Updating as a regular user

[b3ta]

Hi,

I've been running MX for about a year and am now happy to move my wife and my father over to it as well, but there is one fly in the ointment: MX-Updater requires the root password to do any updates, and there is zero chance I'm going to give that to either — the reason I have them on Linux is to minimise their chance of tanking the system while maximising my ability to support them. This has been working fine for years.

I had a look at how you've coded it all, seeking one place I could prepend gksudo, but I'd be fighting the results of said updates, so that would be under-clever on my part.

So, with all that back story, could you come to the same conclusion as antiX and use gksudo when doing an update?

8-)
John

[skidoo]

You can quickly edit the policy on your system(s).
Visit /usr/share/polkit-1/actions/ directory and open in text editor the actions files related to mx-update.
For whichever actions you wish a user to be able to supply his/her own password, change "auth_admin" to "auth_self"

refer to the manpage for polkit to see the other available options (beyond "auth_admin" and "auth_self")
man polkit

[kmathern]

You can quickly edit the policy on your system(s).
Visit /usr/share/polkit-1/actions/ directory and open in text editor the actions files related to mx-update.
For whichever actions you wish a user to be able to supply his/her own password, change "auth_admin" to "auth_self"

The sed command below will change all mx-updater authentications to "auth_self". An update to the apt-notifier package will change them back to "auth_admin" though.

Code: Select all

sudo sed -i 's auth_admin auth_self ' /usr/share/polkit-1/actions/*mx-updater*.policy

refer to the manpage for polkit to see the other available options (beyond "auth_admin" and "auth_self")
man polkit

Thanks, I wasn't aware of the other options. I might change the policy files for viewing the unattended-upgrades logs & dpkg logs to "yes", which would eliminate the password requests for those actions. I've never liked requiring users to have to enter a password just to view log files.

[fehlix]

I might change the policy files for viewing the unattended-upgrades logs & dpkg logs to "yes", which would eliminate the password requests for those actions. I've never liked requiring users to have to enter a password just to view log files.

Nice idea. I tried also auth_self_keep, but seems to have no effect in resp. of remembering authentication for 5 minutes, it bahaves like auth_self, i.e. re-entering user password always required.

[asqwerth]

section 3.2.1 of the manual on mx-updater:

An option for unattended upgrade is available in Preferences. It happens in the background, and neither add new or remove existing packages

It won't update packages where new dependencies are installed or existing packages removed, but most updates can take place without them having to do anything.

You can sort out the rest when you're free.

[b3ta]

Thanks for the excellent replies.

Perhaps let a /usr/local/... version take precedence? That does of course raise the problem of how to deal with updates which introduce new functionality which the local version does not cater for: maybe a file with only the auth_ settings...?

@kmathern: I ended up writing almost the identical sed line as a script to run after updates: created a backup, didn't use space as delimiter, and chose to do .../org.mxlinux.pkexec* as it's a single-user machine.

Thanks again for the cogent replies. I've been enjoying being a lurker.

---

An observation: for a privacy-minded community, why is the forum even available in HTTP?

[b3ta]

Same edit is required to /usr/share/polkit-1/actions/com.ubuntu.pkexec.synaptic.policy

[skidoo]

com.ubuntu.pkexec.synaptic.policy

^--- that's a good point. In terminal, type
pkaction
and you may find a few additional handpicked actions that you'll want to customize.

Perhaps let a /usr/local/... version take precedence?

The possibility to do so isn't mentioned in the specs
https://www.freedesktop.org/software/po ... kit.8.html and I had the impression (per the pklocalauthority manpage) that any customizations must reside in /etc/policykit-1/

An update to the apt-notifier package will change them back to "auth_admin"

kmathern, I've only readabout customizations ~~ haven't attempted to put 'em into practice.
Here's a howto example which also mentions placement in /etc/policykit-1/
http://www.odi.ch/weblog/posting.php?posting=696
Hopefully this means that any distro-supplied (aka vendor?) custom /etc/polkit-1/rules.d/*.rules
will be preserved, not overwritten, during package updates
unless you target those known, individually-named files via a preinst//postrm packaging script.

[kmathern]

kmathern, I've only readabout customizations ~~ haven't attempted to put 'em into practice.
Here's a howto example which also mentions placement in /etc/policykit-1/
http://www.odi.ch/weblog/posting.php?posting=696
Hopefully this means that any distro-supplied (aka vendor?) custom /etc/polkit-1/rules.d/*.rules
will be preserved, not overwritten, during package updates
unless you target those known, individually-named files via a preinst//postrm packaging script.

I did the customizations a little differently. I copied the org.mxlinux.pkexec.mx-updater-*.policy files I wanted to customize over to 00-org.mxlinux.pkexec.mx-updater-*.policy files and made the changes/customizations to them.

Code: Select all

$ ls -1 /usr/share/polkit-1/actions/*mx-updater*.policy
/usr/share/polkit-1/actions/00-org.mxlinux.pkexec.mx-updater-view-auto-update-dpkg-logs.policy
/usr/share/polkit-1/actions/00-org.mxlinux.pkexec.mx-updater-view-auto-update-logs.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-basic-upgrade.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-disable-auto-update.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-enable-auto-update.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-full-upgrade.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-reload.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-view-auto-update-dpkg-logs.policy
/usr/share/polkit-1/actions/org.mxlinux.pkexec.mx-updater-view-auto-update-logs.policy

The 00-* policy files seem to take precedence over the original ones installed with the apt-notifier package and they won't get overwritten during package updates.

[manyroads]

I know my solution suggestion is probably too simple to be really useful (I'm a geek and fully understand...) . But my 90+ year old dad and 64 year old sister do really fine with me having just set the update function to automatic (in MX Updater preferences). Every 5 or 6 weeks I check things and make sure they haven't done anything catastrophic. In the last year everything is smooth as glass...