[FFe] passwordless install of webapps (based on repo whitelist)

The approch seems fine to me, those don't really have lot of code and those websites can already be accessed without password from a web browser anyway, I would still like to get the security team opinion on the topic though, installing random .js from the web in an easy way is somewhat a bit scary ;-)

There are two requests in this bug, the first being to add whitelist functionality to aptdaemon, and the second is to add a webapps repository to that whitelist. I will address them separately.

Aptdaemon:

I believe adding the whitelist functionality to aptdaemon is reasonable. This would also permit enterprise environments to allow their users to install a pre-approved subset of optional packages. Perhaps two whitelists and policykit rights should be added, one for users in the admin group, and a second for regular users who are logged into the console.

Webapps repo whitelist:

We would tolerate being able to install webapp packages without a password with the following caveats:

1- Installing without a password is limited to users in the "admin" group.
2- The repository whitelist for aptdaemon is shipped in a separate "webapps"-named package, and not part of the aptdaemon package.
3- Up-to-date documentation for the exact steps required for auditing the security of contributed webapp scripts. This needs to be written by someone familiar with the intricacies of how the scripts are integrated in the browser security model and how the webapps functionality was implemented.
4- An webapp script security scanning tool that can detect basic security flaws, and can be updated with new flaws as they are discovered.
5- A policy in place to systematically audit new webapp scripts and improvements to existing webapp scripts using the documentation and the scanning tool before they are accepted into the repository.
6- Tracking of a "sign-off" procedure to determine when the security auditing of contributed scripts was performed, by who, and with what revision of the auditing documentation and script.

The security team also reserves the right to remove the password exception at its discretion in the case where webapp scripts are used to facilitate malware attacks.

Thanks a lot Marc for your thoughts on this topic.

I'm working on this currently in the linked branch and for (1) and (2) we will need something like the
"policykit-desktop-priviledges" package for webapps that install something like
"/var/lib/polkit-1/localauthority/10-vendor.d/com.ubuntu.webapps.pkla" with:
"""
[Whitelisted installs]
Identity=unix-group:admin;unix-group:sudo
Action=org.debian.apt.install-packages-from-whitelisted-repo
ResultActive=yes
"""

The steps (3) - (6) I will defer to the webapps team.

The whitelist file looks like:

$ cat /etc/aptdaemon/repository-whitelist.cfg

[webapps test]
origin = Ubuntu
component = universe
pkgnames = 2vcard

[more whitelist]
origin = Ubuntu
component = main
pkgnames = ^unity.*

Approved on the condition that the security team confirms the current implementation matches their requirements and that this lands on the 17th at the latest (so we have room to revert before beta2 freeze if something goes wrong).

The aptdaemon changes proposed matches our requirements, as it's just the framework, not the whitelist file itself.

The whitelist file for webapps needs to be in a separate package, and the requirements listed must be met for that.

This bug was fixed in the package aptdaemon - 0.45+bzr861-0ubuntu1

---------------
aptdaemon (0.45+bzr861-0ubuntu1) quantal; urgency=low

  * New upstream snapshot:
    - lp:~mvo/aptdaemon/support-for-whitelisted-repositories that adds
      support for a new trusted-repo policykit action LP: #1035207
    - lp:~vorlon/aptdaemon/lp.1034806 that fixes unicode/str errors
      LP: #768691, #926340, #1034806
  * debian/patches/fix_gettext_return_value_type.patch:
    - dropped, merged as part of lp:~vorlon/aptdaemon/lp.1034806
 -- Michael Vogt <email address hidden> Thu, 13 Sep 2012 09:13:07 +0200