Security Concern

**gogalthorp** · 18-Aug-2021, 18:30

no-allow-vendor-change is not strictly need since that is now the default. But always dup not up on Tumbleweed

**jwhitmor** · 19-Aug-2021, 18:30

Originally Posted by squidflame

So if you could check if the screenshot in the Fedora post is the same dialog you are/were seeing on shutdown, that may (somewhat) confirm that what you were seeing was a GNOME feature. That it does not ask for a password may the result of polkit, which is (I think) what allows GNOME’s Palimpsest Disk Utility to run without asking for elevation via gksudo or a similar sort of prompt.

?

I looked at the Fedora post screen capture. I did not have the same experience. The Fedora instance clearly allows a decision to abort (Abbrechen). I had no opportunity to intervene. I got a fairly blank screen that said "Installing Software" and the other defining feature was the animated progress bar, running across the center of the screen. I should have used my camera to get a photo. A screen capture was not possible. It did not however look like a standard terminal screen. It was more "graphical" than a basic terminal text screen.

There may be a log of what was installed, but I am not sure where to look.

**jwhitmor** · 19-Aug-2021, 18:37

Just a few days, but I have not had a repeat of the strange behavior since I followed Malcolm's advice. (installed 20210810 by tumbleweed-cli)

**jwhitmor** · 04-Feb-2022, 15:50

Back to my original question. The progress bar has returned. Either many have seen it, or I need to throw my hard drive in the burn pile.
I update regularly with tumbleweed-cli.
Any guess why my O.S. is volunteering to install software for me, at the more vulnerable time before the O.S. loads?
Thank You!
(link to a photo of the screen) https://imgur.com/a/rsSmxq5?nc=1

**malcolmlewis** · 04-Feb-2022, 16:20

Originally Posted by jwhitmor

Back to my original question. The progress bar has returned. Either many have seen it, or I need to throw my hard drive in the burn pile.
I update regularly with tumbleweed-cli.
Any guess why my O.S. is volunteering to install software for me, at the more vulnerable time before the O.S. loads?
Thank You!
(link to a photo of the screen) https://imgur.com/a/rsSmxq5?nc=1

Hi
That's part of plymouth startup/shutdown and I guess packagekit, I have neither present.

**jwhitmor** · 07-Feb-2022, 09:18

I sometimes experiment with other distros. I have never seen Plymouth use that screen, but of course, it is up to the author who complied the distribution.
I think it is illogical, since it allows "updates" to be inserted without any kind of authorization. That is very risky in my opinion. Could be just exceptional paranoia,
but considering I live in the USA, where everyone thinks your phone, and computers, belong to them (not you) please forgive me.
If the Dev.s read this, consider removing that code.

Thank you, MalcomLewis