Security considerations in PolicyKit-enabled daemons

[Richard Hughes]

I've spent a few minutes writing up some documentation about security
and PackageKit. These notes probably apply to most of the PolicyKit
enabled daemons, and they might be useful to somebody. I'm also not
sure whether my concern over a custom "always authenticate" session
helper is valid, as I admit i don't fully understand the setuid aspect
of the session helpers. I would appreciate review from any of you on
this list.

Please bear in mind it's work in progress:
http://cgit.freedesktop.org/packagekit/plain/docs/security.txt

Thanks.

Richard.