Why does GTK polkit password dialogue work, but not QT?

[HubKing]

https://github.com/neutrinolabs/xrdp/wiki/Tips-and-FAQ says that being remote makes it different from local sessions. But I don't understand why GTK works and QT does not. If both of them not worked, it would have been easier to understand.

I tried both XFCE Manjaro and KDE Manjaro. The result was the same. GTK apps such as Gparted or Pamac can show the polkit password dialogue. But QT apps like KDE Parition Manager or Manjaro Settings silently failed to show the dialogue and thus failed to do its job.

Is this a problem of the QT framework? Is there a way to make QT polkit work, too?

Screenshot: GTK apps show polkit

Screenshot: QT apps fail to show polkit

Screenshot: The same QT apps show polkit when logged in locally.

[matt335672]

A couple of things for you to look at:-

1. One thing we found in Xrdp session Kubuntu 20.04 , how to increase rights? #1773 is that if the applications can fail if the PATH is not the same. Check that PATH is the same in local and remote sessions
2. If that's not it, look at https://github.com/matt335672/pk-local . This is a test tool (NOT for production) which should let you narrow down any problems with polkit.

[HubKing]

Found out the reason. It was not because whether it is QT or GTK. It was because of the presence of <allow_any>auth_admin</allow_any> in the policy files under /usr/share/polkit-1/actions, and it just happened to be that all GTK/Gnome apps on the computer had it and all the QT apps did not.

Gparted

KDE Partition

When I modified the policy file of KDE Partition and add <allow_any>auth_admin</allow_any>, it showed the password dialogue.

[HubKing]

Do you think it is meaningful to have different "defaults" for local ("active") and XRDP ("any")? If the attacker doesn't know the sudo user's password, he can't use the app even if the polkit password dialogue shows up. If he does know the password, then even if the policy prevents the app from showing the polkit dialogue, he could simply open a terminal inside of XRDP, and then modify the policy file using sudo to make the polkit dialogue work.

Also, you wrote that "RDP transport is encrypted using TLS by default.", so the password the user type inside of XRDP is not exposed to the network. What potential additional security risks would be added by allowing the user to use polkit authentication in XRDP? Is this that there might be a key logger on the RDP client PC and when the user types the password in the polkit dialogue, the password could be stolen?

[matt335672]

The policies are nothing to do with xrdp itself (we have no control over them), but you'll come across them if you use a polkit-managed system.

All distros provide locked-down remote policies by default. This makes systems as safe as possible out-of-the-box.

Once you've analysed your use cases and risks you can develop a security policy for your organisation. If that lets you open things up a bit, that's fine - no-one's going to stop you doing that. By doing it this way, there's a trail of why particular decisions have been made. That's important when it comes to your regular policy reviews, as changing circumstances may well have an effect on those decisions.

This isn't just my opinion BTW - there's an ISO standard which covers this. It's been around a long time.