touch-packages team mailing list archive

[Dimitri John Ledkov <launchpad@xxxxxxxxxxxx>]

Public bug reported:

As part of (un)stable whoopsie persistent machine identifier generation
/sys/class/dmi/id/product_uuid is used.

However:
$ ls /sys/class/dmi/id/product_uuid
-r-------- 1 root root 4096 Aug  2 01:23 /sys/class/dmi/id/product_uuid

It's not world-readable. Hence API calls to whoopsie_identifier_generate
return different results for root and non-root users.

Either whoopsie should stop using product_uuid, or api calls to
whoopsie_identifier_generate should be denied and instead one should use
whoopsie-preferences which gets the full uuid (since the service is
running as root on system dbus and thus can read product_uuid)

** Affects: whoopsie
     Importance: Undecided
         Status: New

** Affects: linux (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: whoopsie (Ubuntu)
     Importance: Undecided
         Status: New

** Also affects: whoopsie
   Importance: Undecided
       Status: New

** Summary changed:

- product_uuid is not world readable
+ /sys/class/dmi/id/product_uuid is not world readable

** Also affects: linux (Ubuntu)
   Importance: Undecided
       Status: New

** Description changed:

  As part of (un)stable whoopsie persistent machine identifier generation
  /sys/class/dmi/id/product_uuid is used.
  
  However:
  $ ls /sys/class/dmi/id/product_uuid
  -r-------- 1 root root 4096 Aug  2 01:23 /sys/class/dmi/id/product_uuid
  
  It's not world-readable. Hence API calls to whoopsie_identifier_generate
  return different results for root and non-root users.
  
  Either whoopsie should stop using product_uuid, or api calls to
  whoopsie_identifier_generate should be denied and instead one should use
- whoopsie-preferences which gets the full uuid...
+ whoopsie-preferences which gets the full uuid (since the service is
+ running as root on system dbus and thus can read product_uuid)

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to whoopsie in Ubuntu.
https://bugs.launchpad.net/bugs/1351519

Title:
  /sys/class/dmi/id/product_uuid is not world readable

Status in Ubuntu error tracker client (whoopsie):
  New
Status in “linux” package in Ubuntu:
  New
Status in “whoopsie” package in Ubuntu:
  New

Bug description:
  As part of (un)stable whoopsie persistent machine identifier
  generation /sys/class/dmi/id/product_uuid is used.

  However:
  $ ls /sys/class/dmi/id/product_uuid
  -r-------- 1 root root 4096 Aug  2 01:23 /sys/class/dmi/id/product_uuid

  It's not world-readable. Hence API calls to
  whoopsie_identifier_generate return different results for root and
  non-root users.

  Either whoopsie should stop using product_uuid, or api calls to
  whoopsie_identifier_generate should be denied and instead one should
  use whoopsie-preferences which gets the full uuid (since the service
  is running as root on system dbus and thus can read product_uuid)

To manage notifications about this bug go to:
https://bugs.launchpad.net/whoopsie/+bug/1351519/+subscriptions