http://bugzilla.suse.com/show_bug.cgi?id=1090647 Karol Babioch changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|security-team@suse.de |kbabioch@suse.com -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c2 Karol Babioch changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |IN_PROGRESS --- Comment #2 from Karol Babioch --- Ticking off: [x] Install and perform lynis scan Lynis scan report is attached. Nothing serious came up, but we might think about some hardening measures for the future. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c4 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |matthias.gerstner@suse.com --- Comment #4 from Matthias Gerstner --- I had a look today on Leap15 using the security-scanner. I have put together a list of interesting files in https://pes.suse.de/Maintenance-Security/Products/leap15/. The following findings resulted from this: - /etc/machine-id is world-writeable which is probably not what was intended. The reason is found in the systemd spec file: if [ $1 -eq 1 ]; then touch %{_sysconfdir}/machine-id chmod 666 %{_sysconfdir}/machine-id fi - Each process started from within the KDE login inherits a couple of open UNIX domain socket file descriptors. Just open up a konsole and check ls -l /proc/self/fd. These descriptors are open for read/write. They seem to be connected to plasmashell process also running as the logged in user. So it hopefully doesn’t pose a security issue. Anyways, inheriting those file descriptors to arbitrary user processes does not look like a good idea. But probably it is some great KDE concept in action that we’re seeing here? -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c6 --- Comment #6 from Karol Babioch --- Ticking off: [x] medias signed [x] repository signed Packages are signed: rpm -K tree-1.7.0-lp150.1.8.x86_64.rpm -v tree-1.7.0-lp150.1.8.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID 3dbdc284: OK Header SHA1 digest: OK Header SHA256 digest: OK Payload SHA256 digest: OK V3 RSA/SHA256 Signature, key ID 3dbdc284: OK MD5 digest: OK ISO is signed with openSUSE key: gpg --verify openSUSE-Leap-15.0-DVD-x86_64-Build206.1-Media.iso.sha256 gpg: Signature made Tue Apr 17 11:35:37 2018 CEST gpg: using RSA key B88B2FD43DBDC284 gpg: Good signature from "openSUSE Project Signing Key " [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284 Repos are signed with the same key: gpg repomd.xml.key gpg: WARNING: no command supplied. Trying to guess what you mean ... pub rsa2048 2008-11-07 [SC] [expires: 2024-05-02] 22C07BA534178CD02EFE22AAB88B2FD43DBDC284 uid openSUSE Project Signing Key gpg --verify repomd.xml.asc gpg: assuming signed data in 'repomd.xml' gpg: Signature made Thu May 3 11:33:44 2018 CEST gpg: using RSA key B88B2FD43DBDC284 gpg: Good signature from "openSUSE Project Signing Key " [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 22C0 7BA5 3417 8CD0 2EFE 22AA B88B 2FD4 3DBD C284 [x] verify product can install maintenance updates (tested by installing available updates after fresh install from ISO) Current status: General: [x] Install and perform lynis scan [ ] review for outstanding major security issues Defaults: [x] running default services [x] setuid and privileged friends Media and repositories: [x] medias signed [x] repository signed Sources: [ ] thrawl rpmlintrc for bypasses of rpmlint checks [ ] clamav scan of sources Development processes: [ ] verify package review process were adhered to [ ] verify standard development model was followed Updates: [x] verify product can install maintenance updates -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c8 --- Comment #8 from Ludwig Nussel --- (In reply to Matthias Gerstner from comment #4)

The following findings resulted from this:

- /etc/machine-id is world-writeable which is probably not what was intended. The reason is found in the systemd spec file:

if [ $1 -eq 1 ]; then touch %{_sysconfdir}/machine-id chmod 666 %{_sysconfdir}/machine-id fi

- Each process started from within the KDE login inherits a couple of open UNIX domain socket file descriptors. Just open up a konsole and check ls -l /proc/self/fd. These descriptors are open for read/write. They seem to be connected to plasmashell process also running as the logged in user. So it hopefully doesn’t pose a security issue. Anyways, inheriting those file descriptors to arbitrary user processes does not look like a good idea. But probably it is some great KDE concept in action that we’re seeing here?

Please file bugs. Especially the systemd one needs to be fixed ASAP -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c10 --- Comment #10 from Karol Babioch --- (In reply to Ludwig Nussel from comment #8)

Please file bugs.

I've filed a bug for the machine-id issue: #1092269 Matthias will hopefully file a bug for the leaking file system descriptors today, since he knows some more details about it. (In reply to Ludwig Nussel from comment #9)

apart from that, ware we done?

