http://bugzilla.suse.com/show_bug.cgi?id=1127366
http://bugzilla.suse.com/show_bug.cgi?id=1127366#c10
Matthias Gerstner changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|AUDIT-0: snapd: add polkit |AUDIT-0: snapd: review of
|privileges related to snapd |new daemon running as root
|(io.snapcraft.snapd.*) |and polkit privileges
| |related to snapd
| |(io.snapcraft.snapd.*)
--- Comment #10 from Matthias Gerstner ---
This review will take longer than expected since snapd runs as root, is user
activated via a unix domain socket and consists of quite extensive Go code.
One aspect I already noticed as problematic: The reexec logic in
`ExecInSnapdOrCoreSnap()`. The daemon tries to find a newer version of itself
in the core image which is downloaded from external sources, and execute it.
As a (potentially enterprise) distribution we're fulfilling certain
expectations of our users like:
- that only software expressly approved by SUSE is run when using RPMs from
our repositories.
- that a certain degree of quality assurance, which security reviews like this
one are also a part of, are performed for these software packages.
When snapd reexecutes itself as an externally downloaded, newer version then
this is completely outside of our control and it can bypass our policies.
While this is true also for regular application images, the regular
applications run in a container and usually not as root while snapd is part of
the core software and runs as root in the host namespace. This I consider
more sensitive.
There is an environment variable SNAP_REEXEC=0 that can be passed to disable
this behaviour in snapd. Adding this e.g. as patch for the snapd.service file
for the SUSE package could be an approach to fix this problem for us. An
interested user would still be able to remove this environment variable and
retain the default behaviour. Maybe an ever better approach would be the other
way around: To disable this behaviour by default and require passing of
SNAP_REEXEC=1 to enable it.
--
You are receiving this mail because:
You are on the CC list for the bug.
