[Bug 2052495] Re: [MIR] wsl-pro-service

2024-04-19 Thread Didier Roche-Tolomelli
The last security request (having per user certificate to secure the gRPC communication so that they can’t be hijacked cross-users) is now addressed with 0.1.4 with many other enhancements fixing some recommended TODOs. I’m proceeding thus with the promotion. ** Changed in: wsl-pro-service

[Bug 2052495] Re: [MIR] wsl-pro-service

2024-04-02 Thread Carlos Nihelton
Specifically adressing @iosifache concern > 3. Command execution inside the Windows host: With USB/IP the WSL instance gets low level access to a USB device as if it was actually attached to the USB bus. I won't go into the details of how to get that done, but it suffices to say that: 1. It

[Bug 2052495] Re: [MIR] wsl-pro-service

2024-03-27 Thread George-Andrei Iosif
I reviewed `wsl-pro-service` `0.1.1` as checked into Noble. This shouldn't be considered a full audit but rather a quick gauge of maintainability. For the sake of completeness, this review will also mention findings reported in previous GitHub issues and Launchpad comments. Ubuntu Pro for WSL

[Bug 2052495] Re: [MIR] wsl-pro-service

2024-03-27 Thread George-Andrei Iosif
Other patches were published in the meantime: - For the second item above, in the `347e747` commit; - Checking for a negative port number, in the `a6784f5` commit; and - Avoiding logging configuration items, in the `518a85` commit. -- You received this bug notification because you are a member

[Bug 2052495] Re: [MIR] wsl-pro-service

2024-02-29 Thread George-Andrei Iosif
The fourth item's crash has already been patched in a GitHub PR (https://github.com/canonical/ubuntu-pro-for-wsl/pull/622). -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2052495 Title: [MIR]

[Bug 2052495] Re: [MIR] wsl-pro-service

2024-02-29 Thread George-Andrei Iosif
Hi, As multiple security concerns appeared when performing the security review of this package, I had a discussion with Jean and Didier from the owning team. We concluded that reporting these issues before offering the final MIR report would be best. This is because no user is affected (as the