Ubuntu
ubuntu-mate-welcome package

Shipping /etc/skel/.config makes dir world-readable for all users

Bug #1745929 reported by Alkis Georgopoulos
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ubuntu-mate-welcome (Ubuntu)
Fix Released
Undecided
Martin Wimpress 
Ubuntu ubuntu-18.04

Bug Description

ubuntu-mate-welcome ships /etc/skel/.config/autostart/ubuntu-mate-welcome.desktop in order to autostart for new users.
I reported in LP: #1672292 that it would be better to use /etc/xdg/autostart/ instead, but I just realized that this is also a security issue:

New users get world-readable .config directories because /etc/skel/.config is used as a template.
You can easily verify this even in the live CD, where /home/ubuntu-mate/.config has mode=755.
The .config directory should be hidden by default, as applications may put sensitive data like passwords inside it.

A quick workaround for existing systems could be:
# rm -rf /etc/skel/.config
# chmod 700 /home/*/.config

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for reporting this issue. Can I make this bug public?

Revision history for this message
Alkis Georgopoulos (alkisg) wrote :

Marc, I think you're more adequate than me to decide that...

Personally I've fixed my own installations so don't mind, but I do believe other Ubuntu MATE users would mind a lot if this was made public before it's fixed, allowing other users in multi-user environments to see their private data.

I'm only using a small fraction of the available Ubuntu packages and I can see some applications storing passwords and search/file history in there. I imagine that many more applications in the archive are affected by this.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

There is a similar bug in other components which are getting fixed at the moment. Making this bug public will allow the developers working on mate to see it and propose a fix. (related bug is 1735929)

I am making this public so that it can be fixed. Thanks.

information type: Private Security → Public Security
Etienne Papegnies (etienne-papegnies)
Changed in ubuntu-mate-welcome (Ubuntu):
status: New → Confirmed
Martin Wimpress  (flexiondotorg)
Changed in ubuntu-mate-welcome (Ubuntu):
status: Confirmed → Fix Committed
Martin Wimpress  (flexiondotorg)
Changed in ubuntu-mate-welcome (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.