Sandbox the tracker extractor

Bug #1648921 reported by Jeremy Bícha
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Tracker
Fix Released
High
tracker (Ubuntu)
Fix Released
High
Unassigned
Xenial
Won't Fix
High
Unassigned
Yakkety
Won't Fix
High
Unassigned

Bug Description

* SECURITY UPDATE: extractor now runs in a sandbox confined by libseccomp
    - extractor's filesystem and network access is limited to being read and
      local only (LP: #1648921)
    - No CVE number

The tracker developers have recently confined their extractor to attempt to make tracker more resilient to attacks, especially involving flaws in gstreamer parsers.

There is no CVE number assigned to this issue.

https://lwn.net/Articles/708196/
https://scarybeastsecurity.blogspot.com/2016/11/0day-poc-risky-design-decisions-in.html

The gstreamer security fixes are being handled separately. See bug 1619600

Changed in tracker:
importance: Unknown → High
status: Unknown → Fix Released
Jeremy Bícha (jbicha)
description: updated
Jeremy Bícha (jbicha)
description: updated
information type: Public → Public Security
Jeremy Bícha (jbicha)
description: updated
Revision history for this message
Jeremy Bícha (jbicha) wrote :

tracker was not included by default in any Ubuntu 12.04 flavor and libseccomp is only available in backports there.

I don't intend to try to backport this change for Ubuntu 14.04 either. Ubuntu GNOME 14.04 has only a few months of support left. I don't feel it's worth the work to try to make these changes there.

Jeremy Bícha (jbicha)
tags: added: xenial yakkety zesty
Changed in tracker (Ubuntu):
status: New → Fix Released
Changed in tracker (Ubuntu Yakkety):
status: New → In Progress
Revision history for this message
Jeremy Bícha (jbicha) wrote :

I went ahead and uploaded this for yakkety as a regular SRU (it's in the unapproved queue now)

Revision history for this message
Timo Aaltonen (tjaalton) wrote : Please test proposed package

Hello Jeremy, or anyone else affected,

Accepted tracker into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/tracker/1.10.2-0ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in tracker (Ubuntu Yakkety):
status: In Progress → Fix Committed
tags: added: verification-needed
Mathew Hodson (mhodson)
Changed in tracker (Ubuntu):
importance: Undecided → High
Changed in tracker (Ubuntu Yakkety):
importance: Undecided → High
Changed in tracker (Ubuntu Xenial):
importance: Undecided → High
Revision history for this message
Jeremy Bícha (jbicha) wrote :

When I looked earlier, I couldn't easily backport this to 16.04 LTS.

After a few months, I believe the tracker sandbox still causes regressions since it blocks stuff that used to be allowed. The new tracker (with sandbox) will be shipped in 17.04 and Debian stretch, but I think this update is not worth doing for 17.04 given that 17.04 is already halfway through it short life and given that we are unlikely to be able to fix all regressions it introduces.

tags: added: verification-failed
removed: verification-needed
Changed in tracker (Ubuntu Xenial):
status: New → Won't Fix
Jeremy Bícha (jbicha)
Changed in tracker (Ubuntu Yakkety):
status: Fix Committed → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.