why use pkexec about add-to-desktop HOT 8 CLOSED

As you can see I changed the shortcut implementation, now I'm coping the original .desktop file.

No more pkexec and no more sudo prompt.

Feel free to download and test this new update, just clone master branch and use it as your extension folder. Now it is compatible with every gnome-shell after 3.28 afaik.

If this works without any problem we can close this issue because pkexec is gone, let me know.

from add-to-desktop.

I don't agree, root owns preinstalled application at /usr/share/applications and I believe you need sudo for those apps, tell me if I'm missing something.

If avoiding pkexec is so important I'm planning to add a new mode to use copy of the launcher files instead of using links, for copies chmod is not required.

I have some idea to solve the copy related problems pointed out in the README.md

For this to happen you need a bit of patience

from add-to-desktop.

Gio can wrtite permissions if extension is installed in /usr/share/gnome-shell/extensions/

i think copying .desktop file will also require changing permissions, this is what i am using currently, works just fine

_createLink() {
    let desktop = GLib.get_user_special_dir(GLib.UserDirectory.DIRECTORY_DESKTOP);
    let src = Gio.File.new_for_path(this._appPath);
    let dst = Gio.File.new_for_path(GLib.build_filenamev([desktop, src.get_basename()]));
    try {
        src.copy(dst, Gio.FileCopyFlags.OVERWRITE, null, null);
        this._markTrusted(dst);
    } catch (e) {
        log(`Failed to copy to desktop: ${e.message}`);
    }
}
async _markTrusted(file) {
    let modeAttr = Gio.FILE_ATTRIBUTE_UNIX_MODE;
    let trustedAttr = 'metadata::trusted';
    let queryFlags = Gio.FileQueryInfoFlags.NONE;
    let ioPriority = GLib.PRIORITY_DEFAULT;

    try {
        let info = await file.query_info_async(modeAttr, queryFlags, ioPriority, null);
        let mode = info.get_attribute_uint32(modeAttr) | 0o100;
        info.set_attribute_uint32(modeAttr, mode);
        info.set_attribute_string(trustedAttr, 'yes');
        await file.set_attributes_async(info, queryFlags, ioPriority, null);
    } catch (e) {
        log(`Failed to mark file as trusted: ${e.message}`);
    }
}

from add-to-desktop.

I will try this as soon as possible, thanks for spending your time on this project.

Just to be clear you say that automatic installed extensions can edit root owned files without asking for password? This seems very insecure to me.

from add-to-desktop.

What you are doing with this code is creating a copy of the original .desktop file stored at this._appPath, this method avoids pkexec.

That said this extension uses soft links instead and with your code you are not making any soft link, the reason to use links instead of copies is pointed out in README.md in section 'How does it work'.

I will add copies support but I have to automatically solve those problems.

from add-to-desktop.

I will try this as soon as possible, thanks for spending your time on this project.

Just to be clear you say that automatic installed extensions can edit root owned files without asking for password? This seems very insecure to me.

I think most users won't like a sudo prompt for adding desktop shortcuts, and that's how it works with most core gnome-shell-extensions @ https://github.com/GNOME/gnome-shell-extensions, you can add an option for installing as builtin

What you are doing with this code is creating a copy of the original .desktop file stored at this._appPath, this method avoids pkexec.

That said this extension uses soft links instead and with your code you are not making any soft link, the reason to use links instead of copies is pointed out in README.md in section 'How does it work'.

I will add copies support but I have to automatically solve those problems.

both soft links and desktop files should work, my example just happens to use desktop entries.

from add-to-desktop.

I think most users won't like a sudo prompt for adding desktop shortcuts

I think you are right, this layout isn't the best, we should find a better solution.

you can add an option for installing as builtin

Honestly If you explain it more I would appreciate it but I prefer if the extension works pretty much the same with any kind of installation. In fact you can always copy the original desktop file to the Desktop folder with no sudo, no matter how you installed the extension.

I will work on that in the next days (starting today), tell me if you have something more to say about it

from add-to-desktop.

@Tommimon Sounds great.
I am using a modified version currently, will try out the new one once i get a chance.

from add-to-desktop.