Mark. 14th would be great

David

On Wed, 6 Dec 2023, 17:51 Mark Esler, <email address hidden> wrote:

> Thanks Nishit.
>
> David, can we set the CRD to December 14th?
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/2044373
>
> Title:
>   CVEs to resolve multi-user accessibility of multiple extras applets
>   and applications
>
> Status in budgie-extras package in Ubuntu:
>   New
> Status in budgie-extras source package in Jammy:
>   New
> Status in budgie-extras source package in Lunar:
>   New
> Status in budgie-extras source package in Mantic:
>   New
> Status in budgie-extras source package in Noble:
>   New
>
> Bug description:
>   Tracking bug report
>
>   DRAFT TO BE COMPLETED
>
>   [ Impact ]
>
>    * The Ubuntu Budgie team have been notified of several issues that
>   require CVE's to be assigned to the budgie-extras package in mantic.
>   budgie-extras is specific to the budgie-desktop and is in the universe
>   repo.  No other flavours use this package.
>
>   The recommendation from the opensuse security team is for one CVE per
>   binary. The report details 4 potential CVEs.  Analysis by the UB team
> have determined a further two CVEs are warranted since the issues
> identified apply to two further binaries.
>
>   Thus a total of 6 CVEs.
>
>   All the CVEs are based around a similar issue - usage of temporary
>   files in /tmp which are easily guessable for a system with two or more
>   users - one user could in theory craft temporary files that would
>   impact another user of these budgie based binaries.
>
>   [ Test Plan ]
>
>    * Since this issue has now switched the stored location to user-space
> the test plan needs to:
>   a) ensure the existing capabilities works as expected;
>   b) verify that /tmp is NOT being used and that the transitory files are
> being written to the user-space locations i.e. $XDG_RUNTIME_DIR or $HOME
> are being used instead.
>
>   Use the following notify script (save as ~/notifydir.sh and chmod +x
>   ~/notifydir.sh) to watch a folder - run it in three tilix sessions:
>
>   #!/bin/bash
>
>   monitor_path="$1"
>
>   inotifywait -m "$monitor_path" -e create -e moved_to |
>       while read path action file; do
>           echo "The file '$file' appeared in directory '$path' via
> '$action'"
>           ls -la "$path/$file"
>       done
>
>   i.e. in session 1 run ~/notifydir.sh /tmp
>   in session 2 run ~/notifydir.sh $XDG_RUNTIME
>   in session 3 run ~/notifydir.sh $HOME
>
>    1. From budgie desktop settings add one of the affected applets:
>   budgie-takeabreak
>   budgie-dropby
>   budgie-clockworks
>   budgie-weathershow
>
>    2a. For takeabreak enable a takeabreak action.
>    2b. For dropby, insert a USB stick and mount the stick
>    2c. For clockworks create another clock
>    2d. For weathershow - change to another location and open the popup to
> show the weather
>    3.
>   For all of the above examine the tilix sessions. Session 1 should not
> show temporary files being written in /tmp. Note you will see other
> temporary files for the operating system in general but that should be
> expected
>
>   Session 2 for UB should show files being written.
>
>   Session 3 for UB should not show any screenshot files being written.
> This is as expected because UB should not normally use the fallback folder.
>     4. Repeat for the other applets
>     5. Repeat but enable budgie window previews by the menu application
> (search for previews)
>     6. Repeat but enable budgie window shuffler by the menu application
> (search for shuffler)
>
>   [ Where problems could occur ]
>
>    * The issue is specific to budgie-desktop users only and is limited to
> one specific capability of budgie i.e. a specific applet or budgie
> application (window previews/window shuffler)
>    * If the user space locations - XDG_RUNTIME_DIR or HOME do not exist
> then the applet/budgie application will not capture the image. It is
> considered that it is highly unlikely that a budgie-desktop user will be
> attempting to run a session without a HOME folder location i.e. the
> ultimately fallback each applet/budgie application requires
>
>   [ Other Info ]
>
>    * The budgie team have tested the above for jammy, lunar and mantic.
>   The testing involves applying the debdiff's for each series and building
> via sbuild.  The applet/application binaries have then been installed via
> sudo apt install ./appletapplication.deb
>    * For noble there will be a version bump from github - v1.7.1 that has
> been/will be uploaded first to Debian unstable before sync'ing to noble.
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/budgie-extras/+bug/2044373/+subscriptions
>
>