Sudo is not allowed for Dolphin, Kate, etc in Kubuntu 18.04 Beta

[funkybomber]

[you can still start other GUI apps as root, like krusader], and while the vulnerability is currently not actively abused [to my knowledge], I'd bet the backlash to be bigger if user's computers were overtaken because the devs chose not to do something about it.

I beg to differ on the supposed backlash if the devs did nothing about it, for a couple of reasons:
1) I am still running Linux Mint 17.3 KDE in one of my systems, which is still officially supported until 2019. The vulnerability is still there in KDE 4 but it has not been patched. I can run Dolphin as sudo. I haven't heard anyone complain about that. If it was such a big deal perhaps someone would have said something.
2) There is an actual backlash against removing sudo functionality from Dolphin (while still unable to prove the final KIO policy fix). From my point of view that patch did more harm than good.
3) People who would create a backlash about that have much bigger problems to think about: Vulnerabilities such as Spectre/Meltdown etc, their attack surface (be it Kernel or whatever other software stack they run on their server). For these people there is also the option to run an Ubuntu flavor without a GUI. The KDE dev responsible for this should just spare us common folks.

The new method will eventually fix the security issues, as there are no root GUI windows opened in the process (as there is no need to do so). The newer method will have other benefits as well, like being more intuitive (for most) and will also continue working after the looming wayland transition.

Yes, eventually it will. In the meantime it is just causing unwarranted pain to a lot of loyal KDE users. For a long time, if a may add:
https://bugs.kde.org/show_bug.cgi?id=179678

Quote from the blog post you provided:

"I am also aware that if you run an application which is malicious you are already owned. I think that we should protect nevertheless."

Protect against what? If you're owned, you're owned. Better luck in your next installation.

By the way, thanks to everyone providing alternatives. Much appreciated. There are some interesting choices there.
In my case though, this is not about just editing files. Sometimes I just run dolphin in root in order to quickly unmount a drive. I'm not a terminal expert and to be frank I don't care to become one.
If I can use Thunar, or Konqueror with sudo mode I will still do that, even if I am still "vulnerable". These are also GUI apps, right? Why didn't their developers remove sudo access as well?

Sorry if I sound cranky, I am. A bit. This is the next LTS version of Kubuntu we're talking about, it has to be better than that!
Anyway, I feel better now. :|

[Sothis6881]

I thought a password prompt is now given when attempting to edit/paste/etc. when elevated permissions are required.

[kubicle]

1) I am still running Linux Mint 17.3 KDE in one of my systems, which is still officially supported until 2019. The vulnerability is still there in KDE 4 but it has not been patched. I can run Dolphin as sudo. I haven't heard anyone complain about that. If it was such a big deal perhaps someone would have said something.

KDE4 isn't supported anymore by the KDE devs, nor are other desktop environments...The "fix" was made, but not backported to old releases. Whether linux distributors (like mint) wish to support other desktop environments/versions without fixing it, that's their call. And quite a few people have actually "said something"...whether other people will listen (or agree) is a completely different matter. GNOME (and Debian) has also removed gksu altogether (a more drastic step) and are also moving to policykit (which is to only way forward with Wayland).

2) There is an actual backlash against removing sudo functionality from Dolphin (while still unable to prove the final KIO policy fix). From my point of view that patch did more harm than good.

There will be a backlash whatever you do in this case. I as a developer (not a KDE developer, though), would put security first despite the backlash, but everyone has an opinion and I respect that. But ultimately in open source, it's always the developers' call...And judgement calls can be divisive.

3) People who would create a backlash about that have much bigger problems to think about: Vulnerabilities such as Spectre/Meltdown etc, their attack surface (be it Kernel or whatever other software stack they run on their server). For these people there is also the option to run an Ubuntu flavor without a GUI.

Personally, I don't think the fact that there are other (more serious) vulnerabilities is a reason to not try to mitigate lesser threats.

Yes, eventually it will. In the meantime it is just causing unwarranted pain to a lot of loyal KDE users. For a long time, if a may add:
https://bugs.kde.org/show_bug.cgi?id=179678

Yes, the need for policykit integration has been known for a long time. This change has actually sped things up considerably, which I think is a good thing. People tend to work on things that are necessary (rather than just "it would be nice to have that"), and I don't think anyone thinks this isn't necessary now, after the change.

Protect against what? If you're owned, you're owned. Better luck in your next installation.

Firstly, you have to think of multiuser systems here, it's not about just the admin user making mistakes by adding malware. Another non-admin user might inadvertently add malware (possibly disguised as something else), you don't need root access to install something in $HOME...and that malware could just wait for an admin user to come up and launch a GUI app as root, and take over...theoretically speaking (you obviously don't want malware on your iron in any case, but there is no reason to make their work easier)...A single user system of course has fewer variables at play.

By the way, thanks to everyone providing alternatives. Much appreciated. There are some interesting choices there.
In my case though, this is not about just editing files. Sometimes I just run dolphin in root in order to quickly unmount a drive. I'm not a terminal expert and to be frank I don't care to become one.
If I can use Thunar, or Konqueror with sudo mode I will still do that, even if I am still "vulnerable". These are also GUI apps, right? Why didn't their developers remove sudo access as well?

I myself prefer Krusader over Dolphin (even without this issue), and would recommend that for anyone not concerned about the vulnerability (IIRC, Krusader only warns the user the first time it's launched as root, but will run nevertheless). And sudo is not the problem here, as the goal is not to remove access...only to mitigate the threat of the X vulnerability.

Sorry if I sound cranky, I am. A bit. This is the next LTS version of Kubuntu we're talking about, it has to be better than that!
Anyway, I feel better now. :|

I totally understand the frustration regarding the current situation, the policykit integration is taking much longer than it ideally should (I seem to recall it was already merged into the master branch...although there apparently still are some issues with the implementation). I'm just trying to clear up the misconception that the KDE devs are removing root access, or that they are deliberately trying to harm their user's workflows. I didn't make the call (and would have made a different call if it were mine to make, making it optional rather than hard-coded), so I'm not against you (or anyone) or just defending my own views/opinions.

[kubicle]

I thought a password prompt is now given when attempting to edit/paste/etc. when elevated permissions are required.

This is true for kate/kwrite (all editors using ktexteditor), as the policykit integration is already done for that. Doesn't work with dolphin yet (which seems to be the main issue here).

[Sothis6881]

This might be Debian specific since it seems to be working find in my Manjaro install. Makes me curious, though...I'll have to check when I get home from work today.

[wizard10000]

This might be Debian specific since it seems to be working find in my Manjaro install. Makes me curious, though...I'll have to check when I get home from work today.

Nope. Fully implemented in KDE Neon, which would lead me to believe it's an official thing

[mr_raider]

I see your mc and raise you one doublecmd

[Rod J]

+1 for Double Commander!

I prefer Krusader over Double Commander but there are some things that Double Commander does better. Incredibly, Double Commander is even more configurable than Krusader! Example: the panel columns can be configured to use different fonts/colours if you want. I've actually used Double Commander longer than I've used Krusader as I used to use D.C. back in my Windows days.

If I may be permitted a little personal boast I had a hand in rewriting the documentation for Double Commander many years ago. The original Russian/English translation left a lot to be desired. Most of the screenshots in the documentation I took on my old Ubuntu system (I think it was 8.10).

Surprisingly, my name is still at the bottom of this page as an acknowledgement: http://doublecmd.github.io/doc/en/help.html