[quantal] isc-dhcp-client dropped network-interface-security symlink and therefore may run unconfined

[Jamie Strandboge]

[IMPACT]
 * dhclient is a root run process and successfully exploiting a flaw in dhclient could
   have severe consequences for the user's system
[TESTCASE]
 * On an Ubuntu server system using dhcp for an interface:
  1. sudo aa-status # bug not fixed
     ...
     1 processes are unconfined but have a profile defined.
     /sbin/dhclient (<pid>)
  2. install the updates
  3. reboot
  4. sudo aa-status # bug fixed
     ...
     5 processes are in enforce mode.
     /sbin/dhclient (<pid>)
     ...
     0 processes are unconfined but have a profile defined.

[Regression Potential]
 * Regression potential is low. The AppArmor profile for dhclient has been in use for
   years and is still in effect on the default Ubuntu desktop because of when network
   manager runs (the profile is loaded before the interface is brought up). Therefore
   there should be no surprise denials.

= Initial report =
I was doing install audits of 12.10 and noticed this with 'sudo aa-status':
1 processes are unconfined but have a profile defined.
   /sbin/dhclient (<pid removed>)

This is a regression over 12.04 and needs to be fixed in an SRU. I don't know what introduced the regression, but it is very likely a race condition. I saw it on 12.10 server but not on 12.10 desktop. It seems to be at least somewhat reproducible (rebooting once showed it is still affected) with an amd64 VM with 1024M of ram with installation defaults (except home directory is encrypted) and the following tasks installed:
Basic Ubuntu server
OpenSSH server
DNS server
LAMP server
Mail server
PostgreSQL database
Print server
Samba file server
Tomcat Java server
Virtual Machine host

Upon investigation this is because /etc/init/network-interface-security.conf is looking for files in /etc/apparmor/init/network-interface-security/*. Unfortunately, the quantal merge dropped this:
diff -Naur ./precise/isc-dhcp-4.1.ESV-R4/debian/isc-dhcp-client.links ./quantal/isc-dhcp-4.2.4/debian/isc-dhcp-client.links
--- ./precise/isc-dhcp-4.1.ESV-R4/debian/isc-dhcp-client.links 2012-10-16 13:48:13.000000000 -0500
+++ ./quantal/isc-dhcp-4.2.4/debian/isc-dhcp-client.links 1969-12-31 18:00:00.000000000 -0600
@@ -1,3 +0,0 @@
-sbin/dhclient sbin/dhclient3
-usr/share/man/man8/dhclient.8.gz usr/share/man/man8/dhclient3.8.gz
-etc/apparmor.d/sbin.dhclient etc/apparmor/init/network-interface-security/sbin.dhclient

[Stéphane Graber (stgraber)]

Re-introduced the missing symlink. Upload to quantal-proposed.

[Jamie Strandboge (jdstrand)]

FYI, I built the unapproved package locally and it fixes the issue.

[Steve Langasek (vorlon)]

Jamie, how did you confirm that the package fixes the issue? The details should be added to the bug description per the SRU process. Thanks!

[Steve Langasek (vorlon)]

Hello Jamie, or anyone else affected,

Accepted isc-dhcp into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/isc-dhcp/4.2.4-1ubuntu10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Jamie Strandboge (jdstrand)]

4.2.4-1ubuntu10.1 from quantal-proposed works great. The test case passes and there are no apparmor denials.

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package isc-dhcp - 4.2.4-1ubuntu10.1

---------------
isc-dhcp (4.2.4-1ubuntu10.1) quantal-proposed; urgency=low

  * Re-introduce missing symlink for dhclient in
    /etc/apparmor/init/network-interface-security/ (LP: #1067473)
 -- Stephane Graber <email address hidden> Tue, 16 Oct 2012 21:37:40 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package isc-dhcp - 4.2.4-2ubuntu1

---------------
isc-dhcp (4.2.4-2ubuntu1) raring; urgency=low

  * Merge from Debian, remaining changes:
    - Apparmor profiles for dhclient and dhcpd.
    - Upstart jobs for isc-dhcp-server, isc-dhcp-server6, isc-dhcp-relay and
      isc-dhcp-relay6. (LP: #944849)
    - Separate default file for isc-dhcp-relay6. (LP: #944849)
    - Apport hook for isc-dhcp-client and isc-dhcp-server.
    - dhcient.conf: Set for IPv6 (fqdn.fqdn and dhcp6.*) (LP: #770324)
    - If /etc/ltsp/dhcpd.conf exists, use that instead of /etc/dhcp/dhcpd.conf
    - Drop isc-dhcp-server/new_auth_behavior question from high to medium
    - Create user/group dhcpd (LP: #727837)
    - Create /etc/dhcp/ddns-keys/ for DDNS updates (LP: #341817)
    - Build with extra hardening and use --enable-paranoia to run dhcpd as user
      (LP: #727837)
    - Add IPv6 support to dhclient-script.linux.udeb
    - Wait for /etc/resolv.conf to be writable in dhclient-script.linux.
      (LP: #856984)
    - Sanitize environment in dhclient-script.linux. (LP: #1045986)
    - Don't call 'ip addr flush' as it breaks IPv6 networking. (LP: #1023174)
    - Remaining Ubuntu patches:
      + dhclient-fix-backoff
      + dhclient-more-debug (LP: #35265)
      + dhclient-onetry-call-clientscript
      + dhclient-safer-timeout (LP: #838968)
      + dhcpd.conf-subnet-examples (LP: #26661)
      + multi-ip-addr-per-if (LP: #717166)
      + onetry_retry_after_initial_success (LP: #974284)
      + revert-next-server

isc-dhcp (4.2.4-2) unstable; urgency=low

  * Fix multiple security issues (closes: #686174)
    - cve-2012-3570: buffer overflow via lanrge hardware address length.
    - cve-2012-3571: denial-of-service via zero-length packets.
    - cve-2012-3954: two potential memory leaks.
    - cve-2012-3955: server abort due to certain lease time changes.
 -- Stephane Graber <email address hidden> Thu, 25 Oct 2012 13:53:57 +0200