Bug 97518 - [Patch] Don't require admin to change own password, use auth_self
Summary: [Patch] Don't require admin to change own password, use auth_self
Alias: None
Product: accountsservice
Classification: Unclassified
Component: general (show other bugs)
Version: unspecified
Hardware: All Linux (All)
: medium normal
Assignee: Matthias Clasen
QA Contact:
Depends on:
Reported: 2016-08-28 19:57 UTC by David Edmundson
Modified: 2018-08-07 09:30 UTC (History)
4 users (show)

See Also:
i915 platform:
i915 features:

patch (3.45 KB, patch)
2016-08-28 19:57 UTC, David Edmundson
Details | Splinter Review

Description David Edmundson 2016-08-28 19:57:08 UTC
Created attachment 126087 [details] [review]
Comment 1 Ray Strode [halfline] 2017-08-18 13:24:05 UTC
Comment on attachment 126087 [details] [review]

Review of attachment 126087 [details] [review]:

makes sense to me, and sorry for the delay.  I think we should be specific with the action name, though.  since really org.freedesktop.accounts.change-own-user-data could be just as restricted, depending on the policy, having org.freedesktop.accounts.change-own-user-data and org.freedesktop.accounts.change-own-user-data-restricted isn't super clear.

::: data/org.freedesktop.accounts.policy.in
@@ +17,4 @@
>      </defaults>
>    </action>
> +  <action id="org.freedesktop.accounts.change-own-user-data-restricted">

so i'm going to call this org.freedesktop.accounts.change-own-password.  Though at some point we may want to go really fine grained, and do something that could facilitate globs... say


etc etc.  we'll save that for another day...
Comment 2 Ray Strode [halfline] 2017-08-18 13:28:37 UTC
Thanks pushed to ssh://git.freedesktop.org/git/accountsservice

   9fdd1d9..1b91ffc  master -> master
Comment 3 Ray Strode [halfline] 2017-08-18 16:41:23 UTC
so one thing I didn't quite think about this morning, but remembered at lunch is the rules are different for what passwords are allowed.  If we let the user do this without a password we should really enforce the policy rules for passwords.

For now i'm going to set the policy by default to auth_admin, effectively reverting this behavior (but still letting admins set it in their own deployment).

I think we'll probably need to go through PAM if we want to allow a user to change his own password, so we follow the same rules as the passwd command etc.

That's going to probably require a different looking interface than SetPassword, since it entails an interactive conversation between the caller and the authentication system.
Comment 4 Ray Strode [halfline] 2017-08-18 19:09:04 UTC
commit ccd8388dd026c390667d7bfc6744a730d951166d
Author: Ray Strode <rstrode@redhat.com>
Date:   Fri Aug 18 12:41:59 2017 -0400

    data: require an adminstrator password to change own password
    We need to enforce this, because otherwise we're allowing the
    user to bypass password sanity enforcement rules.
    This commit changes the newly added change-own-password action to
    be auth_admin.
Comment 5 Budi Utomo 2018-08-01 20:23:20 UTC
jadi saya akan memanggil org.freedesktop.accounts.change-own-password ini. Meskipun pada titik tertentu kita mungkin ingin berbutir halus, dan melakukan sesuatu yang dapat memfasilitasi globs ... katakan
dll. kita akan menyimpannya untuk hari lain ...
Ray Strode [garis batas] <rstrode@redhat.com>
Comment 6 GitLab Migration User 2018-08-07 09:30:54 UTC
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/accountsservice/accountsservice/issues/17.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.