[Pamac 9.3.0beta] Password less updates possible

The beta 9.3.0beta-1 has an undesired behavior.

Pamac makes system changes without asking authorization.

The is very much undesired - no changes should be made to the system without authorization.

changed title from BUG: Pamac undesired behaviour to BUG: Pamac security hole

See 2e59ce35

Please test v9.3.0beta-2

Same behavior

/usr/share/polkit-1/actions/org.manjaro.pamac.policy

<policyconfig>
  <vendor>Manjaro</vendor>
  <vendor_url>http://manjaro.org/</vendor_url>
  <icon_name>package-x-generic</icon_name>
  <action id="org.manjaro.pamac.commit">
    <description gettext-domain="pamac">Install, update, or remove packages</description>
>--- snip
    <defaults>
      <allow_any>auth_admin_keep</allow_any>
      <allow_inactive>auth_admin_keep</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>
</policyconfig>

That file was last changed with v9.0.0beta.

If you look at the code changes a lot got simplified. We have to wait for @guinux to confirm if not needing a password is the new way we want to go. Especially for the file /etc/sudoers.d/10-installer.

changed title from BUG: Pamac security hole to [Pamac 9.3.0beta] Password less updates possible

"not needing a password" most certainly is not the way you want to go. needs to get fixed. was not amused when i noticed the behavior yesterday.

sudo pacman -R manjaro-application-utility pamac-gtk pamac-cli pamac-common

This is the solution i have applied to this circumstance. Upgrades that require no admin password have no place on my computer. Thanks and have a wonderful day. Also, i don't need no stinkin' gui for updates anyway.

So follow your thought: just install Archlinux.

Dont be a troll. Follow that thought

Be my guest and follow your advice.

Signed by who? Pamac-aur-git maintainer on AUR and long time pamac user and bug reporter.

If you cant handle being told that the changes made are unacceptable without resorting to being rude then perhaps you should rethink your presence in a public forum. I dont care what you maintain when you act like a troll.

You didn't need to get on your high horses like you do. Even if you were right - it is the case - acting angrily and telling "Also, i don't need no stinkin' gui for updates anyway." is not the best way to be heard.

fredderic again you are in the wrong.

Wrong about what? I saw someone overreacting here, and it is not me. Anyway, whatever I can, I will be wrong.

No need to go further here. You DECIDED that I was wrong. End of the story.

I have no more time to waste on this non-issue.

Fixed with b21ebda6

closed

@fredbezies74, @LizziAS is right in their last post.

I know, but she chose the wrong way to say things. I don't think "Also, i don't need no stinkin' gui for updates anyway." is the right thing to say here.

nothing wrong with her post.

Nothing wrong? I don't think using "stickin' gui for updates" is not the right words on a bugtracker related to GUI package manager. But YOU decided I was wrong.

End of the story. No need to go further.

mentioned in issue #718 (closed)

Please - this is a repo - not a place for personal bigotry.

Indeed. But some people need to care about the way things are said. My last post here.

@fhdk there is no kind of bigotry in this thread and you damn well know it.

manjaro sucks and that @LizziAS girl sucks as well. also, are you kind of a personal secretary, defending her everywhere? grow up. install arch. or better, install artix with s6 and have a fresh air. systemd is what made you shallow minded simp.