3

The title basically says everything.

KDE Partition Manager asks for password after opening the app, but GNOME Disks does not ask for the password. It (Disks) can do basically everything without ever trying to elevate the privilege.

I have seen this in multiple distros: Ubuntu vs KDE neon, Fedora vs Fedora KDE, OpenSUSE Tumbleweed, etc.

How and why do they behave the way they do?

0

2 Answers 2

1

The difference is how these two get information about devices in your system. You can get some information about block devices as a normal user from UDev database and sysfs (that's why lsblk works for example) but especially for more advanced setups with LVM or MD RAID etc. you'll need to use tools that require root privileges. But even for getting more information about partitions you'll need root (that's why fdisk -l gives you tons of Permission denied if you don't run it as root).

That's why KDE Partition Manager needs authentication immediately, it runs tools like sfdisk, cryptsetup and lvm to get all the extra information that displays after it starts (it actually uses a new KPMCore process for that, the GUI doesn't run as root, but that's not that important).

And why GNOME Disks doesn't need that? It uses data from UDisks. UDisks is a daemon that runs as root so it already has all these information (it uses same tools/libraries KDE Partition Manager does) and provides "read" access to everyone (you can check with udisksctl dump what it knows). Only actions that change something (e.g. removing a partition) require authentication using Polkit.

You may ask why KDE Partition Manager doesn't use UDisks? I don't know, I can only guess. UDisks didn't have support for "advanced" storage like LVM for a long time (its main focus was more towards mounting devices and "simpler" stuff like that) so that's why authors of KDE Partition Manager probably decided to not use it.

0

Not an answer to the question "Why is that?", but a way how to disable asking password that I have found.

In the /etc/polkit-1/rules.d directory create a file named for example partmanager.rules. Then write the following content there:

polkit.addRule(function(action, subject) { if (action.id == "org.kde.kpmcore.externalcommand.init" && subject.isInGroup("yourusername")) { return polkit.Result.YES; } }); 

Replace yourusername with your user name.

Now when you open kde partition manager, it will not ask you a password.


Regarding the question "Why is it asking password" - probably because it is programmed such way currently. I agree that if possible, it should scan the partitions without asking password first, and only ask it when change action is going to be done. But for that, please file a proper bug report at https://bugs.kde.org.

5
  • Don't do that. You just created root privilage escalation problem on your system. Any other unprivileged process could now connect to kpmcore without password prompt and run arbitrary commands as root on your system. Commented Feb 4, 2022 at 15:00
  • Arbitrary commands? Not related to partitioning? Commented Feb 7, 2022 at 0:44
  • Yes arbitrary. Partitioning commands are in any case invasive enough to be equivalent to root. For example, you could create some file in user-writable location and mount it to /etc/sudoers.d/. The other option (might be harder) is to create a file by writing directly into raw block device. There are some safeguards in polkit helper but at least some can be overcome. It's really not designed to be passwordless. Commented Feb 7, 2022 at 14:47
  • Thanks. I deleted the rule file. I also had the same rule file, but for gparted, with id "org.gnome.gparted". Also deleted it. Commented Feb 8, 2022 at 5:41
  • 1
    Having that rule for gparted is actually less dangerous because gparted runs the whole app as root. Although, running the whole GUI as root is also less than ideal since GUI toolkit is quite a big amount of code and not all of it was designed with root privileges in mind. Commented Feb 8, 2022 at 17:19

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.