profile name matching behaves unexpectedly
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| linux (Ubuntu) |
Fix Released
|
Medium
|
John Johansen | ||
Bug Description
Karmic will be shipping an apparmor profile for firefox (bug #382917). This is a spec for the security team. Due to packaging constraints and maintenance, it must use matching for the profile name. Eg, with a profile name specified like this:
/usr/lib/
...
/usr/lib/
However, this causes problems:
a) profile is attached from unconfined, but not from confined processes. This reduces the security of the already shipping AppArmor profile for evince, which allows transitions to firefox
b) it improperly matches the *files* /usr/lib/
c) '/usr/lib/** ux' is too greedy-- ie will match /usr/l if nothing else is available
d) '/usr/bin/** px' won't attach if the profiled is confined
These issues are a surprising side-effect of using matching in the profile name, and will cause bugs and problems when people modify the firefox profile or develop their own profiles using profile name matching.
Related branches
| Changed in linux (Ubuntu): | |
| assignee: | nobody → John Johansen (jjohansen) |
| importance: | Undecided → Medium |
| status: | New → In Progress |
| description: | updated |
| description: | updated |
| Jamie Strandboge (jdstrand) wrote | #1 |
| Launchpad Janitor (janitor) wrote | #2 |
| Changed in linux (Ubuntu): | |
| status: | In Progress → Fix Released |
I haven't tested all of the various situations where this can occur, but the -9 kernel John made available today on chinstrap does not regress this behavior (ie firefox profile works properly).