New PCLinuxOS Education soon With enforced security on partitions

[melodie]

Hi,

The subject is about : not letting anyone get into internal partitions without root priviledges. Many schools and also parents do have other systems : Windows, fortunately other Linux partitions too, sometimes. No one would want the children or non experimented people to mess with the files from other systems while using PCManFM...

After a while using the Education at home I realized that after I clicked on the icon of one internal partition, once I had given the root password and clicked on the button "Authenticate", the permission to get into partitions belonging to other systems lasted for all the sessions after, even after reboot, resulting in free access to unprivileged users !

That was not what I expected it to do, therefore I have read most of the documentation now, part of the polkit documentation, polkit-auth, polkit-action and more... went a bit to what dbus does... I still have left a lot to read, got tired... but I understood that I needed to experiment, and more important found how to grant or revoke authorizations from the command line too.

Then I wanted to test in my own system, as there is a Windows sleeping in the bottom of the hard drive, I could do additional tests, such as creating a file in the middle of the system, and wildly erase it.

But in my system where I had edited the PolicyKit.conf before, I didn't meet with the problem and I saw why at once. I will show you screenshots in French, but it should be enough explanatory to get the difference.



The first line where I put an arrow says : "Keep authorisation", while the second line says "Only for this session". In the PCLinuxOS Education available on my web space, this is the window you get.

So I have done a series of tests editing PolicyKit.conf in an install in VirtualBox, until I get exactly the result I have in my system. I didn't want to just switch directly the files, but get to understand what set of configuration does what. I have also downloaded a rpm of policykit to get the model of file we have when we have it as provided.

After this series of tests, I have got this result in the window:



The possibility to memorize authorization has disappeared. Now, each time a storage/internal partition is unmounted, you will be prompted for the root password next time.

In the meanwhile, if the root password has been kept, how to revoke the permission ? This is the command:

Code: [Select]

$ su
passwd
# polkit-auth --user USER --revoke org.freedesktop.hal.storage.mount-fixed
Replace the chain character "USER" by the name of the user.

To get the list of the actions available, you can type "polkit-action" (as user or as root, for this command it is not important).

polkit-action
org.freedesktop.hal.lock
org.freedesktop.hal.leds.brightness
org.freedesktop.hal.power-management.shutdown
org.freedesktop.hal.power-management.shutdown-multiple-sessions
org.freedesktop.hal.power-management.reboot
org.freedesktop.hal.power-management.reboot-multiple-sessions
org.freedesktop.hal.power-management.set-powersave
org.freedesktop.hal.power-management.suspend
org.freedesktop.hal.power-management.hibernate
org.freedesktop.hal.power-management.cpufreq
org.freedesktop.hal.power-management.lcd-panel
org.freedesktop.hal.power-management.light-sensor
org.freedesktop.hal.power-management.keyboard-backlight
org.freedesktop.hal.wol.enabled
org.freedesktop.hal.wol.enable
org.freedesktop.hal.wol.supported
org.freedesktop.hal.killswitch.bluetooth
org.freedesktop.hal.killswitch.wlan
org.freedesktop.hal.killswitch.wwan
org.freedesktop.hal.storage.mount-fixed
org.freedesktop.hal.storage.mount-removable
org.freedesktop.hal.storage.unmount-others
org.freedesktop.hal.storage.eject
org.freedesktop.hal.storage.crypto-setup-fixed
org.freedesktop.hal.storage.crypto-setup-removable
org.freedesktop.hal.dockstation.undock
org.freedesktop.policykit.read
org.freedesktop.policykit.revoke
org.freedesktop.policykit.grant
org.freedesktop.policykit.modify-defaults

You can notice the syntax for the name of the actions. For the internal partitions, it is the lines containing the word storage which are concerned:
* in "org.freedesktop.hal.storage.mount-fixed" : only "mount-fixed" has a dash in the middle. Same for all the other actions, only the main action, at the end of the line, contains a dash.

* In "org.freedesktop.hal.power-management.keyboard-backlight" there is a dash only between the words that are related to the type of action, "power-management", then to the words that define more precisely what particular part of the power-management it is about.

There are not dashes everywhere. The experiments I have done show that it makes big difference in the results according if the syntax respects the dots and dashes or doesn't. (And all the examples and advices I have read on the web about the PolicyKit.conf file are loose about that).

So what will you do with the PCLinuxOS Education you already have ? If you have installed it, you can get the PolicyKit.conf file I have modified for it here, and install it in the /etc/PolicyKit/ directory. It is a zip file with the permissions already correct inside, so if you copy the zip to /etc/PolicyKit/ as root, and then unzip it there as root, all you will have left to do, will be to remove the archive and restart hal as root:

Code: [Select]

# service haldaemon restart
And your PCLinuxOS Education will be more secure, for the poor Ntfs partitions, particularly.

