Comment 7 for bug 1829071

Hello again folks,

I just noticed the LXD snap is included in a default installation of Ubuntu 19.04 Server. I really don't mean to pick on LXD (I actually really love the tool and think the team is doing awesome work), but I want to make a few points clear:

- In default installations of Ubuntu, users who follow the official documentation to create their first LXD container are introducing a privilege escalation vulnerability on their systems with no warning.
- Users who follow guides to create "unprivileged" containers are in fact creating containers under the context of their accounts that are members of the LXD group, which is essentially root due to multiple vulnerabilities.
- Savvy attackers have been able to figure this out using Google for at least two years now.
- I have multiple fully working exploits (including the new attack leveraging relayed UNIX socket creds) and a detailed technical write-up I am ready to publish.

If the stance is still "this is not a security issue" - I understand and respect that, and will assume there is no issue with publishing the exploits for other security researchers.

Thanks again for reading, I know you are all quite busy juggling many projects.

Thanks!