please consider letting non-admins create ubuntu installation USB stick

[Timo Juhani Lindfors]

This is a wishlist bug. Currently

http://www.ubuntu.com/download

nicely describes how a user can create Ubuntu installation USB stick using usb-creator. What it does not mention is that you need to be an admin to create the USB stick since /usr/share/polkit-1/actions/com.ubuntu.usbcreator.policy has "auth_admin_keep" set.

This is unfortunate since it means that users can not create Ubuntu installation USB sticks on computers where they do not have admin privileges (think university class rooms, libraries, work places where people are not given root privileges to their desktops).

Please consider if this could be relaxed to at least to allow local users to create such installation media.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Dimitri John Ledkov (xnox)]

auth_admin_keep is set, because the application is formatting drives / installing a bootloader into mbr.
There is a potential for data loss & rendering your system unbootable.
I need to check if we can relax policy, without causing dataloss.

[Timo Juhani Lindfors (timo-lindfors)]

The code at least tries to check if the drive is marked as "device-is-system-internal" by udisks and aborts if that is the case.

[Timo Juhani Lindfors (timo-lindfors)]

Sorry to ask again but is there some specific area of code that you'd like to be reviewed more carefully? I think I found at least a few security bugs. For example it does not check that the file that the user wants to write to the USB stick is actually something that the user can normally access. This means you can tell it to write /etc/shadow to your USB stick.