search

KernelPanicBlog / MPIS

Manjaro Post Install Script
http://kernelpanicblog.wordpress.com
GNU General Public License v3.0
12 stars 6 forks source link

Uninformed use of root privileges #27

Closed emvigo closed 8 years ago

emvigo commented 8 years ago

The script calls yaourt without the user's knowledge, leading to potential dangerous effects which the user does not have control over. In part I understand this is not your fault: as we all know, yaourt cannot be run as root because of how the building process of Arch packages, so it is designed to call "sudo" by itself. This is generally considered bad practice due to the "principle of least privilege" (i.e. a program must ask for the privileges it needs), but in the case of yaourt this is sort of inevitable. My recommendation is that you inform users when a subsequent action needs root privileges and give them the chance to cancel right after the warning.

hgavidia commented 8 years ago

thanks for the feedback in future versions allow the user to abort the task yaourt before running. (Currently only we advised that yaourt be executed, but do not give option to cancel)

hgavidia commented 8 years ago

the option to cancel the command is implemented. (On the unstable branch )