Please confine guest sessions again

[Balint Reczey]

This is a continuation of LP: #1663157 where as a workaround for the guest session not being confined the session got disabled. This bug tracks the fix for proper confinement.

Original bug report text:

Processes launched under a lightdm guest session are not confined by the /usr/lib/lightdm/lightdm-guest-session AppArmor profile in Ubuntu 16.10, Ubuntu 17.04, and Ubuntu Artful (current dev release). The processes are unconfined.

The simple test case is to log into a guest session, launch a terminal with ctrl-alt-t, and run the following command:

 $ cat /proc/self/attr/current

Expected output, as seen in Ubuntu 16.04 LTS, is:

 /usr/lib/lightdm/lightdm-guest-session (enforce)

Running the command inside of an Ubuntu 16.10 and newer guest session results in:

 unconfined

[Gunnar Hjalmarsson (gunnarhj)]

I just posted this:

https://community.ubuntu.com/t/brain-dump-on-guest-session-progress/3717/2

[Open Sense Solutions (opensense)]

Please note that the simple test ( cat /proc/self/attr/current ) can be misleading.

I tried that in Ubuntu 18.04 ( switched to lightdm ) and got "(enforce)" but some applications like the file manager could browse other user's home directories. Most applications including firefox and libreoffice are restricted. In Xubuntu the file manager is restricted as well as every other application I tried.

Is it possible to just eliminate certain applications or prevent launching applications in specific ways to guarantee a restricted guest sessions?

[Open Sense Solutions (opensense)]

I figured out why the simple test didn't work - when I first installed Ubuntu 18.04, gnome-terminal wouldn't accept any keyboard input, I assumed it was just a pre-alpha bug and installed terminator. Installing terminator switched itself to the default including launching with ctrl-alt-t , and terminator does get apparmor restricted. When I paste in "cat /proc/self/attr/current" into a gnome-terminal it shows unconfined.

[Jarno Suni (jarnos)]

I tested this on Xubuntu 18.04.3, and xfce4-terminal gives the expected output (like xterm as well). I do not see how this should depend on the terminal application used. I guess it is pretty safe to use guest session in Xubuntu.

[Jarno Suni (jarnos)]

I installed gnome-terminal and got 'unconfined'. So I could view the home directory of another user, but if the directories had no permissions for Other group, I could not view the contents in guest session. So I think a better solution than disabling guest sessions is to make proper default permissions for directories under /home directory.

[Dave Mellor (davemellor)]

The result on Ubuntu 20.04.1 is 'unconfined'.

Is this bad or to be expected?

I've noticed that Ubuntu 20.04 doesn't seem to handle multiple users well. I have no idea why.

[martinr (martinr1111)]

Please be aware when configuring app-armor of the Firefox snap, that breaks the guest-account experience in Xubuntu 22.04 LTS with Firefox version: 102.0.1 (64-bit), Mozilla Firefox Snap for Ubuntu canonical-002-1.0.
See Bug #1981881 .