[Bug 1140151] New: AUDIT-0: libvirt: new polkit permissions for networkport

newer
[Bug 1141369] Package update for...

bugzilla_noreply＠novell.com

3 Jul 2019 3 Jul '19

00:44

http://bugzilla.suse.com/show_bug.cgi?id=1140151 Bug ID: 1140151 Summary: AUDIT-0: libvirt: new polkit permissions for networkport Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team@suse.de Reporter: jfehlig@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- libvirt 5.5.0 got some new polkit permissions for the networkport object via commit e69444e1793, which cause the following lint failures [ 732s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.libvirt.api.network-port.getattr (yes:yes:yes) [ 732s] libvirt-daemon.x86_64: E: polkit-unauthorized-privilege (Badness: 10000) org.libvirt.api.network-port.read (yes:yes:yes) [ 732s] The package allows unprivileged users to carry out privileged operations [ 732s] without authentication. This could cause security problems if not done [ 732s] carefully. If the package is intended for inclusion in any SUSE product please [ 732s] open a bug report to request review of the package by the security team. [ 732s] Please refer to [ 732s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 732s] more information. [ 732s] [ 732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.network-port.create (no:no:no) [ 732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.network-port.delete (no:no:no) [ 732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.network-port.write (no:no:no) [ 732s] libvirt-daemon.x86_64: E: polkit-untracked-privilege (Badness: 10000) org.libvirt.api.network.search-ports (no:no:no) [ 732s] The privilege is not listed in /etc/polkit-default-privs.* which makes it [ 732s] harder for admins to find. Furthermore polkit authorization checks can easily [ 732s] introduce security issues. If the package is intended for inclusion in any [ 732s] SUSE product please open a bug report to request review of the package by the [ 732s] security team. Please refer to [ 732s] https://en.opensuse.org/openSUSE:Package_security_guidelines#audit_bugs for [ 732s] more information. -- You are receiving this mail because: You are on the CC list for the bug.

Attachments:

attachment.htm (text/html — 4.1 KB)

Show replies by date

bugzilla_noreply＠novell.com

3 Jul 3 Jul

00:45

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c1 --- Comment #1 from James Fehlig --- BTW, failing package can be found in this branch https://build.opensuse.org/package/show/home:jfehlig:branches:Virtualization... -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

07:52

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c2 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.gerstner@suse.com --- Comment #2 from Matthias Gerstner --- Thank you for opening the bug report. Since the libvirt framework was already intensively reviewed and these new actions are set to all no (if that is all that useful is another question) I don't think this is going to take long to whitelist. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

13:46

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c3 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS Assignee|security-team@suse.de |matthias.gerstner@suse.com --- Comment #3 from Matthias Gerstner --- These rules don't need further auditing so far. I've whitelisted them via sr#713249. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:04

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c4 --- Comment #4 from James Fehlig --- (In reply to Matthias Gerstner from comment #3)

...

These rules don't need further auditing so far. I've whitelisted them via sr#713249.

Thanks! Will the whitelisting also flow to "older" distros, like SLE15 GA/SP1 and Leap 15.0/1? I'm sure you recall similar requests from me in the past, so that libvirt will build for targets other than Factory in our Virtualization devel project :-). -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:20

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c5 --- Comment #5 from Swamp Workflow Management --- This is an autogenerated message for OBS integration: This bug (1140151) was mentioned in https://build.opensuse.org/request/show/713249 Factory / polkit-default-privs -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

4 Jul 4 Jul

10:10

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c6 --- Comment #6 from Swamp Workflow Management --- This is an autogenerated message for OBS integration: This bug (1140151) was mentioned in https://build.opensuse.org/request/show/713358 Factory / polkit-default-privs -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11:51

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c7 --- Comment #7 from Matthias Gerstner --- (In reply to jfehlig@suse.com from comment #4)

...

Thanks! Will the whitelisting also flow to "older" distros, like SLE15 GA/SP1 and Leap 15.0/1? I'm sure you recall similar requests from me in the past, so that libvirt will build for targets other than Factory in our Virtualization devel project :-).

Technically I'm not so happy to backport whitelistings to older codestreams when they're not actually needed there. I understand your request, however, and the limitation is on our side (how rpmlint and the whitelisting works). Hopefully we can improve on this in the future. Meanwhile I'll backport the whitelisting for 15 and 15.1 codestreams. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

5 Jul 5 Jul

22:37

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Whiteboard| |ibs:running:11809:moderate | |ibs:running:11808:moderate -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

8 Jul 8 Jul

22:47

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c9 --- Comment #9 from James Fehlig --- (In reply to Matthias Gerstner from comment #7)

...

Technically I'm not so happy to backport whitelistings to older codestreams when they're not actually needed there.

In previous bugs I've agreed with your distaste of the backports, and will do so again in this bug :-).

...

I understand your request, however, and the limitation is on our side (how rpmlint and the whitelisting works). Hopefully we can improve on this in the future.

Although not super sexy, it could make for a hackweek project.

...

Meanwhile I'll backport the whitelisting for 15 and 15.1 codestreams.

Thanks! -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

11 Jul 11 Jul

00:49

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c10 --- Comment #10 from James Fehlig --- ISTR something else needing done for all this to work. Perhaps rebuild of rpmlint with new polkit-default-privs? The branched libvirt in my home project still fails to build even though the updated polkit-default-privs has landed in Factory. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

09:50

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c11 --- Comment #11 from Matthias Gerstner --- (In reply to jfehlig@suse.com from comment #10)

...

ISTR something else needing done for all this to work. Perhaps rebuild of rpmlint with new polkit-default-privs? The branched libvirt in my home project still fails to build even though the updated polkit-default-privs has landed in Factory.

Ouch! It seems like I've overlooked part of the new rules in comment 0. I've missed search-ports and getattr and read. getattr and read also have yes:yes:yes. I'll have too take a closer look. -- You are receiving this mail because: You are on the CC list for the bug.

bugzilla_noreply＠novell.com

14:00

New subject: [Bug 1140151] AUDIT-0: libvirt: new polkit permissions for networkport

http://bugzilla.suse.com/show_bug.cgi?id=1140151 http://bugzilla.suse.com/show_bug.cgi?id=1140151#c12 --- Comment #12 from Matthias Gerstner --- (In reply to matthias.gerstner@suse.com from comment #11)

...

Ouch! It seems like I've overlooked part of the new rules in comment 0. I've missed search-ports and getattr and read. getattr and read also have yes:yes:yes. I'll have too take a closer look.

So those yes:yes:yes actions are only for getting information about existing network ports. Shouldn't be too evil. I've added the missing actions and started the whole affair in OBS once more including maintenance updates for SLE-15 codestreams. -- You are receiving this mail because: You are on the CC list for the bug.