[Bug 1949115] Re: default install of focal allows privilege escalation via lxd group

[Sebastien Bacher]

Thanks for the feedback Alex, I will make sure we check early what's the
impact on snapcraft

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to user-setup in Ubuntu.
https://bugs.launchpad.net/bugs/1949115

Title:
  default install of focal allows privilege escalation via lxd group

Status in user-setup package in Ubuntu:
  Fix Committed

Bug description:
  By default, a new installation of Ubuntu (at least I tried 20.04
  Desktop, but I assume this applies to other variants/versions as well)
  create a user which is in the lxd group. When the lxd snap is also
  installed, this user can now create privileged containers which
  essentially allow trivial privilege elevation to root.

  This might be a bug in lxd with privileged container creation
  requiring full root, or it might be the case that the default user
  should not be put into the lxd group out of the box, so I'm not sure
  what's the best package to file this one against.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/user-setup/+bug/1949115/+subscriptions