touch-packages team mailing list archive

Thread
Date

[Bug 1219644] Re: Account plugins should be made confinable by apparmor

To: touch-packages@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1219644@xxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Mar 2015 21:16:28 -0000
Reply-to: Bug 1219644 <1219644@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

This bug was fixed in the package ubuntu-system-settings-online-accounts
- 0.6+15.04.20150319-0ubuntu1

---------------
ubuntu-system-settings-online-accounts (0.6+15.04.20150319-0ubuntu1) vivid; urgency=medium

  [ Alberto Mardegan ]
  * Merge from upstream
    - Add account data as search keywords (LP: #1373279)
    - Delete accounts when their plugin is removed (LP: #1413542)
    - More fixes for plugin confinement (LP: #1219644)
    - Fail initialization if trust session cannot be setup (LP: #1420847)

  [ CI Train Bot ]
  * Resync trunk
  * Resync trunk
  * Resync trunk
  * Resync trunk
 -- CI Train Bot <ci-train-bot@xxxxxxxxxxxxx>   Thu, 19 Mar 2015 10:52:45 +0000

** Changed in: ubuntu-system-settings-online-accounts (Ubuntu)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor-easyprof-ubuntu
in Ubuntu.
https://bugs.launchpad.net/bugs/1219644

Title:
  Account plugins should be made confinable by apparmor

Status in tools to review click packages:
  Confirmed
Status in Online Accounts setup for Ubuntu Touch:
  Confirmed
Status in apparmor-easyprof-ubuntu package in Ubuntu:
  Fix Released
Status in ubuntu-system-settings-online-accounts package in Ubuntu:
  Fix Released

Bug description:
  With the current implementation, the QML files for account plugins are
  executed by the Online Accounts QML applet which in turn is executed
  within the System Settings process, which probably means that
  malicious account plugins could control everything that the System
  Settings process can (like entering/exiting the flight mode).

  Account plugins (or the Online Accounts applet itself) should probably
  be run in a separate process, which could then be assigned a stricter
  confinement with apparmor.

To manage notifications about this bug go to:
https://bugs.launchpad.net/click-reviewers-tools/+bug/1219644/+subscriptions