgrade log present (probably fresh install)

Sam_ (and-sam) wrote :
description: updated
Changed in update-manager (Ubuntu):
status: New → Confirmed
RedSingularity (redsingularity) wrote :

Sam, post the output of:

apt-cache policy update-manager

Thanks.
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

Changed in update-manager (Ubuntu):
status: Confirmed → Incomplete
Sam_ (and-sam) wrote :

$ apt-cache policy update-manager
update-manager:
  Installed: 1:0.152.6
  Candidate: 1:0.152.6
  Version table:
 *** 1:0.152.6 0
        500 http://archive.ubuntu.com/ubuntu/ oneiric/main amd64 Packages
        100 /var/lib/dpkg/status

Changed in update-manager (Ubuntu):
status: Incomplete → New
RedSingularity (redsingularity) wrote :

Thanks. I will test this out as soon as possible and report back.
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

Changed in update-manager (Ubuntu):
assignee: nobody → RedSingularity (redsingularity)
Changed in update-manager (Ubuntu):
status: New → Confirmed

I can confirm this too - also I don't think it's proper to assign a bug to yourself unless you're currently working on a fix. Unless we're all mistaken here it seems like quite a serious security issue to allow updates to be done with any authentication.

Changed in update-manager (Ubuntu):
importance: Undecided → High
assignee: RedSingularity (redsingularity) → nobody
RedSingularity (redsingularity) wrote :

Confirmed in a fresh install of 11.10.
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

Changed in update-manager (Ubuntu):
status: Confirmed → Triaged
RedSingularity (redsingularity) wrote :

This was also the case in update-manager version 151.7 it seems.
---
Ubuntu Bug Squad volunteer triager
http://wiki.ubuntu.com/BugSquad

tags: added: regression-release
Sam_ (and-sam) wrote :

In changelog I ran into Bug #626798, maybe it's related to policykit.

Brian Murray (brian-murray) wrote :

This is by design and only applies to admins:

policykit-desktop-privileges (0.6) oneiric; urgency=low

  * Allow local admins to update already installed software without password.

https://launchpad.net/ubuntu/oneiric/+source/policykit-desktop-privileges/0.6

Changed in update-manager (Ubuntu):
status: Triaged → Won't Fix
Sam_ (and-sam) wrote :

Thanks for the clarification Brian.
When I did a partitial upgrade it requested a passwd, although it updated already installed packages, then the policy seems to be inconsistent when it says 'update already installed software'.

Sam_ (and-sam) wrote :

Actually it asks again for authentication. Bug #819328
Please clarify what is expected, authentication or not?

Colin Law (colin-law) wrote :

Can somebody clarify what should happen here? In 11.04 whenever I used update manager to install updates I was asked to authenticate. On 11.10 Beta (15th Sept 2011) I am not asked to authenticate. Comments above suggest that this is correct for administrator users. This appears not to be consistent with the fact that from the command line I have to use sudo apt-get upgrade, and authenticate.

kieran (kieran-charles) wrote :

This is worrying as I don't want my kids to be able to install without admin authorisation under their own logon.
Are security actions like removing all 3rd party PPAs necessary?

kieran (kieran-charles) wrote :

Ok, without sounding like I am whinging, and whining.
2nd time update manager has run on the new 11.10 upgrade, it again updated software after I pressed the 'install updates' button without asking for any password.

This was not a release update, it was the usual patch cycle.

This is a now a very insecure system for me to use - can someone please provide me with some reassurance?

Sam_ (and-sam) wrote :

That's why I've marked my follow-up Bug #863602 as invalid.
As I understood the policy says
< update *already installed* software without password >
which doesn't regard installations of new packages. Admitted it's still confusing the user.

Dave Stroud (bigdavesr) wrote :

I would like to add that one of the best things ubuntu has going for it is that in order to install anything you have to use adm. password to do it. I would much rather have to use it to install anything including updates no matter who is using my computer..

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers