[Bug 1202933] VUL-0: CVE-2022-3560: pesign: pesign-authorize ExecStartPost script allows privilege escalation from pesign to root

https://bugzilla.suse.com/show_bug.cgi?id=1202933 https://bugzilla.suse.com/show_bug.cgi?id=1202933#c20 --- Comment #20 from Gary Ching-Pang Lin <glin@suse.com> --- While backporting the patch to SLE15, I'm thinking about removing the pesign-authorize-users/groups scripts completely. For SLE/openSUSE, we never use the daemon mode to sign EFI images, and the signing script for the customers also just uses pesign directly. Besides, there was no complaint about the broken path in pesign.service.in, so I wonder if there is any real SLE/openSUSE user of daemon mode. -- You are receiving this mail because: You are on the CC list for the bug.