I have also sent a mail to Texstar, with the same  information, and as he has not yet come back to say if he tested the PCLinuxOS Education version, I think I still have time to do a new remaster with this change in it, and take advantage to update it.

Regards,
Mélodie

[Texstar]

I've already stated in the past I have no interest in educational software what so ever. It doesn't mean you can't make an iso, host it or even announce it on the forum.

Cheers,
Tex

[melodie]

I've already stated in the past I have no interest in educational software what so ever. It doesn't mean you can't make an iso, host it or even announce it on the forum.

Cheers,
Tex

Hello Texstar,

I didn't know about this statement of your's. I can host it, no problem about that, and will make the announcement. The announcement will be made as soon as the newer versions will be available.

Thank you very much !!! 

Mélodie

[Texstar]

Do you have plans to post anything about your openbox isos in the General Announcement area of the forum? Both have been uploaded to ibiblio and have been mirrored.

[melodie]

Do you have plans to post anything about your openbox isos in the General Announcement area of the forum? Both have been uploaded to ibiblio and have been mirrored.

Yes I do. Johnston has volunteered to write the presentation for the full Openbox, and I started to read it and modify things in the middle of last night. I have still to boot to it and check exactly about the programs install as I don't have it all in mind. I'll try to do that next this evening, probably late. I have other things that call me out this afternoon.

Regards,
Mélodie

[djohnston]

Openbox Desktop

All about the PCLinuxOS Openbox 2011.08 desktop



Release Date: 08-19-2011
Size: 683MB
Md5Sum: 6b6f2fef62875d8604d45183ae2a40ff
Produced by: Melodie
User Level:  Intermediate, Advanced

Info:
Openbox is an extremely fast-performing and energy-saving desktop environment. Openbox is not a desktop manager, it is a window manager with extended features. But with the addition of a few small programs, a full desktop is achieved. It is also unique as a “stand-alone” Openbox version thanks to openbox-menu. This small program  allows you to have Openbox right-click menus which are dynamically reloaded each time you add or remove a program, as does any full desktop with a task panel and program menu launcher. The standard Openbox installation does not provide these capabilities. Openbox uses less CPU and less RAM than other environments. It is especially suited for cloud computers with low hardware specifications, such as netbooks, mobile devices (e.g. MIDs) or older computers. It is also well-suited to modern computers with fast CPUs and lots of RAM. You can install your favorite programs in an environment that leaves more of the computer's resources available for CPU and memory-hungry applications.

Features:

Kernel
2.6.38.8-bfs kernel for maximum desktop performance.

Full Openbox Desktop.
Nvidia and ATI fglrx driver support.
Multimedia playback support for many popular formats.
Wireless support for many network devices.
Printer support for many local and networked printer devices.
Addlocale allows you to convert PCLinuxOS into over 60 languages.
LibreOffice full edition installed.
MyLiveCD allows you  to take a snapshot of  your installation and burn it to a LiveCD/DVD.
PCLinuxOS-liveusb – allows you to install PCLinuxOS on a USB key disk.

Highlighted Applications:
LibreOffice – full version installed on LiveCD
Bleachbit – system cleaning program
LXPanel - panel with system menu, program launcher, window docker and system tray
ePDFViewer – PDF viewing client
Fileroller – archiving client
Firefox- web browser (Chromium and Opera available from our software center)
flash-player-plugin – flash support
GIMP – graphic drawing program
ImageMagick – graphics manipulation
Viewnior – graphics viewing program
GnomeBaker – CD/DVD burning program
kernel-2.6.38.8-pclos1.bfs-1 – BFS kernel for maximum desktop performance
Geany – text editor
PCLinuxOS-LiveUSB Creator – Put PCLinuxOS on USB key disk (New on LiveCD)
DeadBeef- music player
mc and mcedit – Norton Commander-style file manager and text editor
PCManFM- file manager
MTPaint and MTPaint Screenshot – paint and screenshot programs
VLC – multimedia video and audio player
Sylpheed – email program
XChat – IRC client
ClamTK – virus scanner
Osmo – calendar, notepad and task reminder
RadioTray – internet radio player
SGSearch – desktop search program
GTKam – digital camera photo manager
Gajim Instant Messenger – IM client
Xsane – scanner program

12,000 additional programs available from our Synaptic Software Manager after installation to your computer.

Hardware requirements

Processor
Modern Intel or AMD processor.

Memory & storage
RAM : 384 MB minimum, 1 GB recommended.
Hard disk : 5 GB minimum, 10 GB or more recommended if you plan to install additional software from our repository.

