{"id":149,"date":"2007-08-03T00:39:07","date_gmt":"2007-08-03T00:39:07","guid":{"rendered":"http:\/\/ubuntucat.wordpress.com\/2007\/08\/03\/file-browser-privilege-escalation-done-right\/"},"modified":"2010-02-03T19:10:01","modified_gmt":"2010-02-03T23:10:01","slug":"file-browser-privilege-escalation-done-right","status":"publish","type":"post","link":"https:\/\/www.psychocats.net\/ubuntucat\/file-browser-privilege-escalation-done-right\/","title":{"rendered":"File Browser Privilege Escalation Done Right"},"content":{"rendered":"

Even though there is a bug report on this for Nautilus,<\/a> I didn’t include proper implementation of privilege escalation as one of The Top 5 Gnome\/Ubuntu Usability Bugs I\u2019d Love to See Fixed<\/a> (well, it would then be six instead of five, anyway)—mainly because it’s not unique to Gnome. <\/p>\n

I haven’t seen proper file browser privilege escalation implemented in Gnome, KDE, or Xfce. I haven’t seen it done well in Windows XP or Mac OS X, either. <\/p>\n

Right now in Windows XP, if you’re not the administrator (and, for safety’s sake, you really shouldn’t<\/i> be logged in as the administrator), there’s no easy way to temporarily become the administrator to edit a file or two. You can’t right-click the file and Open as…<\/i> a different user. You can’t right-click Explorer and Run as…<\/i> a different user. Basically, unless there’s something I don’t know about (Windows fans, please pipe up! I have to use Windows at work, and it’d be great to know if a solution exists), you have to log out of the current user, log in as the administrative user, make the change, and log back in again as the original user. <\/p>\n

Same deal for Mac OS X. You can’t just open Finder as an administrator. In fact, because Mac OS X has a better security implementation (it uses sudo<\/i>, same as Ubuntu) than XP’s, even an administrator can’t modify system files through Finder. You have to enable the root account and use its Finder, or make changes through the terminal. <\/p>\n

Desktop Linux has one up on Windows and Mac in this regard, but it’s still not completely smooth. If you know you’re going to modify a system file, you can launch your file browser window with root (or administrator) privileges even within a regular account. If you have Konqueror plugins, Nautilus scripts, or Thunar custom actions, you can right-click on a system file and edit it as root. <\/p>\n

To be fully smooth, file browsers should have drag-and-drop authentication. <\/p>\n

In other words, a Ubuntu user, for example, who happens to be in the admin<\/i> group (meaning that she can sudo<\/i> to temporarily gain root privileges for a particular task) can drag a file to a system folder and instead of getting the old Access denied: You do not own that folder<\/b> warning, she gets an authentication dialogue: <\/p>\n