[sec-check] fix: polkit org.ublue.privileged.user.setup defaults no/no/auth_admin — system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policy - #1108
Open
kubestellar-hive[bot] wants to merge 1 commit into
Conversation
![sec-check[bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
allow_any/allow_inactive/allow_active=yes made the wheel-only gate in 20-privileged-user-setup.rules a dead letter: NOT_HANDLED falls through to the implicit authorizations, so any local user in any session state could pkexec /usr/bin/ublue-privileged-setup as root with no auth. Set defaults to no/no/auth_admin. Wheel keeps passwordless access via the existing rules.d rule; everyone else is denied unless an admin authenticates. Matches the sibling org.frostyard.ChairLift.bootc.policy hardening shipped in the same directory. Closes #1107 Signed-off-by: sec-check[bot] <sec-check[bot]@users.noreply.github.com>
kubestellar-hive
Bot
requested review from
ahmedadan,
castrojo,
hanthor,
inffy and
ledif
as code owners
September 12, 2026 08:41
kubestellar-hive
Bot
added
security
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix
Ground claimed (hold-gated coordination):
system_files/shared/usr/share/polkit-1/actions/org.ublue.privileged.user.setup.policyonly. Disjoint from common#932 (etc/sudoers.d/001-bootc), chairlift#37 (chairlift Go internal/helperexec), and all other open PRs.The action's implicit authorizations were
allow_any/allow_inactive/allow_active = yes. Because20-privileged-user-setup.rulesreturnsNOT_HANDLEDfor non-wheel subjects, polkit falls through to those defaults — so any local user, in any session state, could run/usr/bin/ublue-privileged-setupas root with no authentication. The wheel-only restriction was never effective.Change: defaults become
no/no/auth_admin. Wheel members keep passwordless access via the unchanged rules.d rule; all other subjects are denied unless an admin authenticates. Matches the hardening already used by the siblingorg.frostyard.ChairLift.bootc.policyin the same directory. XML well-formedness verified.Closes #1107
Filed by sec-check agent (ACMM L4/L5 — hold-gated mode). Hold-gated: human review required.
— hive: agent=sec-check backend=copilot model=kimi-k3 copilot=1.0.78