From 2daf4331a648cc2df6982c1a6ec47a705e038255 Mon Sep 17 00:00:00 2001 From: Radosław Piliszek Date: Mon, 29 Aug 2022 18:13:34 +0000 Subject: Fix writable rootwrap/privsep config Fixes a hypothetical security issue related to privilege escalation via rootwrap/privsep. A potential vulnerable service could previously allow writes to its rootwrap/privsep config and thus allow for more commands to be run with root privileges via rootwrap/privsep. For a succesful attack, this would also require the service to allow to run arbitrary commands via rootwrap/privsep. Thus far, no such vulnerabilities have been reported and thus this fix is simply strengthening the container images against such an issue in the future. Change-Id: I92c81c77e6a16570a108cde8031f7977930fb02a Closes-Bug: #1874298 --- releasenotes/notes/bug-1874298-35b7ccffe327f7e4.yaml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 releasenotes/notes/bug-1874298-35b7ccffe327f7e4.yaml (limited to 'releasenotes') diff --git a/releasenotes/notes/bug-1874298-35b7ccffe327f7e4.yaml b/releasenotes/notes/bug-1874298-35b7ccffe327f7e4.yaml new file mode 100644 index 000000000..10ec5faaa --- /dev/null +++ b/releasenotes/notes/bug-1874298-35b7ccffe327f7e4.yaml @@ -0,0 +1,12 @@ +--- +security: + - | + Fixes a hypothetical security issue related to privilege escalation via + rootwrap/privsep. A potential vulnerable service could previously allow + writes to its rootwrap/privsep config and thus allow for more commands + to be run with root privileges via rootwrap/privsep. For a succesful + attack, this would also require the service to allow to run arbitrary + commands via rootwrap/privsep. Thus far, no such vulnerabilities have + been reported and thus this fix is simply strengthening the container + images against such an issue in the future. + `LP#1874298 `__ -- cgit v1.2.3