[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <52672DC1.4090007@canonical.com>
Date: Tue, 22 Oct 2013 22:00:33 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request: lightdm no longer confines guest
profile with AppArmor
On 13-10-22 09:50 PM, Kurt Seifried wrote:
> On 10/22/2013 12:52 PM, Marc Deslauriers wrote:
>> Hello,
>
>> Christian Prim discovered that Light Display Manager 1.8.0 and
>> later no longer use the appropriate wrapper when launching guest
>> sessions, resulting in the session not being confined by AppArmor.
>
>> Bug report: https://bugs.launchpad.net/lightdm/+bug/1243339
>
>> Could a CVE please be assigned to this issue?
>
>> Thanks,
>
>> Marc.
>
>
> Ok to confirm the app armor profile is applied by default to lightdm
> and the guest account, and was meant to prevent guest from touching
> /home at all? I just wanna confirm this is a security vuln and not
> security hardening.
>
lightdm is supposed to run the guest account through a special wrapper that
applies an AppArmor security policy so the guest is confined and has a limited
set of files which it can access. Kind of like a sandbox.
The lightdm code was refactored at some point during the 1.8 development cycle,
and the code no longer executes the wrapper, resulting in the guest account on
Ubuntu 13.10 being unconfined and is now able to access user's files, which
wasn't the case in earlier Ubuntu versions.
Basically, a security feature that is applied by default got inadvertently
dropped in a rewrite.
Marc.
--
Marc Deslauriers
Ubuntu Security Engineer | http://www.ubuntu.com/
Canonical Ltd. | http://www.canonical.com/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
