Bug 347822 – AUDIT-0: PulseAudio permissions

Bug 347822 - AUDIT-0: PulseAudio permissions


Summary:	AUDIT-0: PulseAudio permissions

Status:	RESOLVED FIXED

Classification:	openSUSE
Product:	openSUSE 11.0
Classification:	openSUSE
Component:	Security
Version:	Alpha 2
Hardware:	Other Other

Priority:	P5 - None Severity: Normal with 5 votes (vote)
Target Milestone:	---
Assigned To:	E-mail List
QA Contact:	E-mail List

URL:
Whiteboard:	CVE-2008-0008: CVSS v2 Base Score: 7....
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Create test case

Clone This Bug

Reported:	2007-12-11 22:12 UTC by Rodrigo Moya
Modified:	2009-10-14 01:51 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	---
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Rodrigo Moya 2007-12-11 22:12:15 UTC

I just submitted a new pulseaudio package, from http://download.opensuse.org/repositories/home:/rodrigomoya:/pulseaudio/ and came to the /usr/bin/pulseaudio which, as we found in the Fedora package, needs special SUID permissions to be run as a system daemon for all users. We are yet not 100% sure this is needed, since the first version of the package from Takashi didn't need this, but it might be needed for multi-user environments AFAIK.

Need auditing from security team

Comment 1 Thomas Biege 2007-12-12 06:32:50 UTC

System daemons should be started during boot-up therefore no setuid is needed.

Comment 2 Marcus Meissner 2007-12-12 08:34:49 UTC

a very brief look at PulseAudio shows that it uses the setuid root
only for getting the CAP_SYS_NICE capability and then drops the setuid
things. (although badly, without return value checking *sigh*)

So it is user-based, but with setuid root for switching to realtime/fifo
scheduliong (haven't looked for the code).

having it without setuid root 755 now will work fine for testing while we
review and report bugs.

Comment 5 Sebastian Krahmer 2008-04-23 07:30:51 UTC

anything happened here?

Comment 6 Thomas Biege 2008-11-10 08:35:36 UTC

closing

Comment 7 Thomas Biege 2009-10-14 01:51:08 UTC

CVE-2008-0008: CVSS v2 Base Score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)