SUMMARY I created a user account for my dad as a standard user not admin. But Discover's updates page still offers system updates and then gives an error when entering the password. I think sudo -l is able to correctly check this without asking for the user's password. STEPS TO REPRODUCE 1. login as non-admin user 2. open Discover's updates page 3. try to update 4. enter password OBSERVED RESULT Scary errors displayed. EXPECTED RESULT Skip system updates for non-admin users. SOFTWARE/OS VERSIONS Operating System: Kubuntu 25.10 KDE Plasma Version: 6.4.5 KDE Frameworks Version: 6.17.0 Qt Version: 6.9.2 Kernel Version: 6.17.0-7-generic (64-bit) Graphics Platform: Wayland Processors: 12 × AMD Ryzen 5 2600 Six-Core Processor Memory: 16 GiB of RAM (15.5 GiB usable) Graphics Processor: NVIDIA GeForce RTX 2080
I could disable update notifications for him, but then his Snaps/Flatpaks never get updated.
> Scary errors displayed. Which errors are they? Can you paste them here? Also, did your dad try enter his own password? Or did he call you over end enter your admin password?
I checked this again, it does correctly ask for my password and not his, but it's not super obvious since it's a normal unformatted dialog box with small text. I think the error I saw must've been unrelated before because I can't reproduce an error dialog when cancelling or entering my password. I'm not sure what the ideal UX behavior would be for this. Maybe only show notifications for updates that the user has permission to update, or show them separately somehow. I don't consider this a bug anymore but just a UX concern. This issue can be closed, or left open if you want to tweak the UX.
This is a somewhat complicated situation, but it starts with the admin's intention. That's you. What's your intent here? Should your father be able to update system-level software without you being involved, or not? If yes, then it's up to you to create a polkit rule file that lets him do it. If no, then we need to decide whether any UI improvements are warranted here. e.g. Discover could only attempt to update the user-level apps, and ignore the system updates. Or it could do them as a two-step process, first updating the user-level apps and then afterwards explaining that admin authentication is needed for the system updates.
I don't think he should be able to update without me. I'm thinking maybe you should be able to set timings for the update notifications based on the source. Like Flathub and Snap maybe every week, and apt repos never notify.
Yeah, definitely seems like there are opportunities for better presentation here.