Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I've found that most of user authentication programs that used in Ubuntu is not gksu, but it's not a problem. The problem is that these programs do not lock the keyboard (while gksu does).

For example, the program xneur (analog puntoswitcher) can log keystrokes. And when I turn on this option, I found my password used to authenticate applications in this log.

Why is Ubuntu using such an insecure method of authentication? Is there a specific reason why applications don't use gksu to authenticate? If so, why, if not, shouldn't measures be taken to ensure that applications use gksu to authenticate?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

sudo provides access to commands. If you have access to the shutdown command, then you can always shutdown the system. PolicyKit provides access to features. For instance, you can say that a user is allowed to reboot the system, but only if there's no other logged in users. PolicyKit rules can be made for almost anything you can do in your system. For instance, it might be beneficial to say that anyone in the family should be allowed to install officially released security updates from the official repositories, but not install any new software. That's far beyond the scope of sudo; if you have access to apt-get, then you have access to apt-get. There's no granularity.

However, why the PolicyKit dialog doesn't grab the inputs, I don't know. You could file a bug on Launchpad.net.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.