Re: GNOME and superuser (privilege raising) integration

[Philip Van Hoof <spam freax org>]

Hongli Lai wrote:

> What do you think? Will this ever get the chance to be integrated in GNOME? If 
> not, what wrong with it? Is there any reason to reject this instead of 
> accepting and incrementally fixing it?
Hi there, let me first introduce myself: I have been the author of GNOME 
xsu which has new renamed to GNOME SuperUser and is now being maintained 
by Mark Finlay (I think Mark is on this list to).  
<http://xsu.sourceforge.net/>

Most issues with the wrapping of the "su" application and integrating 
such applications with GNOME are

1) Security issues. The best way is to use a SUID-root non-Gtk+ 
application in stead of passing the password to "su" using a 
terminal-widget. However, some people dislike the idea of having 
_another_ SUID-root application and like the idea of using the standard 
"su" -or "sudo" command for this purpose. (Problem: su and sudo require 
a terminal for typing in the password -you cannot use a pipe for this-). 
Faking a terminal-widget might introduce security-issues.

2) The fact that not every Operating System that can host GNOME/Gtk+ 
applications really needs a superuser utility (Gtk+ and GNOME also work 
on -older versions of- Windows) nor/or has such a utility. Adding the 
library to GNOME would add a impossible dependancy for some Operating 
Systems -and environments.


However, I _do_ like your idea and I _do_ think that it should be 
integrated with GNOME. Why? Because that way applications (like 
nautilus) and distrubutions (like RedHat) can then start using it in 
stead of inventing their own SuperUser-protocol. I also think that this 
library should not be GNOME-only; in stead should be available for "all" 
applications (so also KDE -and Console applications)... (PAM ?) and easy 
for developers to start using it. Maybe the people at freedesktop.org 
should agree on such a protocol? Talking to them might be a good idea (I 
have not checked but it is possible that they are already working on 
this issue).

> libgnomesu can be downloaded at this URL. It's mostly finished.
> http://members1.chello.nl/~h.lai/libgnomesu-0.9.tar.gz
--
Philip Van Hoof
me at freax dot org
http://www.freax.eu.org