~ubuntu-core-dev/ubuntu/+source/apport:ubuntu/kinetic

Last commit made on 2023-04-12
Get this branch:
git clone -b ubuntu/kinetic https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/apport
Members of Ubuntu Core Development Team can upload to this branch. Log in for directions.

Branch merges

Branch information

Name:
ubuntu/kinetic
Repository:
lp:~ubuntu-core-dev/ubuntu/+source/apport

Recent commits

98ef8f4... by Benjamin Drung

Release apport 2.23.1-0ubuntu3.2

Signed-off-by: Benjamin Drung <email address hidden>

754689f... by Benjamin Drung

fix: Do not run sensible-pager as root if using sudo/pkexec

The apport-cli supports view a crash. These features invoke the default
pager, which is likely to be less, other functions may apply.

It can be used to break out from restricted environments by spawning an
interactive system shell. If the binary is allowed to run as superuser
by sudo, it does not drop the elevated privileges and may be used to
access the file system, escalate or maintain privileged access.

apport-cli should normally not be called with sudo or pkexec. In case it
is called via sudo or pkexec execute `sensible-pager` as the original
user to avoid privilege elevation.

Proof of concept:

```
$ sudo apport-cli -c /var/crash/xxx.crash
[...]
Please choose (S/E/V/K/I/C): v
!id
uid=0(root) gid=0(root) groups=0(root)
!done (press RETURN)
```

This fixes CVE-2023-1326.

Bug: https://launchpad.net/bugs/2016023
Signed-off-by: Benjamin Drung <email address hidden>

8fdf9e8... by Benjamin Drung

Let apport depend on recent python3-problem-report for recent bug fix

```
Traceback (most recent call last):
  File "/usr/share/apport/whoopsie-upload-all", line 29, in <module>
    from problem_report import MalformedProblemReport
ImportError: cannot import name 'MalformedProblemReport' from 'problem_report' (/usr/lib/python3/dist-packages/problem_report.py)
```

See https://errors.ubuntu.com/problem/8c8ad00fd6db7c3c42391a48da6a4fc8e8a483fa

a9de6e0... by Benjamin Drung

Release apport 2.23.1-0ubuntu3.1

Signed-off-by: Benjamin Drung <email address hidden>

67a37f5... by Benjamin Drung

Use ubuntu/kinetic branch

Signed-off-by: Benjamin Drung <email address hidden>

d717e45... by Benjamin Drung

fix: Catch ValueError: not enough values to unpack

The problem report might be malformed which lets `whoopsie-upload-all`
crash:

```
Traceback (most recent call last):
  File "data/whoopsie-upload-all", line 250, in <module>
    main()
  File "data/whoopsie-upload-all", line 232, in main
    stamps = collect_info()
  File "data/whoopsie-upload-all", line 163, in collect_info
    res = process_report(r)
  File "data/whoopsie-upload-all", line 77, in process_report
    r.load(f, binary="compressed")
  File "problem_report.py", line 173, in load
    (key, value) = line.split(b":", 1)
ValueError: not enough values to unpack (expected 2, got 1)
```

Catch the `ValueError` and raise a `MalformedProblemReport` exception
instead (which is catched by `whoopsie-upload-all` and `apport-unpack`).

Bug: https://launchpad.net/bugs/1995100
Signed-off-by: Benjamin Drung <email address hidden>

f02f913... by Benjamin Drung

fix: Catch malformed problem report

When passing a core file, `apport-unpack` will crash:

```
Traceback (most recent call last):
  File "bin/apport-unpack", line 91, in <module>
    main()
  File "bin/apport-unpack", line 67, in main
    pr = load_report(args.report)
  File "bin/apport-unpack", line 47, in load_report
    pr.load(f, binary=False)
  File "problem_report.py", line 167, in load
    key = key.decode("ASCII")
UnicodeDecodeError: 'ascii' codec can't decode byte 0xfc in position 2: ordinal not in range(128)
```

Wrap `UnicodeDecodeError` in a `MalformedProblemReport` exception and
catch this exception in `apport-unpack` to print nice error message.

Bug-Ubuntu: https://launchpad.net/bugs/1996040
Signed-off-by: Benjamin Drung <email address hidden>

79d1398... by Benjamin Drung

Declare python3-apport breaking older apport/apport-gtk/apport-kde

Bug: https://launchpad.net/bugs/1997759
Signed-off-by: Benjamin Drung <email address hidden>

b9c3b10... by Utkarsh Gupta

Update d/ch for 2.23.1-0ubuntu3 release

04704a5... by Utkarsh Gupta

etc/apport/crashdb.conf: Disable Launchpad crash reports for 22.10 release