1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138 | diff -u apport-2.14.7/data/apport apport-2.14.7/data/apport
--- apport-2.14.7/data/apport
+++ apport-2.14.7/data/apport
@@ -261,114 +261,11 @@
# Check if we received a valid global PID (kernel >= 3.12). If we do,
# then compare it with the local PID. If they don't match, it's an
-# indication that the crash originated from another PID namespace. In that
-# case, attempt to forward the crash to apport in that namespace. If
-# apport can't be found, then simply log an entry in the host error log
-# and exit 0.
+# indication that the crash originated from another PID namespace.
+# Simply log an entry in the host error log and exit 0.
if len(sys.argv) == 5 and sys.argv[4].isdigit() and sys.argv[4] != sys.argv[1]:
- if os.path.exists('/proc/%s/root/%s' % (sys.argv[4], __file__)) \
- and os.path.exists('/proc/%s/ns/' % sys.argv[4]):
- try:
- import lxc
- except:
- error_log('pid %s crashed in a container without python3-lxc' % sys.argv[4])
- sys.exit(0)
-
- def list_containers():
- containers = []
-
- with open('/proc/net/unix', 'r') as fd:
- for line in sorted(fd):
- fields = line.strip().split(' ')
- if len(fields) != 8:
- continue
-
- inode = fields[6].strip()
- path = fields[7].split('/')
- if path[-1] != 'command':
- continue
-
- if len(path) < 2:
- continue
-
- real_path = '/'.join(path[:-2]).lstrip('@')
-
- container = lxc.Container(path[-2], real_path)
-
- if not container.controllable:
- continue
-
- if container.state == 'STOPPED':
- continue
-
- ppid = 0
- with open('/proc/%s/status' % container.init_pid) as fd:
- for line in fd:
- if line.startswith('PPid:'):
- ppid = int(line.strip().split(':')[-1].strip())
- break
- else:
- continue
-
- stat = os.stat('/proc/%s' % ppid)
- uid = stat.st_uid
- gid = stat.st_gid
-
- for fd in os.listdir('/proc/%s/fd/' % ppid):
- if os.readlink('/proc/%s/fd/%s' % (ppid, fd)) \
- == 'socket:[%s]' % inode:
- break
- else:
- continue
-
- containers.append((container, (uid, gid)))
-
- return containers
-
- def list_ns(pid):
- return [os.readlink('/proc/%s/ns/%s' % (pid, ns))
- for ns in sorted(os.listdir('/proc/%s/ns' % pid))]
-
- def get_container(pid):
- pid_ns = list_ns(pid)
-
- for container, owner in list_containers():
- container_ns = list_ns(container.init_pid)
-
- if container_ns == pid_ns:
- return container, owner
-
- return None, None
-
- container, owner = get_container(sys.argv[4])
- if not container:
- error_log('pid %s crashed in an unknown container' % sys.argv[4])
- sys.exit(0)
-
- if owner[0] or owner[1]:
- error_log('pid %s crashed in an untrusted container' % sys.argv[4])
- sys.exit(0)
-
- error_log('pid %s (host pid %s) crashed in container '
- '"%s" (%s), forwarding' % (sys.argv[1], sys.argv[4],
- container.name,
- container.get_config_path()))
-
- sys.stderr.flush()
-
- def run_command(cmd):
- os.environ['PATH'] = '/usr/sbin:/usr/bin:/sbin:/bin'
-
- return subprocess.call(cmd)
-
- cmd = [__file__, sys.argv[1], sys.argv[2], sys.argv[3]]
- retval = container.attach_wait(run_command, cmd,
- env_policy=lxc.LXC_ATTACH_CLEAR_ENV)
-
- sys.exit(0)
- else:
- error_log('pid %s crashed in a container without apport support' % sys.argv[4])
- sys.exit(0)
+ error_log('pid %s crashed in a container' % sys.argv[4])
+ sys.exit(0)
check_lock()
diff -u apport-2.14.7/debian/changelog apport-2.14.7/debian/changelog
--- apport-2.14.7/debian/changelog
+++ apport-2.14.7/debian/changelog
@@ -1,3 +1,12 @@
+apport (2.14.7-0ubuntu8.4) utopic-security; urgency=medium
+
+ * SECURITY UPDATE: insecure /proc/net/unix parsing (LP: #1444518)
+ - data/apport: temporarily disable container support until it can be
+ re-written in a secure manner.
+ - CVE number pending
+
+ -- Marc Deslauriers <marc.deslauriers@ubuntu.com> Thu, 16 Apr 2015 07:40:49 -0400
+
apport (2.14.7-0ubuntu8.3) utopic-security; urgency=medium
* SECURITY UPDATE: privilege escalation through namespaces and crafted
|