[Bug 1202933] VUL-0: CVE-2022-3560: pesign: pesign-authorize ExecStartPost script allows privilege escalation from pesign to root
https://bugzilla.suse.com/show_bug.cgi?id=1202933 https://bugzilla.suse.com/show_bug.cgi?id=1202933#c21 --- Comment #21 from Matthias Gerstner <matthias.gerstner@suse.com> --- (In reply to glin@suse.com from comment #20)
While backporting the patch to SLE15, I'm thinking about removing the pesign-authorize-users/groups scripts completely. For SLE/openSUSE, we never use the daemon mode to sign EFI images, and the signing script for the customers also just uses pesign directly. Besides, there was no complaint about the broken path in pesign.service.in, so I wonder if there is any real SLE/openSUSE user of daemon mode.
Technically this makes sense. The question is what the maintenance reviewers make out of this, since formally "removal of functionality" is not allowed in updates. One could argue that it never worked, but well... -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@suse.com