News for hackers. Stuff that matters.
Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by pavon on Tuesday January 25, 2022 @10:33PM (#30081346)
Yes. On my Debian Stable desktop the only packages that required it were:

* rtkit - optional dependency of PulseAudio to grant its processes realtime priority.

* colord - optional color profile dbus service.

* gparted - hard dependency to give it permission to reformat disks.

I like to keep a minimal system, so I went ahead and removed them all. Will see if audio performance suffers.

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by throwawaysysd on Tuesday January 25, 2022 @11:40PM (#30081793)
You can still get realtime priority for threads without rtkit but you will have to set the appropriate permissions on your user. See the section on privileges: https://www.man7.org/linux/man-pages/man7/sched.7.html

I wouldn't suggest giving those permissions to your user because it opens up the possibility of a denial of service. With those permissions, any program running as your user can spawn lots of realtime threads that can take over the scheduler and lock the system up. This was detailed in the rtkit announcement, and preventing it is the reason rtkit exists: http://lalists.stanford.edu/lad/2009/06/0191.html

Maybe realtime audio is not important to you, and that's fine. But it's never as simple as "delete these things and now I have a secure system", you may be trading off security elsewhere to get that. Please also note that pkexec is not required to use polkit. You can remove pkexec and still have a functioning polkit installation and still use all those other daemons too. For a really secure system you may want to remove all suid binaries anyway and only use polkit or SELinux or something.

Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by trasz on Wednesday January 26, 2022 @03:04AM (#30083001)
So essentially a whole another daemon/service designed to provide a fake permission system for real-time privileges?
Re:Pwnkit: Local Privilege Escalation in polkit's pkexec (CV... by yrro on Wednesday January 26, 2022 @08:20AM (#30085049)
Nothing fake about it? That is one of the actions that RealtimeKit allows clients to request:

    $ pkaction --action-id org.freedesktop.RealtimeKit1.acquire-high-priority --verbose org.freedesktop.RealtimeKit1.acquire-high-priority:
      description:       Grant high priority scheduling to a user process
      message:           Authentication is required to grant an application high priority scheduling
      vendor:            Lennart Poettering
      vendor_url:        
      icon:              
      implicit any:      no
      implicit inactive: yes
      implicit active:   yes
In the default configuration that will be granted to clients that are part of a local console session, but denied to clients that are not (e.g., batch jobs, SSH). That policy can be further customized by the OS vendor, organization, site, or local admin in quite a flexible way.