search

linuxmint / mintupdate

The Linux Mint Update Manager
309 stars 152 forks source link

Mint Update will install applets/desklets without authentication. #817

Closed ChooChooAl closed 1 year ago

ChooChooAl commented 1 year ago

I just got an update for sound150 applet. Hitting install did the update without any authentication (root pw). It's not too bad as a single item, but when multiple system updates are included with the applet/desklets, they all get done together.
The latter issue I feel is a possible security issue.

Another issue with applets/desklets is that if there are many, it seems to only do one at a time. It just means you have to click install several times. (Without authentication is not so bad, I guess that's a plus on the other side of the coin).

Distribution: Linux mint cinnamon 21.1 Update manager 5.9.8 Kernel: Linux 5.15.0-72-generic DE: Cinnamon 5.6.8

@clefebvre

JosephMcc commented 1 year ago

Well xlets are installed in the /home directory and can be installed/removed/updated without authentication. Have you ever had it happen where other things updated alongside xlets without asking for a password? I'm pretty sure that can't happen.

ChooChooAl commented 1 year ago

Thanks for the quick reminder. I am now reminded that xlets don't require authentication. At the time it seemed to me that anything coming via the update mgr should be authenticated. If there are other system updates alongside then authentication is required.
Thanks for the head smack. I'm closing this.