oss-sec mailing list archives
Re: CVE Request: lightdm no longer confines guest profile with AppArmor
From: Marc Deslauriers <marc.deslauriers () canonical com>
Date: Tue, 22 Oct 2013 22:00:33 -0400
On 13-10-22 09:50 PM, Kurt Seifried wrote:
On 10/22/2013 12:52 PM, Marc Deslauriers wrote:Hello,Christian Prim discovered that Light Display Manager 1.8.0 and later no longer use the appropriate wrapper when launching guest sessions, resulting in the session not being confined by AppArmor.Bug report: https://bugs.launchpad.net/lightdm/+bug/1243339Could a CVE please be assigned to this issue?Thanks,Marc.Ok to confirm the app armor profile is applied by default to lightdm and the guest account, and was meant to prevent guest from touching /home at all? I just wanna confirm this is a security vuln and not security hardening.
lightdm is supposed to run the guest account through a special wrapper that applies an AppArmor security policy so the guest is confined and has a limited set of files which it can access. Kind of like a sandbox. The lightdm code was refactored at some point during the 1.8 development cycle, and the code no longer executes the wrapper, resulting in the guest account on Ubuntu 13.10 being unconfined and is now able to access user's files, which wasn't the case in earlier Ubuntu versions. Basically, a security feature that is applied by default got inadvertently dropped in a rewrite. Marc. -- Marc Deslauriers Ubuntu Security Engineer | http://www.ubuntu.com/ Canonical Ltd. | http://www.canonical.com/
Current thread:
- CVE Request: lightdm no longer confines guest profile with AppArmor Marc Deslauriers (Oct 22)
- Re: CVE Request: lightdm no longer confines guest profile with AppArmor Kurt Seifried (Oct 22)
- Re: CVE Request: lightdm no longer confines guest profile with AppArmor Marc Deslauriers (Oct 22)
- Re: CVE Request: lightdm no longer confines guest profile with AppArmor Kurt Seifried (Oct 22)
- Re: CVE Request: lightdm no longer confines guest profile with AppArmor Marc Deslauriers (Oct 22)
- Re: CVE Request: lightdm no longer confines guest profile with AppArmor Kurt Seifried (Oct 22)