desktop-packages team mailing list archive

[Rolf Leggewie <1212425@xxxxxxxxxxxxxxxxxx>]

saucy has seen the end of its life and is no longer receiving any
updates. Marking the saucy task for this ticket as "Won't Fix".

** Changed in: nvidia-graphics-drivers-304 (Ubuntu Saucy)
       Status: Confirmed => Won't Fix

-- 
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to nvidia-graphics-drivers-304 in Ubuntu.
https://bugs.launchpad.net/bugs/1212425

Title:
  SDK applications require /tmp access with nvidia (should honor TMPDIR)

Status in apparmor-easyprof-ubuntu package in Ubuntu:
  Fix Released
Status in nvidia-graphics-drivers-304 package in Ubuntu:
  Fix Released
Status in nvidia-graphics-drivers-304-updates package in Ubuntu:
  Fix Released
Status in nvidia-graphics-drivers-319 package in Ubuntu:
  Fix Released
Status in nvidia-graphics-drivers-319-updates package in Ubuntu:
  Fix Released
Status in apparmor-easyprof-ubuntu source package in Saucy:
  Fix Released
Status in nvidia-graphics-drivers-304 source package in Saucy:
  Won't Fix
Status in nvidia-graphics-drivers-304-updates source package in Saucy:
  Won't Fix
Status in nvidia-graphics-drivers-319 source package in Saucy:
  Won't Fix
Status in nvidia-graphics-drivers-319-updates source package in Saucy:
  Fix Released
Status in nvidia-graphics-drivers-tegra source package in Saucy:
  Invalid
Status in nvidia-graphics-drivers-tegra3 source package in Saucy:
  Invalid

Bug description:
  Nvidia desktop users need the following AppArmor permissions to avoid denials:
    owner /tmp/gl* mrw,

  But this rule breaks application confinement such that apps are able
  to tamper with each other. Interestingly, apps still run without the
  rule, so we can explicitly deny it for now.

  The use of /tmp is apparently hardcoded and does not honor TMPDIR (application confinement will setup TMPDIR to a private area for the app). strace confirms this:
  24603 mkdir("/tmp", 0777)               = -1 EEXIST (File exists)
  24603 open("/tmp/glBRPYmm", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EACCES (Permission denied)

  While the use of O_EXCL is safe, we don't allow access to /tmp for
  confined apps and libraries/applications should always honor TMPDIR.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor-easyprof-ubuntu/+bug/1212425/+subscriptions