No, not completely. We are still working on it. Sorry that this takes a while, there is only so much we can do each day ;). -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c12 --- Comment #12 from Karol Babioch --- I've finally scanned the source tree for Leap 15.0 and ClamAV complains about these findings: ./freetype2/.osc/bnc628213_test.otf: Win.Exploit.Jailbreak-1 FOUND ./freetype2/bnc628213_test.otf: Win.Exploit.Jailbreak-1 FOUND ./kdepim-addons/.osc/kdepim-addons-17.12.3.tar.xz: Email.Phishing.VOF1-6295269-0-6295269-1 FOUND ./kdepim-addons/kdepim-addons-17.12.3.tar.xz: Email.Phishing.VOF1-6295269-0-6295269-1 FOUND ./libemf2svg/.osc/libemf2svg-1.1.0.tar.gz: Win.Exploit.CVE_2017_11244-6335828-1 FOUND ./libemf2svg/libemf2svg-1.1.0.tar.gz: Win.Exploit.CVE_2017_11244-6335828-1 FOUND ./libreoffice/.osc/libreoffice-6.0.4.1.tar.xz: BC.Win.Exploit.CVE_2017_0060-6333894-0 FOUND ./libreoffice/libreoffice-6.0.4.1.tar.xz: BC.Win.Exploit.CVE_2017_0060-6333894-0 FOUND ./linkchecker/.osc/LinkChecker-9.3.tar.gz: Clamav.Test.File-6 FOUND ./linkchecker/LinkChecker-9.3.tar.gz: Clamav.Test.File-6 FOUND ./llvm5/.osc/lldb-5.0.1.src.tar.xz: Win.Trojan.Agent-1817571 FOUND ./llvm5/lldb-5.0.1.src.tar.xz: Win.Trojan.Agent-1817571 FOUND ./pmdk/.osc/pmdk-1.3.1.tar.gz: Heuristics.Broken.Executable FOUND ./pmdk/pmdk-1.3.1.tar.gz: Heuristics.Broken.Executable FOUND -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c15 --- Comment #15 from Matthias Gerstner --- I have split off bug 1092329 to handle the extra open file descriptors in KDE Plasma sessions. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c17 --- Comment #17 from Karol Babioch --- Looked through most recent submission requests, couldn't find anything fishy, therefore signing off on: [x] verify package review process were adhered to [x] verify standard development model was followed -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c19 --- Comment #19 from Karol Babioch --- Actually there are packages that invoke setBadness in the spec file: kauth/.osc/kauth.spec:91:echo "setBadness('suse-dbus-unauthorized-service', 0)"

$RPM_SOURCE_DIR/%name-rpmlintrc kauth/kauth.spec:91:echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%name-rpmlintrc kcm_sddm/.osc/kcm_sddm.spec:79: echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%name-rpmlintrc kcm_sddm/kcm_sddm.spec:79: echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%name-rpmlintrc kwalletmanager5/.osc/kwalletmanager5.spec:81:echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%{name}-rpmlintrc kwalletmanager5/kwalletmanager5.spec:81:echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%{name}-rpmlintrc

-- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c21 --- Comment #21 from Ludwig Nussel --- ah, they circumvent the check in the spec file, wtf -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c23 --- Comment #23 from Karol Babioch --- So, we found the following issues while looking for rpmlintrc issues: - kauth: https://build.opensuse.org/package/view_file/openSUSE:Leap:15.0/kauth/kauth.... echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%name-rpmlintrc - kcm_sddm: Already fixed: https://build.opensuse.org/request/show/603288 - kwalletmanager5: https://build.opensuse.org/package/view_file/openSUSE:Leap:15.0/kwalletmanag... echo "setBadness('suse-dbus-unauthorized-service', 0)" > $RPM_SOURCE_DIR/%{name}-rpmlintrc echo "setBadness('polkit-unauthorized-privilege', 0)" >> $RPM_SOURCE_DIR/%{name}-rpmlintrc Therefore (for the time being): [ ] thrawl rpmlintrc for bypasses of rpmlint checks -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c25 --- Comment #25 from Karol Babioch --- Looked through missing submissions (compared to Factory). These are the findings: MozillaFirefox -> Nevermind, will be updated regularly anyway LibVNCServer -> missing: LibVNCServer-CVE-2018-7225.patch in Factory (Factory First violated) dpdk -> missing fix for CVE-2018-1059 (version bump necessary/possible?) dpdk-thunderx -> missing fix for CVE-2018-1059 gpg2 -> gnupg-CVE-2018-9234.patch (missing) openvpn -> version in SLE-15 is outdated, new version contains a fix for CVE-2018-9336 pam_yubico -> https://build.opensuse.org/request/show/605739 zsh -> https://build.suse.de/request/show/164695 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c27 --- Comment #27 from Karol Babioch --- I've created submissions for missing fixes and/or noted in the appropriate bug, so ticking off: [x] review for outstanding major security issues -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c29 --- Comment #29 from Fabian Vogt --- (In reply to Karol Babioch from comment #28)

Another finding with setBadness() work-around: kdesu

https://build.opensuse.org/package/view_file/KDE:Frameworks5/kdesu/kdesu. spec?expand=1

Request to get rid: https://build.opensuse.org/request/show/607501

Well, that was not actually enabled: %if 0%{?suse_version} <= 1310 -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c31 --- Comment #31 from Fabian Vogt --- (In reply to Karol Babioch from comment #30)

Nope, but still not necessary in Factory and Leap 15.0 any more (same as with previous findings).

Yes, but it's not necessary to have this change in Leap 15 to pass this audit - the submission deadline is closed. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1090647 http://bugzilla.suse.com/show_bug.cgi?id=1090647#c33 Karol Babioch changed: What |Removed |Added ---------------------------------------------------------------------------- Status|IN_PROGRESS |RESOLVED Resolution|--- |FIXED --- Comment #33 from Karol Babioch --- As far as I can see everything has been addressed in the meantime. -- You are receiving this mail because: You are on the CC list for the bug.