Sign up to save your podcasts
Or
Share Episode 236
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 236
Overview
The long awaited preview of snapd-based AppArmor file prompting is finally
seeing the light of day, plus we cover the recent 24.04.1 LTS release and the
podcast officially moves to a fortnightly cycle.
This week in Ubuntu Security Updates
45 unique CVEs addressed
[USN-6972-4] Linux kernel (Oracle) vulnerabilities
[USN-6982-1] Dovecot vulnerabilities
[USN-6983-1] FFmpeg vulnerability
[USN-6984-1] WebOb vulnerability
[USN-6973-4] Linux kernel (Raspberry Pi) vulnerabilities
[USN-6981-2] Drupal vulnerabilities
[USN-6986-1] OpenSSL vulnerability
[USN-6987-1] Django vulnerabilities
[USN-6988-1] Twisted vulnerabilities
[USN-6985-1] ImageMagick vulnerabilities
Goings on in Ubuntu Security Community
Ubuntu 24.04.1 LTS released (02:55)
due to reports of a critical bug in the ubuntu-release-upgrader package and
its interaction with the apt solver - essentially resulting in packages like
linux-headers being in an broken state since it would remove some packages
that were seen as obsolete but which were still required due to other packages
depending on them
Ubuntu Security Center with snapd-based AppArmor home file access prompting preview (05:45)
Dart etc and published a snap
full-disk encryption, enabling/usage of Ubuntu Pro, Firewall control and
finally for snap permission prompting
toggle which is to enable “snaps to ask for system permissions” -
aka. snapd-based AppArmor prompting
futher fine-tuned
sysadmin etc
desktop / CLI etc - can’t know in advance every possible file a user may want
to open in say Firefox so have to grant access to all files in home directory
just in case
number of ways this can be done, XDG Portals one such way - using Powerbox
concept pioneered in tools from the object-capability based security community
like CapDesk/Polaris and Plash (principle of least-authority shell) - access
is mediated by a privileged component that acts with the users whole authority
to then delegate some of that authority to the application - seen say in the
file-chooser dialog with portals - this runs outside of the scope of the
application itself and so has the full, unrestricted access to the system to
allow a file to be chosen - then the application is then just given a
file-descriptor to the file to grant it the access (or similar)
can’t allow the user to explicitly grant access to the configuration file that
gets loaded from a well-known path at startup in a server application etc
for that access - and this is currently how this new prompting feature works
interface in snapd get tagged with a prompt attribute - any access then which
would normally be allowed is instead delegated to a trusted helper application
which displays a dialog to the user asking them to explicitly allow such
access
application itself is unaware that this is happening - but is just suspended
whilst waiting for the users response - and then assuming they grant the
access it proceeds as normal (or if they deny then the application gets a
permission denied error)
regardless of which API might be used (unlike portals which only support the
regular file-chooser scenario)
managed by the user in the Security Center later to revoke any such permission
that they granted
seccomp has supported this via the seccomp_unotify interface - allows to
delegate seccomp decisions to userspace in a very similar manner - existed
since the 5.5 kernel released in January 2020
functionality (https://sourceforge.net/projects/pulse-lsm/ /
https://crpit.scem.westernsydney.edu.au/confpapers/CRPITV81Murray.pdf)
desktop-security-center snap as well as the prompting-client snap
been talked about since at least 2018
security center application itself for this but it is not working currently -
instead report via a Github issue on the desktop-security-center project
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
The long awaited preview of snapd-based AppArmor file prompting is finally
seeing the light of day, plus we cover the recent 24.04.1 LTS release and the
podcast officially moves to a fortnightly cycle.
This week in Ubuntu Security Updates
45 unique CVEs addressed
[USN-6972-4] Linux kernel (Oracle) vulnerabilities
[USN-6982-1] Dovecot vulnerabilities
[USN-6983-1] FFmpeg vulnerability
[USN-6984-1] WebOb vulnerability
[USN-6973-4] Linux kernel (Raspberry Pi) vulnerabilities
[USN-6981-2] Drupal vulnerabilities
[USN-6986-1] OpenSSL vulnerability
[USN-6987-1] Django vulnerabilities
[USN-6988-1] Twisted vulnerabilities
[USN-6985-1] ImageMagick vulnerabilities
Goings on in Ubuntu Security Community
Ubuntu 24.04.1 LTS released (02:55)
due to reports of a critical bug in the ubuntu-release-upgrader package and
its interaction with the apt solver - essentially resulting in packages like
linux-headers being in an broken state since it would remove some packages
that were seen as obsolete but which were still required due to other packages
depending on them
Ubuntu Security Center with snapd-based AppArmor home file access prompting preview (05:45)
Dart etc and published a snap
full-disk encryption, enabling/usage of Ubuntu Pro, Firewall control and
finally for snap permission prompting
toggle which is to enable “snaps to ask for system permissions” -
aka. snapd-based AppArmor prompting
futher fine-tuned
sysadmin etc
desktop / CLI etc - can’t know in advance every possible file a user may want
to open in say Firefox so have to grant access to all files in home directory
just in case
number of ways this can be done, XDG Portals one such way - using Powerbox
concept pioneered in tools from the object-capability based security community
like CapDesk/Polaris and Plash (principle of least-authority shell) - access
is mediated by a privileged component that acts with the users whole authority
to then delegate some of that authority to the application - seen say in the
file-chooser dialog with portals - this runs outside of the scope of the
application itself and so has the full, unrestricted access to the system to
allow a file to be chosen - then the application is then just given a
file-descriptor to the file to grant it the access (or similar)
can’t allow the user to explicitly grant access to the configuration file that
gets loaded from a well-known path at startup in a server application etc
for that access - and this is currently how this new prompting feature works
interface in snapd get tagged with a prompt attribute - any access then which
would normally be allowed is instead delegated to a trusted helper application
which displays a dialog to the user asking them to explicitly allow such
access
application itself is unaware that this is happening - but is just suspended
whilst waiting for the users response - and then assuming they grant the
access it proceeds as normal (or if they deny then the application gets a
permission denied error)
regardless of which API might be used (unlike portals which only support the
regular file-chooser scenario)
managed by the user in the Security Center later to revoke any such permission
that they granted
seccomp has supported this via the seccomp_unotify interface - allows to
delegate seccomp decisions to userspace in a very similar manner - existed
since the 5.5 kernel released in January 2020
functionality (https://sourceforge.net/projects/pulse-lsm/ /
https://crpit.scem.westernsydney.edu.au/confpapers/CRPITV81Murray.pdf)
desktop-security-center snap as well as the prompting-client snap
been talked about since at least 2018
security center application itself for this but it is not working currently -
instead report via a Github issue on the desktop-security-center project
Get in contact