Video card
nVidia, ATI, Intel, SiS, Matrox, VIA.
3D desktop support requires a 3D instructions set compatible card.
Sound card
Any Sound Blaster, AC97 or HDA compatible card.
Other
CD/DVD drive required

Openbox Mini Version “Bonsai”



Release Date: 08-18-2011
Size: 263MB
Md5Sum: 6e979f3a2c733447643c70e471a1ec42
Produced by: Melodie
User Level:  Advanced

Features:
Kernel 2.6.38.8-bfs kernel for maximum desktop performance.
The proprietary video drivers are not included. The zram swap-to-RAM kernel module, present in the kernels of all PCLinuxOS versions since kernel 2.6.37, is preconfigured. This Openbox version is intended for advanced users who know what programs and features they want, and do not want to uninstall unwanted programs.

Highlighted Applications:
ssh – secure shell
lftp – advanced file retrieval tool that supports FTP and HTTP protocols
tint2 - panel with window docker and system tray
Geany – text editor and programming IDE
Midori - web browser (Firefox, Chromium and Opera available from our software center)
PCManFM – File manager
mc – CLI file manager and utilities


EDIT: corrections made

[melodie]

Hi Johnston,

First a great thank you for this presentation. It is one of the greedy things which need to be done and having your versions to work on has been a very valuable gain of time for me.

I would just like you to change one little thing. It is about zram, I think we can't talk about a device as long as it has not been activated. In the PCLinuxOS distributions, no one will find it until they seek in the kernel configuration file. So I would rather like you to talk about a module. Isn't that the correct naming in English for theses little items we have to put "yes" or "m" or ignore when configuring the kernel ?

In place of this sentence:

The zram swap-to-RAM device, present in all versions of PCLinuxOS since kernel 2.6.37, is preconfigured.

I suggest:

The zram swap-to-RAM module, present in the kernels of all actual available versions of PCLinuxOS, is preconfigured

If it seems ok to you, of course. The rest seems perfect.

Regards,
Mélodie

[djohnston]

I would just like you to change one little thing. It is about zram, I think we can't talk about a device as long as it has not been activated. In the PCLinuxOS distributions, no one will find it until they seek in the kernel configuration file. So I would rather like you to talk about a module. Isn't that the correct naming in English for theses little items we have to put "yes" or "m" or ignore when configuring the kernel ?

In place of this sentence:

The zram swap-to-RAM device, present in all versions of PCLinuxOS since kernel 2.6.37, is preconfigured.

I suggest:

The zram swap-to-RAM module, present in the kernels of all actual available versions of PCLinuxOS, is preconfigured

Changes have been made.

[melodie]

Changes have been made.

Thank you mighty contributor and kind Sir !
I would like you to be the one to bring The Colours of this Community Flavor to the News and Announcements Forum ! If you do not do that in a row, would you be willing to give it a fast whirl to get sure everything works as expected ?

Thank you so much for you help,
Mélodie

[djohnston]

Thank you mighty contributor and kind Sir !
I would like you to be the one to bring The Colours of this Community Flavor to the News and Announcements Forum ! If you do not do that in a row, would you be willing to give it a fast whirl to get sure everything works as expected ?

Thank you so much for you help,
Mélodie

With much fanfare and blaring horns? Announcement has been made.

http://www.pclinuxos.com/forum/index.php/topic,96396.0.html

[melodie]

Thank you mighty contributor and kind Sir !
I would like you to be the one to bring The Colours of this Community Flavor to the News and Announcements Forum ! If you do not do that in a row, would you be willing to give it a fast whirl to get sure everything works as expected ?

Thank you so much for you help,
Mélodie

With much fanfare and blaring horns? Announcement has been made.

http://www.pclinuxos.com/forum/index.php/topic,96396.0.html

Great !
I would also like you to do so for the PCLinuxOS Education version. This is also about it I was thinking when talking about a last test (from someone else than myself) : http://www.pclinuxos.com/forum/index.php/topic,94160.msg813933.html#msg813933

Regards,
Mélodie

[jlf001]

Thank you mighty contributor and kind Sir !
I would like you to be the one to bring The Colours of this Community Flavor to the News and Announcements Forum ! If you do not do that in a row, would you be willing to give it a fast whirl to get sure everything works as expected ?

Thank you so much for you help,
Mélodie

With much fanfare and blaring horns? Announcement has been made.

http://www.pclinuxos.com/forum/index.php/topic,96396.0.html

djohnston,

Really nice job,

Jeff

[djohnston]

Thanks, Jeff. A lot of it was copy and paste. And rewrites. And rewrites. 

[jimwilk]

I have downloaded the revised iso and have just burned a live CD. Will try it out and then pass it to the grandchildren for another test drive. They loved the earlier copy.

Well done team.

Jim