This bug was fixed in the package apparmor-easyprof-ubuntu - 1.0.16
---------------
apparmor-easyprof-ubuntu (1.0.16) saucy; urgency=low
* rename data_exchange policy group to content_exchange. This would normally
constitute a new minor version, but no one is using these yet
* ubuntu-sdk template:
- add a couple PROC accesses for desktop systems
- add /usr/bin/qtchooser rmix for launching under upstart
- add device specific access for desktop nvidia users (LP: #1212425)
- adjust to use /{,var/}run/user/*/confined/@{APPNAME} instead of
/{,var/}run/user/*/@{APPNAME}
-- Jamie Strandboge <[email protected]> Wed, 14 Aug 2013 13:56:04 -0500
** Changed in: apparmor-easyprof-ubuntu (Ubuntu Saucy)
Status: In Progress => Fix Released
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to nvidia-graphics-drivers-319 in Ubuntu.
https://bugs.launchpad.net/bugs/1212425
Title:
SDK applications require too many accesses on desktop with nvidia
Status in “apparmor-easyprof-ubuntu” package in Ubuntu:
Fix Released
Status in “nvidia-graphics-drivers-319” package in Ubuntu:
New
Status in “nvidia-graphics-drivers-tegra” package in Ubuntu:
New
Status in “nvidia-graphics-drivers-tegra3” package in Ubuntu:
New
Status in “apparmor-easyprof-ubuntu” source package in Saucy:
Fix Released
Status in “nvidia-graphics-drivers-319” source package in Saucy:
New
Status in “nvidia-graphics-drivers-tegra” source package in Saucy:
New
Status in “nvidia-graphics-drivers-tegra3” source package in Saucy:
New
Bug description:
Nvidia desktop users need the following AppArmor permissions to avoid denials:
owner /tmp/gl* mrw,
But this rule breaks application confinement such that apps are able
to tamper with each other. Interestingly, apps still run without the
rule, so we can explicitly deny it for now.
The use of /tmp is apparently hardcoded and does not honor TMPDIR
(application confinement will setup TMPDIR to a private area for the app).
strace confirms this:
24603 mkdir("/tmp", 0777) = -1 EEXIST (File exists)
24603 open("/tmp/glBRPYmm", O_RDWR|O_CREAT|O_EXCL, 0600) = -1 EACCES
(Permission denied)
While the use of O_EXCL is safe however, we don't allow access to /tmp
for confined apps and libraries/applications should always honor
TMPDIR.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor-easyprof-ubuntu/+bug/1212425/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
