Typo in UDisks action

[kev]

It appears that com.ubuntu.desktop.pkla contains a typo in the UDisks section:

[Mounting, checking, etc. of internal drives]
Identity=unix-group:admin;unix-group:sudo
Action=org.freedesktop.udisks.filesystem-*;org.freedesktop.udisks.drive-ata-smart*;org.freedesktop.udisks2.filesystem-mount-system;org.freedesktop.udisks2.encrypted-unlock-system;org.freedesktop.udisks2.filesystem-fstab;
ResultActive=yes

Notice that the first two actions contain the string "udisks", rather than "udisks2", which appears to be a typo.

However, the typo is actually a lucky accident because it is preventing a vulnerability in UDisks from being exploited. The vulnerable code in UDisks is protected by the `org.freedesktop.udisks2.filesystem-take-ownership` polkit action, so it will become accessible if the typo is fixed. I have separately reported the UDisks vulnerability to the maintainers of UDisks. I have attached a copy of that report for your information.

I would recommend removing the first two actions from this file. Since they don't currently work, presumably nobody will miss them if they are removed.

[Marc Deslauriers (mdeslaur)]

That's not a typo, those are the rules for udisks v1 which we shipped in older releases at the same time as udisks2. We should remove them, they haven't been needed for a long time now.

[kev (kbackhouse2000)]

Hi Marc. Thanks! I heard back from the UDisks2 team, who said the same thing: these policies are correct, but refer to an obsolete version of the software. They also said that they are already aware of the symlink issue in TakeOwnership method, but do not consider it a vulnerability because the vulnerable code is gated by polkit. So I am happy to close this issue.

[Seth Arnold (seth-arnold)]

Hello Kevin, thanks for the excellent GHSL-2020-161 report. Given that the polkit rules are intentional, if ancient, and the udisks2 team doesn't want to treat the symlink finding as a security bug, I'm going to open this publicly and mark it wontfix, to reflect what's likely going to happen for our currently released systems.

I do hope upstream handles the symlink discovery eventually but I can appreciate why they wouldn't want to handle it as a security issue.

Thanks

[Launchpad Janitor (janitor)]

This bug was fixed in the package policykit-desktop-privileges - 0.22

---------------
policykit-desktop-privileges (0.22) mantic; urgency=medium

  * Include a .rules in the new javascript format for newer polkitd
  * Remove old legacy udisks1 actions (lp: #1899019)
  * Remove the network manager system connection override
    there is a similar entry included in the network-manager package
  * Update copyright, debhelper and standards version
  * Remove old breaks, update for the new polkitd binary naming

 -- Sebastien Bacher <email address hidden> Mon, 05 Jun 2023 11:58:29 +0200