Apport hook attaches private data, but does not mark bug private

Bug #389702 reported by Micah Gersten
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
network-manager (Ubuntu)
Fix Released
Wishlist
Mathieu Trudel-Lapierre

Bug Description

Binary package hint: network-manager

The apport hook for network manager attached my vpn connection info and my private SSID info. This should be
marked private by default since a normal user might not have realized that private info was attached.

Regular Jaunty install

network-manager:
  Installed: 0.7.1~rc4.1.cf199a964-0ubuntu2
  Candidate: 0.7.1~rc4.1.cf199a964-0ubuntu2
  Version table:
 *** 0.7.1~rc4.1.cf199a964-0ubuntu2 0
        500 http://archive.ubuntu.com jaunty/main Packages
        100 /var/lib/dpkg/status

Revision history for this message
Alexander Sack (asac) wrote :

i am not sure how serious this is. maybe the apport hook should anonymize the attachments instead of making it private. Patches welcome!

Changed in network-manager (Ubuntu):
importance: Undecided → Wishlist
status: New → Triaged
Revision history for this message
Mathieu Trudel-Lapierre (cyphermox) wrote :

I also don't feel it's very serious since for example SSIDs are generally broadcasted, but this is still an issue, and I rather give the users a way to not add this information (with a strong recommendation to still add it):

    try:
        response = ui.yesno("You can also include scan results and "
            "configuration parameters which may greatly help in diagnosing "
            "the issue you are seeing. However, it may contain sensitive "
            "information. Do you want to include these?")

        if response:
            report['Gconf'] = command_output(['gconftool-2','-R','/system/networking'])
            report['Keyfiles'] = command_output(['ls -l','/etc/NetworkManager/system-connections/'])
            # nm-tool happens to give a good snapshot of the client's state, so try to capture this
            report['NMTool'] = command_output(['nm-tool'])
    except:
        pass

I guess the exact wording can be reworked but the idea is there. Marking In Progress since I should be uploading this shortly.

Changed in network-manager (Ubuntu):
status: Triaged → In Progress
assignee: nobody → Mathieu Trudel-Lapierre (mathieu-tl)
Revision history for this message
Micah Gersten (micahg) wrote :

What was more concerning that the SSID info was the VPN info.

Revision history for this message
Mathieu Trudel-Lapierre (cyphermox) wrote :

That will be included in the same question: it's retrieved from the information in Gconf.

Revision history for this message
Micah Gersten (micahg) wrote : Re: [Bug 389702] Re: Apport hook attaches private data, but does not mark bug private

The language of the question should mention that as well then :)

Revision history for this message
Mathieu Trudel-Lapierre (cyphermox) wrote :

Now in NM packaging branch, I'm about to upload a fix. I updated the wording to specifically mention Gconf keys and such.

Changed in network-manager (Ubuntu):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package network-manager - 0.8.3+git.20101219t181118.e919218-0ubuntu2

---------------
network-manager (0.8.3+git.20101219t181118.e919218-0ubuntu2) natty; urgency=low

  [ Mathieu Trudel-Lapierre ]
  * debian/source_network-manager.py:
    - Replace HAL usage by udev and other means. (LP: #654900)
    - Make Gconf/settings/scan results inclusion conditional (LP: #389702)
  * debian/patches/gtkdoc-build-requires-gobject.patch: explicitly link against
    gobject-2.0 to build documentation files.

  [ Thomas Bechtold ]
  * Install gtk-doc API with libnm-util-dev and libnm-glib-dev (LP: #706965)
    - update debian/libnm-glib-dev.install
    - update debian/libnm-util-dev.install
  * Regenerate libnm-glib, libnm-util documentation at build time
    - update debian/rules
 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 07 Feb 2011 11:34:46 -0500

Changed in network-manager (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.