Tails

#2 Updated by cypherpunks 2017-03-11 10:11:16

This might be a useful way to what profiles are able to access the pseudoterminal. It’s not perfect because it only looks at one, and it doesn’t check for write permission for the character device. I don’t have a Tails system handy right now, but manual analysis makes it look like Tor Browser cannot access the pseudoterminals.

cat /sys/kernel/security/apparmor/policy/profile/*/name 2>/dev/null | while read -r i; do
    if aa-exec -p "$i" -- stty -a < /dev/pts/0 >/dev/null; then
        echo "$i"
    fi
done

Is resolving this bug going to take until the next version of Tails, or is an emergency release going to be issued for this quite severe vulnerability?

#3 Updated by intrigeri 2017-03-19 09:17:38

I want it to be fixed in 3.0~beta3 (today).

#5 Updated by intrigeri 2017-03-19 10:20:36

cypherpunks wrote:
> Is resolving this bug going to take until the next version of Tails,

Yes: 2.12 and 3.0~beta3.

> or is an emergency release going to be issued for this quite severe vulnerability?

We can’t afford doing emergency releases for every local priv esc :/ … yet. (Reproducible builds will make this a bit cheaper.)

#7 Updated by cypherpunks 2017-03-30 02:39:49

intrigeri wrote:
> cypherpunks wrote:
> > or is an emergency release going to be issued for this quite severe vulnerability?
> We can’t afford doing emergency releases for every local priv esc :/ … yet. (Reproducible builds will make this a bit cheaper.)
I hope that at least the upgrade importance will be rated as high, instead of medium as it is every other time.

#8 Updated by intrigeri 2017-03-30 08:58:59

> I hope that at least the upgrade importance will be rated as high, instead of medium as it is every other time.

What’s the “upgrade importance”?

#9 Updated by cypherpunks 2017-04-01 03:19:47

intrigeri wrote:
> > I hope that at least the upgrade importance will be rated as high, instead of medium as it is every other time.
>
> What’s the “upgrade importance”?

Urgency, I mean. For example, from the changelogs:

tails (3.0~beta3) unstable; urgency=medium

#10 Updated by intrigeri 2017-04-01 06:23:30

> Urgency, I mean. For example, from the changelogs:

>

> tails (3.0~beta3) unstable; urgency=medium
> 

I see. Thankfully we don’t communicate this to users as “upgrade importance”.

#11 Updated by cypherpunks 2017-04-03 01:56:40

intrigeri wrote:
> > Urgency, I mean. For example, from the changelogs:
>
> > […]
>
> I see. Thankfully we don’t communicate this to users as “upgrade importance”.
This has confused me and others I have talked to in the past, then, considering users are linked to the changelog. Perhaps it should be clarified or removed in that case, but that’s for another ticket.