Wrong mode on unix.socket when socket activated

[Stéphane Graber]

LXD uses systemd socket activation to start the daemon except at installation time where the daemon is started directly.

Systemd defaults to 0666 for its unix sockets instead of respecting umask, leading to /var/lib/lxd/unix.socket being world writable instead of being restricted to the lxd group as it should be.

The fix is simply to specify a mode of 0660 in the systemd unit.

This affects LXD in wily, xenial and trusty-backports. vivid's version is unaffected as we didn't have socket activation back then.

[Stéphane Graber (stgraber)]

Upstream bug report: https://github.com/lxc/lxd/issues/1307

[Launchpad Janitor (janitor)]

This bug was fixed in the package lxd - 0.20-0ubuntu4.1

---------------
lxd (0.20-0ubuntu4.1) wily-security; urgency=medium

  * SECURITY UPDATE: Fix the mode of /var/lib/lxd/unix.socket when
    socket-activated by systemd to be 0660 instead of 0666. (LP: #1515689)

 -- Marc Deslauriers <email address hidden> Thu, 12 Nov 2015 11:37:28 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package lxd - 0.22-0ubuntu2

---------------
lxd (0.22-0ubuntu2) xenial; urgency=medium

  * SECURITY UPDATE: Fix the mode of /var/lib/lxd/unix.socket when
    socket-activated by systemd to be 0660 instead of 0666. (LP: #1515689)

 -- Stéphane Graber <email address hidden> Thu, 12 Nov 2015 11:35:59 -0500

[Marc Deslauriers (mdeslaur)]

This got CVE-2015-8222