4

Why do I not need to install as root when the shell "guesses" the package I need to execute a command?

For example: 

(cseymour) : ~ $ dnf install rogue
Error: This command has to be run under the root user.
(cseymour) : ~ $ rogue
bash: rogue: command not found...
Install package 'rogue' to provide command 'rogue'? [N/y] y


 * Waiting in queue... 
The following packages have to be installed:
 rogue-5.4.5-19.fc24.x86_64 The original graphical adventure game
Proceed with changes? [N/y] y


 * Waiting in queue... 
 * Waiting for authentication... 
 * Waiting in queue... 
 * Downloading packages... 
 * Requesting data... 
 * Testing changes... 
 * Installing packages...

and so on, successfully installing the package without requiring root password.

Improve this question

1 Answer 1

Reset to default
2

There is small package PackageKit-command-not-found installed in Fedora, that makes this happen. The policy is configured in /etc/PackageKit/CommandNotFound.conf.

The authentication is done using PolicyKit (over D-bus), where you already granted installation of new package using PackageKit GUI. The respective file is usr/share/polkit-1/rules.d/org.freedesktop.packagekit.rules allowing to install packages for locally logged in users in wheel group:

polkit.addRule(function(action, subject) {
    if (action.id == "org.freedesktop.packagekit.package-install" &&
        subject.active == true && subject.local == true &&
        subject.isInGroup("wheel")) {
            return polkit.Result.YES;
    }
});

If you are not satisfied with this behaviour, you can always uninstall this package (dnf remove PackageKit-command-not-found) and the packages will not get installed automatically.

Improve this answer
4
  • Thanks so much! Given this is installed by default, why is it that dnf deems to use a password request rather than something similar? Are these differing behaviours intentional?
    – csey
    Nov 1, 2016 at 20:22
  • Because dnf is not PackageKit and the rule above is only for PackageKit. DNF is standard command-line tool, that needs root privileges, but PackageKit is using authentication using D-Bus and some backend already running as a root.
    – Jakuje
    Nov 1, 2016 at 20:24
  • 1
    @csey I agree that it's inconsistent. You can also install software without a password using the GNOME Software GUI tool. I think it's mostly just that the behavior which we decided is okay for command-not-found and GUI installs is to install packages from already-configured repos. Since Fedora in general avoids activating services simply on installation, the risk of this is fairly low. On the other hand, DNF can do a lot of other things, many of them dangerous.
    – mattdm
    Nov 2, 2016 at 18:54
  • @mattdm thank you for the addition and background, which I was missing (still only few years around Fedora). I will add it to the answer or you can edit it in, since it can be interesting also for others.
    – Jakuje
    Nov 2, 2016 at 18:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .