<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> Le 24/03/2009 09:32, Richard Hughes a écrit : <blockquote cite="mid:1237883538.5513.18.camel@hughsie-work.lan" type="cite"> <pre wrap="">On Mon, 2009-03-23 at 23:53 +0100, Adrien BUSTANY wrote: </pre> <blockquote type="cite"> <pre wrap="">Yes, Daniel is right, rights in PackageKit are managed by PolicyKit, and the granularity is action wise, not package wise. Depending on your backend, there might be a way to pin the packages on the backend side. </pre> </blockquote> <pre wrap=""> I think in your situation you need to change the default authorisations for your kid to have deny remove, deny install unsigned (unsigned packaged) and allow install signed. The others are up to you. Also, Daniel is very correct in saying that if he has access to the physical machine, then it's trivial to set grub into runlevel 1 and then pwn the machine. Or even use a live CD and boot from cdrom. You probably want to lock down grub and the bios at a minimum. Richard. _______________________________________________ PackageKit mailing list <a class="moz-txt-link-abbreviated" href="mailto:PackageKit@lists.freedesktop.org">PackageKit@lists.freedesktop.org</a> <a class="moz-txt-link-freetext" href="http://lists.freedesktop.org/mailman/listinfo/packagekit">http://lists.freedesktop.org/mailman/listinfo/packagekit</a> </pre> </blockquote> But then if an 8 year old kid is able to but in single user to remove iptables, I think his education should be put into question :D<br> <br> </body> </html>