Date: Tue, 22 Oct 2013 22:00:33 -0400 From: Marc Deslauriers <marc.deslauriers@...onical.com> To: oss-security@...ts.openwall.com Subject: Re: CVE Request: lightdm no longer confines guest profile with AppArmor On 13-10-22 09:50 PM, Kurt Seifried wrote: > On 10/22/2013 12:52 PM, Marc Deslauriers wrote: >> Hello, > >> Christian Prim discovered that Light Display Manager 1.8.0 and >> later no longer use the appropriate wrapper when launching guest >> sessions, resulting in the session not being confined by AppArmor. > >> Bug report: https://bugs.launchpad.net/lightdm/+bug/1243339 > >> Could a CVE please be assigned to this issue? > >> Thanks, > >> Marc. > > > Ok to confirm the app armor profile is applied by default to lightdm > and the guest account, and was meant to prevent guest from touching > /home at all? I just wanna confirm this is a security vuln and not > security hardening. > lightdm is supposed to run the guest account through a special wrapper that applies an AppArmor security policy so the guest is confined and has a limited set of files which it can access. Kind of like a sandbox. The lightdm code was refactored at some point during the 1.8 development cycle, and the code no longer executes the wrapper, resulting in the guest account on Ubuntu 13.10 being unconfined and is now able to access user's files, which wasn't the case in earlier Ubuntu versions. Basically, a security feature that is applied by default got inadvertently dropped in a rewrite. Marc. -- Marc Deslauriers Ubuntu Security Engineer | http://www.ubuntu.com/ Canonical Ltd. | http://www.canonical.com/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.