-
- Downloads
Add sdk user to the sudo group to fix blueman regression
The user account `user` that is created on the SDK already has sudo powers. However this user account is not part of the sudo group. With the upgrade of blueman from 2.0.8-1co1 to 2.0.8-1+deb10u1co1 this has was now causing an error dialog saying that "You might not be able to connect to the Bluetooth network via this machine": https://github.com/blueman-project/blueman/issues/948 It seems that polkit was disabled and the update which came from debian-security to fix CVE-2020-15238 enabled it: > Blueman is a GTK+ Bluetooth Manager. In Blueman before 2.1.4, the > DhcpClient method of the D-Bus interface to blueman-mechanism is prone > to an argument injection vulnerability. The impact highly depends on the > system configuration. If Polkit-1 is disabled and for versions lower > than 2.0.6, any local user can possibly exploit this. If Polkit-1 is > enabled for version 2.0.6 and later, a possible attacker needs to be > allowed to use the `org.blueman.dhcp.client` action. That is limited to > users in the wheel group in the shipped rules file that do have the > privileges anyway. On systems with ISC DHCP client (dhclient), attackers > can pass arguments to `ip link` with the interface name that can e.g. be > used to bring down an interface or add an arbitrary XDP/BPF program. On > systems with dhcpcd and without ISC DHCP client, attackers can even run > arbitrary scripts by passing `-c/path/to/script` as an interface name. > Patches are included in 2.1.4 and master that change the DhcpClient > D-Bus method(s) to accept BlueZ network object paths instead of network > interface names. A backport to 2.0(.8) is also available. As a > workaround, make sure that Polkit-1-support is enabled and limit > privileges for the `org.blueman.dhcp.client` action to users that are > able to run arbitrary commands as root anyway in > /usr/share/polkit-1/rules.d/blueman.rules. With polkit now being enabled, this snippets becomes relevant: ``` $ sudo cat /usr/share/polkit-1/rules.d/blueman.rules // Allow users in sudo or netdev group to use blueman feature requiring root without authentication polkit.addRule(function(action, subject) { if ((action.id == "org.blueman.network.setup" || action.id == "org.blueman.dhcp.client" || action.id == "org.blueman.rfkill.setstate" || action.id == "org.blueman.pppd.pppconnect") && subject.local && subject.active && (subject.isInGroup("sudo") || subject.isInGroup("netdev"))) { return polkit.Result.YES; } }); ``` Adding the user to the `sudo` group would then make blueman happy again. Signed-off-by:Peter Senna Tschudin <peter.senna@collabora.com>
Loading
Please register or sign in to comment