File 0002-interfaces-builtin-x11-disable-rules-denyi... of Package snapd

Overview Repositories Revisions Requests Users Attributes Meta

File 0002-interfaces-builtin-x11-disable-rules-denying-AF_UNIX.patch of Package snapd (Revision b96d5335a6ac4cce91caa1db72d075ac)

Currently displaying revision b96d5335a6ac4cce91caa1db72d075ac , Show latest

From 2a5f97e61e1e6457bc7f813c7d56cbac00b39205 Mon Sep 17 00:00:00 2001
Message-Id: <2a5f97e61e1e6457bc7f813c7d56cbac00b39205.1610533091.git.maciej.zenon.borzecki@canonical.com>
From: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>
Date: Wed, 13 Jan 2021 11:14:56 +0100
Subject: [PATCH] interfaces/builtin/x11: disable rules denying AF_UNIX to ICE
 due to bsc#1180766

Disable the rule denying all AF_UNIX traffic to ICE-unix due to
https://bugzilla.opensuse.org/show_bug.cgi?id=1180766. Because the kernels lack
the fine grained AF_UNIX mediation patches, the rule is downgraded and blocks
all unix sockets, thus the simplest socket(AF_UNIX, ..) fails with -EACCESS.

Signed-off-by: Maciej Borzecki <maciej.zenon.borzecki@canonical.com>
---
 interfaces/builtin/x11.go | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/interfaces/builtin/x11.go b/interfaces/builtin/x11.go
index 4a9314fec7d67719a30285b161cc717fe0af797e..01dbda1a7bfd9a51a98350f5549f6c17f3c8baac 100644
--- a/interfaces/builtin/x11.go
+++ b/interfaces/builtin/x11.go
@@ -146,9 +146,13 @@ network netlink raw,
 # See: https://bugs.launchpad.net/snapd/+bug/1901489
 deny owner @{HOME}/.ICEauthority r,
 deny owner /run/user/*/ICEauthority r,
-deny unix (connect, receive, send)
-    type=stream
-    peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
+# XXX 13.01.2021: disable the following deny entry due to:
+# https://bugzilla.opensuse.org/show_bug.cgi?id=1180766
+# because the kernels lack the fine grained AF_UNIX mediation patches,
+# the rule is downgraded and blocks all unix sockets
+# deny unix (connect, receive, send)
+#     type=stream
+#     peer=(addr="@/tmp/.ICE-unix/[0-9]*"),
 `
 
 const x11ConnectedPlugSecComp = `
-- 
2.30.0

Places

File 0002-interfaces-builtin-x11-disable-rules-denying-AF_UNIX.patch of Package snapd (Revision b96d5335a6ac4cce91caa1db72d075ac)

Places