Re: CVE Request: lightdm no longer confines guest profile with AppArmor

[Marc Deslauriers <marc.deslauriers () canonical com>]

On 13-10-22 09:50 PM, Kurt Seifried wrote:
> On 10/22/2013 12:52 PM, Marc Deslauriers wrote:
> > Hello,
>
> > Christian Prim discovered that Light Display Manager 1.8.0 and
> > later no longer use the appropriate wrapper when launching guest
> > sessions, resulting in the session not being confined by AppArmor.
>
> > Bug report: https://bugs.launchpad.net/lightdm/+bug/1243339
>
> > Could a CVE please be assigned to this issue?
>
> > Thanks,
>
> > Marc.
>
>
> Ok to confirm the app armor profile is applied by default to lightdm
> and the guest account, and was meant to prevent guest from touching
> /home at all? I just wanna confirm this is a security vuln and not
> security hardening.

lightdm is supposed to run the guest account through a special wrapper that
applies an AppArmor security policy so the guest is confined and has a limited
set of files which it can access. Kind of like a sandbox.

The lightdm code was refactored at some point during the 1.8 development cycle,
and the code no longer executes the wrapper, resulting in the guest account on
Ubuntu 13.10 being unconfined and is now able to access user's files, which
wasn't the case in earlier Ubuntu versions.

Basically, a security feature that is applied by default got inadvertently
dropped in a rewrite.

Marc.


-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/