Light Display Manager

Guest session can't write on /var/run/screen

Bug #1442611 reported by Laércio de Sousa
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Light Display Manager
Fix Released
Medium
Unassigned
Light Display Manager 1.17.0
lightdm (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

I'm customizing guest sessions in Xubuntu 15.04 in my school computer lab and dicovered that I'm unable to open user terminal in epoptes. The main reason for this problem is that epoptes uses screen for opening client terminals remotely on server session, but screen is currently unable to write on /var/run/screen for guest sessions.

Could you please review current apparmor profile for lightdm-guest-session so it can get write access to /var/run/screen?

Related branches

lp://qastaging/~lbssousa/lightdm/guest-session-write-run-screen
Robert Ancell: Approve
Diff: 11 lines (+1/-0)
1 file modified
data/apparmor/abstractions/lightdm (+1/-0)
Revision history for this message
Robert Ancell (robert-ancell) wrote :

Subscribing Jamie and Martin who seem to have the most knowledge on the apparmor profiles.

Changed in lightdm:
status: New → Triaged
importance: Undecided → Medium
Changed in lightdm (Ubuntu):
status: New → Triaged
importance: Undecided → Medium
Revision history for this message
Martin Pitt (pitti) wrote :

This is a bit of a bikeshedding thing IMHO, but I'm not entirely sure whether it's a good idea for a guest session to start screen sessions. I'll let Jamie/the security team have the decision, though.

But AFAIR lightdm kills all guest session processes at session close anyway, right? Then it's probably harmless to allow this.

Revision history for this message
Robert Ancell (robert-ancell) wrote :

Yes, lightdm does (at least attempt to) close everything related to the guest session.

Revision history for this message
Robert Ancell (robert-ancell) wrote :

Merge proposal?

Robert Ancell (robert-ancell)
Changed in lightdm:
milestone: none → 1.17.0
status: Triaged → Fix Committed
Robert Ancell (robert-ancell)
Changed in lightdm:
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package lightdm - 1.17.0-0ubuntu1

---------------
lightdm (1.17.0-0ubuntu1) xenial; urgency=medium

  * New upstream release:
    - Disable log backups - this interferes with logrotate.
    - Support using libaudit to generate audit events.
    - Handle trailing whitespace on boolean values in configuration.
    - Update example configuration to more correctly match allowed options.
    - Fix unnecessary X server from being launched when locking seats.
    - Check the version of the X server we are running so we correctly pass
      -listen tcp when required.
    - Allow reading /proc/<PID>/net/dev from within a guest session.
      (LP: #1442609)
    - Allow guest sessions to write in /{,var/}run/screen folder.
      (LP: #1442611)
    - Update guest-session AppArmor profile to be suitable for openSUSE.
    - Fix apparmor profiles for running Chromium in guest sessions.
      (LP: #1504049, LP: #1464958)
    - Fix configure failing without Vala installed.
  * Build with multi-arch
  * debian/lightdm.logrotate:
    - Use logrotate to handle log files placed in the default system log
      directory (/var/log/lightdm).
  * debian/guest*:
    - Optimize guest account creation, use OverlayFS of AuFS if available.

 -- Robert Ancell <email address hidden> Wed, 28 Oct 2015 15:02:46 +1300

Changed in lightdm (Ubuntu):
status: Triaged → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.