[Portland] Doubts about xdg-su and xdg-screensaver (Was Re:First xdg-utils beta release)

[Bastian, Waldo]

I don't see xdg-su so much as a "system integration" tool as well as a
desktop integrated version of "su -c". We discussed this at the DAM-II
meeting and I had the impression that people still saw a need for xdg-su
style functionality next to a PolicyKit based approach. In that context
I asked Alex Larsson if Fedora or RHEL had any plans to drop su and
there don't seem to be any plans in that direction.

Will PolicyKit be part of RHEL5?

Waldo Bastian
Linux Client Architect - Client Linux Foundation Technology
Channel Platform Solutions Group
Intel Corporation - http://www.intel.com/go/linux
OSDL DTL Tech Board Chairman

>-----Original Message-----
>From: David Zeuthen [mailto:david at fubar.dk]
>Sent: Thursday, July 06, 2006 3:45 PM
>To: Dan Kegel
>Cc: Bastian, Waldo; xdg at lists.freedesktop.org;
>portland at lists.freedesktop.org
>Subject: Re: [Portland] Doubts about xdg-su and xdg-screensaver (Was
>Re:First xdg-utils beta release)
>
>On Thu, 2006-07-06 at 15:38 -0700, Dan Kegel wrote:
>> On 7/6/06, David Zeuthen <david at fubar.dk> wrote:
>> > xdg-su really needs to go. Here are just two reasons
>> >
>> >  1. I don't think we should be encouraging ISV's to use insecure
>> >     methods to do privileged operations. It's a
get-out-of-jail-card
>> >     that encourages lazy programming.
>> >
>> >  2. I'm not sure how this would be implemented on Fedora or RHEL
and,
>> >     unless I'm mistaken, the point is to not lock out any OS'es
that
>> >     wants to participate, yes?
>>
>> Once polkit-su is ready, can't xdg-su be a symlink to it?
>> So what's the problem?
>
>Well, it's a lot more complicated that I previously envisioned in my
>weblog: to do privileged operations in a secure fashion you basically
>need to architect your application to support it. Here's the PolicyKit
>spec, work-in-progress but 90% done
>
> http://webcvs.freedesktop.org/hal/PolicyKit/doc/spec/polkit-
>spec.html?view=co
>
>and I also mentioned it in my GUADEC talk last week
>
>
http://people.freedesktop.org/~david/talks/system-integration-and-gnome-
>guadec2006-davidz.pdf
>
>Hope this clarifies.
>
>Cheers,
>David