INSECURE permissions for Ubuntu Netplan YAML on installer execution, cloud images
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
cloud-images |
Fix Released
|
Undecided
|
Unassigned | ||
subiquity |
Fix Released
|
High
|
Chris Peterson |
Bug Description
Currently, the Subiquity installer for 22.04 and Server images creates 00-installer-
However, Ubuntu 22.04 now has version 0.106.1 backported via -updates pocket. In netplan version 0.106.1, there is a requirement in the system that the permissions for netplan YAMLs need to be more secure, and that the files should not be readable by anyone. To that effect, the only functionally acceptable permissions that DO NOT throw warnings are 600 on the netplan YAML files.
This is a bug in the Subiquity installer used for Server 22.04 and others. This should likely be patched in Subiquity so that during the process of installation, Netplan required permissions are respected **on install** rather than allowing warnings to trigger after the fact and create extra noise.
---
This is flagged as a Security issue because it is in effect CWE-266 (CWE-266: Incorrect Privilege Assignment) and should be considered a security flaw, even if it's low-grade.
information type: | Private Security → Public Security |
tags: | added: foundations-todo |
Changed in subiquity: | |
status: | New → Triaged |
importance: | Undecided → High |
description: | updated |
description: | updated |
Changed in subiquity: | |
assignee: | nobody → Chris Peterson (cpete) |
summary: |
- INSECURE permissions for Ubuntu Netplan YAML on installer execution + INSECURE permissions for Ubuntu Netplan YAML on installer execution, + cloud images |
Changed in cloud-images: | |
status: | New → Fix Released |
Additional notes:
This has been confirmed as of yesterday to affect the Cloud images which, when deployed via LXD, include a 50-cloud-init.yaml for DHCP with the same permissions flaws. This may need to be handled in cloud image generation with an additional chmod call (and may be a cloud-init issue if LXD populates that way)