Malware protection?

[memolus at googlemail.com]

I wonder if malware protection is in the policykit concept. At first
there was some beginning of malware protection with the "constraints"
concept, where you could limit an authorization to an application. In
June 2009 David Zeuthen said, he does not plan malware protection
(http://lists.freedesktop.org/archives/polkit-devel/2009-June/000134.html)
and constraints were removed in polkit-1. But then I heard:
> As such it's not really a good idea to just allow any piece of software
> running in your session to be able to run any command it wants through
> e.g. pkexec(1).
I thought it is already possible for any piece of software to run any
command it wants ("you can easily inject code into this process [, the
authentication agent, ] to capture passwords or spoof dialogs."). So
here David Zeuthen pointed out, that it wouldn't be a good idea to
deactivate the malware protection of PolicyKit. So it seems that they
are plans for malware protection, but currently it isn't working. So
actually the AuthenticationAgend is an illusion of security. "Yes" and
"Admin_Auth" are nearly the same secure pertaining to malware
protection.