v1.2.5

Ubuntu Hello v1.2.5 - Root Helper Hardening (Security Fix)

This is a security release: it fixes a local privilege escalation in the keyring/KWallet unlocking path. Anyone with keyring unlocking enabled should upgrade.

---

🔧 What's in this release

• 🔒 Security fix: root code execution through the keyring helpers. When keyring/KWallet unlocking was enabled, the PAM module started two root helpers through popen(): the TPM unseal steps after a face match, and ubuntu-hello keyring enable from pam_sm_setcred. That runs /bin/sh as uid 0 with the calling user's environment. The setuid program (su, sudo, …) has already had glibc remove the loader variables such as LD_PRELOAD, but PATH, PYTHONPATH and BASH_ENV were still there. The TPM step ran tpm2_* by bare name, so the shell found it through the caller's PATH. The ubuntu-hello wrapper ran Python without -E, so PYTHONPATH applied. Where /bin/sh is bash, BASH_ENV was read too, because the module had already set both uids to 0. A local user with keyring unlocking enabled could set one of these, run su $USER, authenticate with their own password or face, and have their code run as root without any sudo rights.
  • Every root helper now starts through one function, run_root_helper(). It uses posix_spawn with an absolute path and a fixed argument list, with no shell, and passes only the scrubbed environment compare.py already used: a fixed PATH plus checked locale variables.
  • The TPM unseal is now three direct runs of /usr/bin/tpm2_createprimary, tpm2_load and tpm2_unseal. The temporary context files are removed with unlink().
  • Sealing the keyring password at login runs python3 -E -s cli.py keyring enable -U <user> directly, with the password on stdin, instead of the /bin/sh ubuntu-hello wrapper. The username no longer passes through a shell string.
• 🧪 Tests. pam-main now checks that LD_PRELOAD and PYTHONPATH set in the parent arrive empty in a root helper. It also runs the TPM unseal chain against fake tpm2_* tools, checking each step's arguments, failures and context-file cleanup, and runs keyring enable against a fake CLI. The keyring paths of try_set_keyring_authtok and setcred's handling of the helper's result are covered too.

Upgrade if you use keyring/KWallet unlocking. Nothing changes in how face login or keyring unlocking work: no new config keys and no new or changed translatable strings.

---

📥 Installation (from Release assets)

Verify downloads against SHA256SUMS on the Release page before installing. Download this release's assets into an empty/clean directory before running these commands — the wildcards below match by filename pattern, and leftover assets from another version in the same directory can make a package manager see multiple matches (or, for the AppImage command, pass a second matched file as a stray argument).

Format	Command
Debian (amd64 + arm64)	sudo apt install ./ubuntu-hello_*_$(dpkg --print-architecture).deb ./ubuntu-hello-gtk_*_$(dpkg --print-architecture).deb
Fedora (amd64 + arm64)	sudo dnf install ./ubuntu-hello-[0-9]*fc44*.$(uname -m).rpm ./ubuntu-hello-gtk-*fc44*.$(uname -m).rpm
openSUSE (amd64 + arm64)	sudo zypper install ./ubuntu-hello-[0-9]*lp160*.$(uname -m).rpm ./ubuntu-hello-gtk-*lp160*.$(uname -m).rpm
AppImage (amd64 + arm64)	chmod +x Ubuntu-Hello-*-$(uname -m).AppImage && ./Ubuntu-Hello-*-$(uname -m).AppImage --install
Arch (amd64 only)	sudo pacman -U ./ubuntu-hello-[0-9]*.pkg.tar.zst ./ubuntu-hello-gtk-*.pkg.tar.zst
Snap (amd64 only)	sudo snap install --dangerous --classic ubuntu-hello_*_amd64.snap && sudo snap run ubuntu-hello.host-install
Flatpak (amd64 only)	flatpak install --user ./com.github.ventura8.UbuntuHello-*.flatpak && flatpak run --command=ubuntu-hello-host-install com.github.ventura8.UbuntuHello

PPA (Ubuntu 22.04, 24.04 and 26.04). On 22.04 use the PPA: the .deb assets above are built on 26.04:

sudo add-apt-repository ppa:ventura8/ubuntu-hello && sudo apt update && sudo apt install ubuntu-hello

Optional source install: download install.sh from the v1.2.5 tag, review it, then run locally — do not pipe a moving branch URL directly to bash.

Full Changelog: v1.2.4...v1.2.5