Merge lp:~jamesodhunt/ubuntu/vivid/upstart/bug-1425685 into lp:ubuntu/vivid/upstart

[James Hunt]

* debian/upstart-bin.upstart.cron.daily:
  - [SECURITY FIX]: Only consider valid session files to avoid possible
    privilege escalation. Thanks to halfdog for reporting (LP: #1425685).

This branch provides a basic fix for the reported issue. However, I think we could potentially do better by:

- ensuring the user (extracted from the UPSTART_SESSION value) exists.
- ensuring the pid (extracted from the UPSTART_SESSION value) is running and is an upstart process.
- running /sbin/initctl as the user in question (assuming that user is validated as above). The risk here is that doing so may cause the cron job to block indefinately.

Input from other Upstart develops and the Security Team welcome.

[Colin Watson (cjwatson)]

This seems fine as far as it goes, although I think it's still slightly incomplete and you could make it safer with a one-liner.

review: Approve

[lp:~jamesodhunt/ubuntu/vivid/upstart/bug-1425685]

1608. By James Hunt on 2015-02-26

* debian/upstart-bin.upstart.cron.daily: Additional checks on the input
  file based on review feedback.

[Dimitri John Ledkov (xnox)]

I'm so sorry.

=== modified file 'debian/changelog'
--- debian/changelog	2015-01-20 10:55:02 +0000
+++ debian/changelog	2015-02-26 12:23:52 +0000
@@ -1,3 +1,11 @@
+upstart (1.13.2-0ubuntu8) UNRELEASED; urgency=medium
+
+  * debian/upstart-bin.upstart.cron.daily:
+    - [SECURITY FIX]: Only consider valid session files to avoid possible
+      privilege escalation. Thanks to halfdog for reporting (LP: #1425685).
+
+ -- James Hunt <[e-mail]>  Thu, 26 Feb 2015 09:59:50 +0000
+
 upstart (1.13.2-0ubuntu7) vivid; urgency=medium
 
   * Correct upstart-udev-bridge session job start/stop on conditions.
 
=== modified file 'debian/upstart-bin.upstart.cron.daily'
--- debian/upstart-bin.upstart.cron.daily	2015-01-16 23:55:17 +0000
+++ debian/upstart-bin.upstart.cron.daily	2015-02-26 12:23:52 +0000
@@ -11,7 +11,15 @@
 
 [ -x /sbin/initctl ] || exit 0
 
-for session in /run/user/*/upstart/sessions/*
+for file in /run/user/*/upstart/sessions/*.session
 do
-    env $(cat $session) /sbin/initctl emit rotate-logs >/dev/null 2>&1 || true
+    [ -f "$file" ] || continue
+    [ -h "$file" ] && continue
+
+    session=$(grep \
+	    "^UPSTART_SESSION=unix:abstract=/com/ubuntu/upstart-session/[0-9][0-9]*/[0-9][0-9]*$" \
+	    "$file" 2>/dev/null || true)
+    [ -z "$session" ] && continue
+
+    env -i "$session" /sbin/initctl emit rotate-logs >/dev/null 2>&1 || true
 done