21

Oneiric update manager no longer asks for a password to update already installed software. This is a change in behavior from previous versions. Is there a way to revert this behavior and get the Update Manager in Oneiric to ask for a password again?

Thanks!

  • Do you have the policykit-desktop-privileges package installed? – arrange Dec 10 '11 at 21:18
38

This is a deliberate change in behaviour (source):

As of Ubuntu 11.10, update-manager no longer prompts for the user's password to apply updates. This was decided to improve usability and to make it easier for users to apply security updates and therefore increase system security. The rationale is as follows:

  • Like in previous releases, by default only people in the admin group are allowed access to perform security updates.

  • Only updates for already installed software can be applied without a password. Installing additional software still requires people to enter their password.

  • The password prompt had become an irritant for some people such that they would just press 'Cancel' instead of installing the updates. The password prompt decreased system security for those users.

  • People that did dutifully apply updates became conditioned to enter their privileged password perhaps daily. When the user is prompted for the password, it should mean something and the frequency of update-manager updates meant that some people no longer thought about why they were entering their password. For these users, the password prompt had the potential to reduce security.

For environments where this change is deemed not appropriate, this functionality can be disabled by the administrator via PolicyKit or by creating users that are not in the admin group (a recommended practice to begin with).

The relevant PolicyKit policy is in the file /var/lib/polkit-1/localauthority/10-vendor.d/com.ubuntu.desktop.pkla:

[Update already installed software]
Identity=unix-group:admin
Action=org.debian.apt.upgrade-packages
ResultActive=yes

This grants permission for anybody in the admin group to update packages without having to enter a password. I've never used PolicyKit before now, but based on my reading of the manpage for pklocalauthority, to override this you should create a this file..

/var/lib/polkit-1/localauthority/50-local.d/require-password-to-update.pkla

you'll need superuser priviledges to create it, so use this command...

gksudo gedit /var/lib/polkit-1/localauthority/50-local.d/require-password-to-update.pkla

which will open a new file in gedit and put the following policy entry in it:

[Require password to upgrade already installed software]
Identity=unix-group:admin
Action=org.debian.apt.upgrade-packages
ResultActive=auth_admin

Save this and exit gedit, you can now open update manager and it will ask you to confirm your password before applying any updates.

  • The effect should be immediate, without not even logging out. – enzotib Dec 11 '11 at 10:34
  • Excellent, well researched answer. Worked perfectly, immediately, without logout. Thank you. – Argyle Dec 16 '11 at 18:55
  • Excellent answer Blair I especially like the part explaining the rational behind it +1 – Allan Sep 21 '12 at 19:01
  • Oh, my... this is old... I started using Ubuntu 12.04 a couple of years ago and I had been using the update manager without realizing it never asked my password! I was about to ask a question, but I'm glad I found this great answer instead. +1 – Samuel Santana Mar 10 '17 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.