No admin pass for updates anymore?

[0dev]

I just did the latest batch of updates with Software Update, and call me crazy here, but I seem to remember it used to require an admin password to apply them, whereas now, it'll just do them right away.

Is Apple winding down security here? Surely you should need the admin password to update to 10.6.5?

 

[spinnerlys]

I had to give my password on all three Macs I upgraded. Maybe you have entered your password shortly before in Software Update and it "remembered" you?

 

[0dev]

Nope, haven't entered it in Software Update for months, and I can't see any kind of Software Update certificate in Keychain Access either.

Kinda worrying...

 

[Hal Itosis]

It's new in Snow Leopard. If you do the update through the Software Update app/prefpane, then (most of the time) no password is asked for. If you download the dmg file from Apple's support page and do the update "manually"... then a password will be asked for.

 

[0dev]

It's new in Snow Leopard. If you do the update through the Software Update app/prefpane, then (most of the time) no password is asked for. If you download the dmg file from Apple's support page and do the update "manually"... then a password will be asked for.

Ahh, OK. Makes sense I guess, though I assume this only happens for admin accounts?

 

[Hal Itosis]

Ahh, OK. Makes sense I guess, though I assume this only happens for admin accounts?

I believe that's true, yes.

Actually, i was just googling to find an informative link... but it seems very little official "documentation" exists. There are at least 3 threads in Apple Discussions about the subject... all still marked "unanswered".

Then there are these (from last Spring):
http://arstechnica.com/civis/viewtopic.php?f=19&t=1100891
http://rixstep.com/1/2/20100524,00.shtml

[::shrug::]

 

[0dev]

So Software Update has a sub-process which has root without requiring a password? That really doesn't sound too secure to me.

 

[angelwatt]

So Software Update has a sub-process which has root without requiring a password? That really doesn't sound too secure to me.

I think it partly depends on what is getting installed by the update. For me, when I did the 10.6.5 update I got prompted for my admin account to check for updates, but wasn't asked after that. For some updates it will also ask for my admin account again when it does the actual install. I run as a standard account though, so that may partly account for it.

 

[0dev]

I think it partly depends on what is getting installed by the update. For me, when I did the 10.6.5 update I got prompted for my admin account to check for updates, but wasn't asked after that. For some updates it will also ask for my admin account again when it does the actual install. I run as a standard account though, so that may partly account for it.

Yeah, from what I've read, you have to enter an admin password from a normal account, but from an admin account Software Update automatically runs another process which has root.

I think I might demote my main account to a normal user and make a separate one to use for admin stuff TBH.

 

[FourCandles]

...For me, when I did the 10.6.5 update I got prompted for my admin account to check for updates, but wasn't asked after that. For some updates it will also ask for my admin account again when it does the actual install. I run as a standard account though, so that may partly account for it.

I think the first part you mention is a change in Snow Leopard. In Leopard, I can check for updates from my standard account, and if there's anything to install, it will ask for the admin user/password. With Snow Leopard, I have to enter the admin user/password before I can check for updates.

 

[0dev]

I think the first part you mention is a change in Snow Leopard. In Leopard, I can check for updates from my standard account, and if there's anything to install, it will ask for the admin user/password. With Snow Leopard, I have to enter the admin user/password before I can check for updates.

I reckon that's so it can run the root process.

 

[angelwatt]

I think the first part you mention is a change in Snow Leopard. In Leopard, I can check for updates from my standard account, and if there's anything to install, it will ask for the admin user/password. With Snow Leopard, I have to enter the admin user/password before I can check for updates.

My memory agrees with that. I still have Leopard on my mini, though it mostly notifies me of updates through automatic checks so obviously it wouldn't ask for a password then. It just asks for a password when I go to install. Though I can't remember if that account runs as admin or standard user as it just acts as a media server.