[Bug 1051921] Re: lens-bar-keynavigation periodically writes to /tmp/wut.png

[Marco Trevisan (Treviño)]

** Changed in: unity/5.0
       Status: In Progress => Fix Committed

** Changed in: unity (Ubuntu Precise)
       Status: In Progress => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1051921

Title:
  lens-bar-keynavigation periodically writes to /tmp/wut.png

Status in Unity:
  Fix Committed
Status in Unity 5.0 series:
  Fix Committed
Status in “unity” package in Ubuntu:
  Fix Released
Status in “unity” source package in Precise:
  Fix Committed

Bug description:
  [Impact]

   * Style::SquareButton writes a small png to /tmp/wut.png
   * If a user creates /tmp/wut.png as a symlink to some file on the system writeable by the owner of the unity process, then he/she can destroy that file.

  [Test Case]

   * log out
   * log in with the upgraded package
   * open the terminal application using control-alt-T, ensure the terminal is focused
   * invoke the HUD by pressing the Alt key and typing f (the HUD menu selection 'drop
     down' must appear to trigger the png file write)
   * check for presence of "/tmp/wut.png"

  [Regression Potential]

   * n/a

  [Other Info]

   * Marc Deslauriers from the security team said it isn't a problem on
  Ubuntu because we have symlink restrictions (in this case part of the
  Yama LSM [1]).

   * We believe, not everyone is necessarily running Yama LSM.

To manage notifications about this bug go to:
https://bugs.launchpad.net/unity/+bug/1051921/+subscriptions