Ubuntu
pulseaudio package

  1. Bug #1895928
  2. Comment #5

Comment 5 for bug 1895928

Revision history for this message
James Henstridge (jamesh) wrote :

Here is a draft fix for the bug as a patch against 20.04's Pulse Audio. If this looks okay, it should be fairly easy to port to xenial, bionic, and groovy.

With these changes, we use aa_getpeercon() to retrieve the peer's AppArmor label at connection time and store it in the pa_client struct. The policy module then uses this label rather than the "SCM_CREDENTIALS -> process ID -> aa_gettaskcon" method it currently does.

The pa-race test snap consistently returns access denied with these changes applied.

I had a go at trying to slot in a fix for bug 1886854 (allow classic snaps to load modules), but I'm getting protocol errors when switching those hooks to async mode. So this is just a fix for the SCM_CREDENTIALS security issue.