ubuntu-sdk-bugs team mailing list archive

Thread
Date

[Bug 1197060] Re: SDK webview applications should use an app-specific path for shared memory files

To: ubuntu-sdk-bugs@xxxxxxxxxxxxxxxxxxx
From: Jamie Strandboge <jamie@xxxxxxxxxx>
Date: Fri, 11 Oct 2013 15:56:58 -0000
Reply-to: Bug 1197060 <1197060@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx

** Changed in: apparmor-easyprof-ubuntu (Ubuntu Saucy)
       Status: Triaged => Won't Fix

** Changed in: apparmor-easyprof-ubuntu (Ubuntu T-series)
       Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
SDK bug tracking, which is subscribed to qtwebkit-opensource-src in
Ubuntu.
https://bugs.launchpad.net/bugs/1197060

Title:
  SDK webview applications should use an app-specific path for shared
  memory files

Status in Ubuntu UI Toolkit:
  New
Status in “apparmor” package in Ubuntu:
  In Progress
Status in “apparmor-easyprof-ubuntu” package in Ubuntu:
  Triaged
Status in “qtwebkit-opensource-src” package in Ubuntu:
  New
Status in “apparmor” source package in Saucy:
  Won't Fix
Status in “apparmor-easyprof-ubuntu” source package in Saucy:
  Won't Fix
Status in “qtwebkit-opensource-src” source package in Saucy:
  New
Status in “apparmor” source package in t-series:
  In Progress
Status in “apparmor-easyprof-ubuntu” source package in t-series:
  Confirmed
Status in “qtwebkit-opensource-src” source package in t-series:
  New

Bug description:
  Ubuntu SDK applications that use webkit webviews create shared memory files as /run/shm/WK2SharedMemory*. This results in an AppArmor rule like the following:
  owner /{,run/}shm/WK2SharedMemory.[0-9]* rwk,

  But this rule is too lenient because a malicious app could enumerate
  these files and attack shared memory of other applications. Therefore,
  these paths need to be made application specific. One suggestion is to
  use something like shm_open("%s-WK2SharedMemory" % <app_pkgname>")
  instead of shm_open("WK2SharedMemory") where '<app_pkgname>' is the
  "name" field in the Click manifest (see bug #1197037 for details).

  Future work will allow for AppArmor IPC to handle this without
  modifications to the SDK, but this may be 14.04 so we need a solution
  for 13.10. I recommend fixing this bug after the other SDK bugs I
  filed today, then talk to the security team before fixing this bug
  since it is possible we will have something for 13.10 that doesn't
  require altering the SDK.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-ui-toolkit/+bug/1197060/+subscriptions