Re: [gnome-love] Graphical 'su' utility for GNOME

[Hongli Lai <hongli telekabel nl>]

On 2001.10.24 05:30:04 +0200 Malcolm Tredinnick wrote:
> > BTW, is it acceptable for a GNOME program to depend on kdelibs?
> > I don't know any GNOME machines that don't have KDE as well.
>
> No, that's a generally bad idea. For example, if somebody was trying to
> use GNOME in an embedded application (e.g. a PDA), then you have just
> increased the storage requirements by a significant amount by requiring
> the core KDE libraries, the C++ runtime support, etc.

I never imagined GNOME being able to run on embedded devices. :-)


> What is missing
> from the GNOME libraries that you need?

For example, classes similar to TtyProcess and SuProcess (which are
part of kdelibs). They really save a lot of work, but now I
have to try to port them over to GNOME.


> Some other observations...
>
> An 'su' utility needs to run setuid root, introducing all of the
> inherent security problems. Previously, there has been advice _not_ to
> use ther GTK libraries in a setuid application, since they haven't been
> designed or audited for that purpose. That advice may well still apply
> -- search some of the gnome-devel and gtk-* mailing list archives for
> the relevant threads here.

Kdesu, and therebefore gnomesu, creates a terminal for su, and sends
the password to the terminal.
It's not setuid root, it just "emulates the keyboard" for su.


> You possibly have a license conflict in your source code. Libgnome and
> the GTK group of libraries are all LGPL and your product requires those
> to compile and run. I think that conflicts with part 3(a) of the
> Artistic License you have included (IANAL, so draw your own conclusions,
> but it seems like you could alter the source and not contribute back
> changes just by renaming some things, which is not allowed if the
> sources you alter are the LGPL portions). I would rather avoid a license
> debate on this list, but that is something you and your fellow
> maintainers will need to work out.

I wish I can use the GPL or LGPL too, but kdesu is licensed under
the Artistic license so I can't do much about it.