Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-17 Thread James Cowgill
Hi, On 16/01/18 03:41, Russell Coker wrote: > On Monday, 15 January 2018 2:15:40 PM AEDT James Cowgill wrote: >>> Sorry, we do not control the binaries that Valve >>> use in Steam. You're welcome to take this upstream to >>> https://github.com/ValveSoftware/steam-for-linux/issues/ if you believe

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Russell Coker
On Monday, 15 January 2018 2:15:40 PM AEDT James Cowgill wrote: > > Sorry, we do not control the binaries that Valve > > use in Steam. You're welcome to take this upstream to > > https://github.com/ValveSoftware/steam-for-linux/issues/ if you believe > > the use of generic i386 binaries is a

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread James Cowgill
Hi, On 15/01/18 11:18, Simon McVittie wrote: > Control: tags -1 + wontfix > > On Mon, 15 Jan 2018 at 21:47:32 +1100, Russell Coker wrote: >> this should be fixed > ... >> recompiling > > Sorry, we do not control the binaries that Valve > use in Steam. You're welcome to take this upstream to >

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Simon McVittie
On Tue, 16 Jan 2018 at 00:13:32 +1100, Russell Coker wrote: > Can't an amd64 package have dependencies on i386 packages? Dependencies with an :architecture qualifier aren't allowed, as of last time I asked (I think the only one allowed is the :any pseudo-architecture, usually seen as

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Russell Coker
> Impact: am I right in thinking that this is not in itself a security > vulnerability, but that if there is a separate security vulnerability > somewhere in Valve's binaries, having execmod access makes it > significantly easier for an attacker to turn that vulnerability into > arbitrary code

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Simon McVittie
On Mon, 15 Jan 2018 at 22:40:16 +1100, Russell Coker wrote: > On Monday, 15 January 2018 11:18:42 AM AEDT Simon McVittie wrote: > > Sorry, we do not control the binaries that Valve > > use in Steam. You're welcome to take this upstream to > >

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Russell Coker
On Monday, 15 January 2018 11:18:42 AM AEDT Simon McVittie wrote: > Sorry, we do not control the binaries that Valve > use in Steam. You're welcome to take this upstream to > https://github.com/ValveSoftware/steam-for-linux/issues/ if you believe > the use of generic i386 binaries is a security

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Simon McVittie
Control: tags -1 + wontfix On Mon, 15 Jan 2018 at 21:47:32 +1100, Russell Coker wrote: > this should be fixed ... > recompiling Sorry, we do not control the binaries that Valve use in Steam. You're welcome to take this upstream to https://github.com/ValveSoftware/steam-for-linux/issues/ if you

Bug#887348: steam:i386: execmod access is requested, security issue

2018-01-15 Thread Russell Coker
Package: steam Version: 1.0.0.54-3 Severity: normal Tags: upstream type=AVC msg=audit(1516012042.500:1381380): avc: denied { execmod } for pid=4488 comm="steam" path="/home/rjc/.steam/ubuntu12_32/libavutil.so.55" dev="sda2" ino=64950