xfce4-power-manager xfpm-power-backlight-helper pkexec lxsudo popup

Patrick · January 14, 2020, 8:13pm

At boot of a Kicksecure host system, there is a lxsudo popup asking for permission.

xfpm-power-backlight-helper --set-brightness 0

/etc/xdg/autostart/xfce4-power-manager.desktop is probably responsible for that chain reaction.

This probably needs an /etc/sudoers.d exception.

Patrick · January 15, 2020, 7:43am

github.com

Kicksecure/security-misc/blob/master/etc/sudoers.d/pkexec-security-misc

## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## REVIEW: is it ok that users can find out the PATH setting of root?
#%sudo ALL=NOPASSWD: /usr/libexec/security-misc/echo-path

## xfpm-power-backlight-helper demands environment variable PKEXEC_UID to be
## set. Would otherwise error out with the following error message:
## "This program must only be run through pkexec"
## REVIEW: Can bad things be done by spoofing PKEXEC_UID?
#Defaults:ALL env_keep += "PKEXEC_UID"

github.com

Kicksecure/security-misc/blob/master/etc/sudoers.d/xfce-security-misc

## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## https://forums.whonix.org/t/xfce4-power-manager-xfpm-power-backlight-helper-pkexec-lxsudo-popup/8764
## /usr/share/polkit-1/actions/org.xfce.power.policy

## Feel free to out comment this if you are not using xfce4-power-manager or XFCE.

#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]]
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]]
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness [[\:digit\:]][[\:digit\:]][[\:digit\:]]

#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]]
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]]
#%sudo ALL=NOPASSWD: /usr/sbin/xfpm-power-backlight-helper --set-brightness-switch [[\:digit\:]][[\:digit\:]][[\:digit\:]]

## XXX: Should we allow this?
#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --suspend
#%sudo ALL=NOPASSWD: /usr/sbin/xfce4-pm-helper --hibernate

github.com

Kicksecure/security-misc/blob/master/usr/bin/pkexec.security-misc

#!/bin/bash

## Copyright (C) 2019 - 2022 ENCRYPTED SUPPORT LP <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Redirect calls for pkexec to lxqt-sudo because pkexec is incompatible with
## hidepid.
## * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860040
## * https://forums.whonix.org/t/cannot-use-pkexec/8129

set -e

my_real_path="$(realpath "$0")" || true
identifier="$my_real_path wrapper"
exec > >(systemd-cat --identifier="$identifier output by program:") 2>&1

log_to_journal() {
   echo "$@" | systemd-cat --identifier="$identifier output by wrapper:" || true
}

This file has been truncated. show original