So I am attempting to tweak the way GNOME authenticates a desktop user for privileged applications. Out of the box it asks for the
root password. For my deployment this is undesirable and I want it to re-prompt the user for their password and only allow them access if they are in a certain group (
I have made some progress. If a file exists in
/etc/security/console.apps with the name of the service attempting to be ran (for example
pirut the package manager) then GNOME will ask for a password and elevate the program. Here is the
USER=root PROGRAM=/usr/sbin/pirut SESSION=true KEEP_ENV_VARS=http_proxy,ftp_proxy
If I comment out / remove the
USER=root line then I will be prompted for the user I am currently logged in as, which is what I want. The problem is that as long as the user knows their password then it will launch, so even users not in my group can launch privileged applications.
man console.apps is relevant; however useless:
The /etc/security/console.apps/ directory should contain one file per application that wishes to allow access to console users. The filename should be the same as the servicename, and the contents are irrelevant; the file may be a zero-length file. The application that the file is used by is free to specify the contents in any way that is useful for it.
My question: how do I tell GNOME/ConsoleHelper that the user must also be in a specific to allow execution?