|
Bugzilla – Full Text Bug Listing |
| Summary: | VUL-0: apparmor-parser: parser could generate policy using an unconfined fallback execute transition | ||
|---|---|---|---|
| Product: | [Novell Products] SUSE Security Incidents | Reporter: | Thomas Biege <thomas> |
| Component: | General | Assignee: | Security Team bot <security-team> |
| Status: | RESOLVED FIXED | QA Contact: | Security Team bot <security-team> |
| Severity: | Major | ||
| Priority: | P3 - Medium | CC: | heiko.rommel, jeffm, security-team |
| Version: | unspecified | ||
| Target Milestone: | --- | ||
| Hardware: | Other | ||
| OS: | Other | ||
| Whiteboard: | . | ||
| Found By: | Development | Services Priority: | |
| Business Priority: | Blocker: | --- | |
| Marketing QA Status: | --- | IT Deployment: | --- |
| Deadline: | 2011-01-18 | ||
|
Description
Thomas Biege
2011-01-07 08:20:19 UTC
Committed to openSUSE:Factory (whenever AppArmor 2.5 is accepted). Committed to openSUSE 11.3 - SR 57760 Committed to openSUSE 11.2 - SR 57759 Committed to SLES11 SP1 - SR 9994 Earlier releases are unaffected since the feature wasn't available until AppArmor 2.3. Can I get a SWAMP ID for this? -> secteam for swamp The SWAMPID for this issue is 38139. This issue was rated as important. Please submit fixed packages until 2011-01-18. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. p5->p3 mass change Hi Jeff, can you add the fix for bnc#634801 to apparmor-parser and resubmit the package please? Do we need to release apparmor-profiles then too? (bnc#634801 in its changes file) bnc#634801 doesn't affect apparmor-parser - it only affects apparmor-profiles. Thanks for clarifying. I need some assistance to create a test case for this. I have read https://bugs.launchpad.net/apparmor/+bug/693082 and created the following profile: cat <<'EOF' > /etc/apparmor.d/usr.bin.mytestapp /usr/bin/mytestapp flags=(complain) { /usr/bin/mytestapp rm, /usr/bin/printf Pux, /usr/bin/vi Px, } EOF But I get: boxer:~ # apparmor_parser --reload < /etc/apparmor.d/usr.bin.mytestapp AppArmor parser error, line 3: syntax error, unexpected TOK_ID, expecting TOK_MODE P does seem to work together with ux. Please advise. sorry, what I meant was: P does NOT seem to work together with ux. What release are you testing with? I am using apparmor-parser-2.3.1-8.14.9 from SLES11 SP1 GM and apparmor-parser-2.3.1-8.16.10 from the test update Products: SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64), SLE-DESKTOP 11-SP1 (i386, x86_64), SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64), SLES4VMWARE 11-SP1 (i386, x86_64) Category: security SAT Patch No: 3966 MD5 sum: 7a9acb6610b9b4755f205d9ae5c3ad07 SUBSWAMPID: 38740 Packager: jeffm@novell.com Packages: apparmor-parser >= 2.3.1-8.16.10 I have tried to test cases that are embedded in this new release: make tests """ perl ./gen-xtrans.pl Generated 10816 xtransition interaction tests make -C .. apparmor_parser make[1]: Entering directory `/tmp/swamp-38740/BUILD/apparmor-parser-2.3.1' /usr/bin/bison -d -o parser_yacc.c parser_yacc.y parser_yacc.y:214.10-22: warning: type clash on default action: <cod> != <> parser_yacc.y: conflicts: 1 shift/reduce /usr/bin/flex -B -v -oparser_lex.c parser_lex.l ... make[1]: Leaving directory `/tmp/swamp-38740/BUILD/apparmor-parser-2.3.1' /usr/bin/prove simple.pl simple....ok All tests successful. Files=1, Tests=11098, 21 wallclock secs ( 8.00 cusr + 3.29 csys = 11.29 CPU) """ -> looks good however, I am still curious what is wrong about the test case in comment #8 ... Ok, it turns out my analysis about our vulnerability was premature. That should have been clear to me when I modified the test case. The patch is safe but unnecessary. Ubuntu's 2.3 implementation was vulnerable because they backported pux support from the upstream repo. We didn't do that so we're not vulnerable. so we can cancel the sle11 update Update released for: apparmor-parser, apparmor-parser-debuginfo, apparmor-parser-debugsource Products: openSUSE 11.2 (debug, i586, x86_64) openSUSE 11.3 (debug, i586, x86_64) released |