ubuntu-advantage-desktop-daemon (pro client in general) may expose the pro token to other users

[Marco Trevisan (Treviño)]

While attaching through a desktop application the u-a-desktop-daemon may call pro process via

  /usr/bin/python3 /usr/bin/ua attach ZCAb12TN2..........

And the token is visible to any user able to `ps` the system, potentially causing this info to be leaked.

Just use

  gdbus call --system --dest com.canonical.UbuntuAdvantage \
  --object-path /com/canonical/UbuntuAdvantage/Manager \
  --method com.canonical.UbuntuAdvantage.Manager.Attach "$TOKEN"

and pro client attaching with visible token will be in the result of `ps aux|grep attach`

To prevent this to happen, the attach should pass the token to the client via an environment variable or a not readable --attach-config file.

In fact this happen when even attaching manually, as suggested in the official ubuntu pro website, but I feel it's not what we should ever do since passing a private token via args, may cause it to be leaked.

While for the usage of the pro client itself, it should *always* go through getpass-like or if some other interactive way (if we want keep it readable).

---

One way for the pro client to avoid exposing this for long time as it does now, would be, at least, to just make it re-exec itself when the token is passed as argument. Passing it as an internal env variable instead (better than creating a temporary attach-config, since that would imply IO and so potential slowdown).

---

ProblemType: BugDistroRelease: Ubuntu 22.04
Package: ubuntu-advantage-desktop-daemon 1.10~22.04.1
ProcVersionSignature: Ubuntu 6.8.0-35.35-generic 6.8.4
Uname: Linux 6.8.0-35-generic x86_64
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Tue Jun 11 02:39:48 2024
InstallationDate: Installed on 2010-07-10 (5084 days ago)InstallationMedia: Ubuntu 10.04 LTS "Lucid Lynx" - Release amd64 (20100429)
RebootRequiredPkgs: Error: path contained symlinks.SourcePackage: ubuntu-advantage-desktop-daemon
UpgradeStatus: Upgraded to jammy on 2020-06-14 (1457 days ago)

[Marco Trevisan (Treviño) (3v1n0)]

Not sure if this also affects the API call `u.pro.attach.magic.wait.v1`, where the magic is passed, since in such case we should rely on further user interaction so it shouldn't be really a problem.

However, I guess also the `api` calls should support reading from a file other than stdin

[Marco Trevisan (Treviño) (3v1n0)]

ubuntu advantage daemon is handled at
  https://github.com/canonical/ubuntu-advantage-desktop-daemon/pull/24

[Mark Esler (eslerm)]

Please refer to this issue as CVE-2024-6388.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-desktop-daemon - 1.12

---------------
ubuntu-advantage-desktop-daemon (1.12) oracular; urgency=medium

  * Pass the token via a private temporary attach config file (lp: #2068944)

 -- Sebastien Bacher <email address hidden> Thu, 27 Jun 2024 14:31:53 +0200