* SECURITY UPDATE: don't rely on SCM_CREDENTIALS to detect snap confined
clients (LP: #1895928)
- d/p/0409-pa-client-peer-credentials.patch: drop patch
- d/p/0409-fix-arg-parsing-after-async-hook.patch: remains of old 0409
patch not related to pa_creds.
- d/p/0410-pa-client-peer-apparmor-label.patch: new patch, records
AppArmor label in pa_client struct for native connections using
aa_getpeercon.
- d/p/0702-add-snappy-policy-module.patch: use the AppArmor
label in the pa_client rather than looking it up via the process ID
from SCM_CREDENTIALS.
- CVE-2020-16123
* Don't block classic snaps from module loading/unloading (LP: #1886854)
- d/p/0702-add-snappy-policy-module.patch: replace
deny_to_snaps_hook with a version that allows classic snaps.
This bug was fixed in the package pulseaudio - 1:11.1-1ubuntu7.11
--------------- 1ubuntu7. 11) bionic-security; urgency=medium
pulseaudio (1:11.1-
* SECURITY UPDATE: don't rely on SCM_CREDENTIALS to detect snap confined pa-client- peer-credential s.patch: drop patch fix-arg- parsing- after-async- hook.patch: remains of old 0409 pa-client- peer-apparmor- label.patch: new patch, records getpeercon. add-snappy- policy- module. patch: use the AppArmor add-snappy- policy- module. patch: replace to_snaps_ hook with a version that allows classic snaps.
clients (LP: #1895928)
- d/p/0409-
- d/p/0409-
patch not related to pa_creds.
- d/p/0410-
AppArmor label in pa_client struct for native connections using
aa_
- d/p/0702-
label in the pa_client rather than looking it up via the process ID
from SCM_CREDENTIALS.
- CVE-2020-16123
* Don't block classic snaps from module loading/unloading (LP: #1886854)
- d/p/0702-
deny_
-- James Henstridge <email address hidden> Tue, 22 Sep 2020 12:30:20 +0800