{"action":"created","issue":{"url":"https://api.github.com/repos/snapcore/snap-confine/issues/72","repository_url":"https://api.github.com/repos/snapcore/snap-confine","labels_url":"https://api.github.com/repos/snapcore/snap-confine/issues/72/labels{/name}","comments_url":"https://api.github.com/repos/snapcore/snap-confine/issues/72/comments","events_url":"https://api.github.com/repos/snapcore/snap-confine/issues/72/events","html_url":"https://github.com/snapcore/snap-confine/pull/72","id":164139430,"number":72,"title":"use execle() with empty environment when calling snappy-app-dev","user":{"login":"jdstrand","id":1663079,"avatar_url":"https://avatars.githubusercontent.com/u/1663079?v=3","gravatar_id":"","url":"https://api.github.com/users/jdstrand","html_url":"https://github.com/jdstrand","followers_url":"https://api.github.com/users/jdstrand/followers","following_url":"https://api.github.com/users/jdstrand/following{/other_user}","gists_url":"https://api.github.com/users/jdstrand/gists{/gist_id}","starred_url":"https://api.github.com/users/jdstrand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdstrand/subscriptions","organizations_url":"https://api.github.com/users/jdstrand/orgs","repos_url":"https://api.github.com/users/jdstrand/repos","events_url":"https://api.github.com/users/jdstrand/events{/privacy}","received_events_url":"https://api.github.com/users/jdstrand/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-06T18:11:22Z","updated_at":"2016-07-06T20:41:11Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/snapcore/snap-confine/pulls/72","html_url":"https://github.com/snapcore/snap-confine/pull/72","diff_url":"https://github.com/snapcore/snap-confine/pull/72.diff","patch_url":"https://github.com/snapcore/snap-confine/pull/72.patch"},"body":"use execle() with clean environment instead of execl() when calling\r\nsnappy-add-dev to avoid influencing snappy-add-dev and allowing privilege\r\nescalation. snappy-app-dev is only called when devices are assigned via udev\r\ntagging, but currently snapd does not create these udev tags during 'snap\r\ninstall' or 'snap connect' so this code branch is not entered during app\r\ninvocation.\r\n\r\nCurrently this is not a security issue since no snaps will be udev tagged via\r\nsnapd (as such, today this can only be exploited by manually creating the\r\nnecessary udev tags (and there is no reason or documentation to do so), but\r\nthis requires root and is thus not a privilege escalation).\r\n\r\nThis is a vulnerability in waiting though since whenever the udev tagging is\r\nused and generated by snapd, then an unprivileged user would be able to create\r\na crafted environment and pass to snappy-app-dev via execl(). While\r\nsnappy-app-dev is constrained by the launcher AppArmor profile, clearly this\r\nissue must be addressed.\r\n\r\nThanks to Sebastian Krahmer from SUSE for discovering this issue."},"comment":{"url":"https://api.github.com/repos/snapcore/snap-confine/issues/comments/230899618","html_url":"https://github.com/snapcore/snap-confine/pull/72#issuecomment-230899618","issue_url":"https://api.github.com/repos/snapcore/snap-confine/issues/72","id":230899618,"user":{"login":"zyga","id":784262,"avatar_url":"https://avatars.githubusercontent.com/u/784262?v=3","gravatar_id":"","url":"https://api.github.com/users/zyga","html_url":"https://github.com/zyga","followers_url":"https://api.github.com/users/zyga/followers","following_url":"https://api.github.com/users/zyga/following{/other_user}","gists_url":"https://api.github.com/users/zyga/gists{/gist_id}","starred_url":"https://api.github.com/users/zyga/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zyga/subscriptions","organizations_url":"https://api.github.com/users/zyga/orgs","repos_url":"https://api.github.com/users/zyga/repos","events_url":"https://api.github.com/users/zyga/events{/privacy}","received_events_url":"https://api.github.com/users/zyga/received_events","type":"User","site_admin":false},"created_at":"2016-07-06T20:41:11Z","updated_at":"2016-07-06T20:41:11Z","body":"Thank you for the fix Jamie. As discussed on IRC I'll merge and release this. We can add more spread tests as we go but this should be sufficient to deal with the issue at hand. Thanks for the cgroup spread test, it is very useful to have real end-user tests that don't mock anything really."}}
{"actor":{"display_login":"zyga"}}