> We are also now vendoring a new upstream plugin manager source (confusingly named `google-guest-agent` in github [0]) using a secondary orig tar. We build these plugin manager binaries from the vendored tree *during* the pkg build so LP doesn't need network access (which would fail anyway).
I'm not sure I follow. Is this an arbitrary code execution engine? It sounds like, at any time, the host environment (via "VM Extension Manager") can instruct the guest Ubuntu system to download and execute arbitrary code (a plugin, but one that could be written later) subject to whatever validation it performs (I haven't checked). Is this correct? If so, this sounds like a significant security-sensitive change. It would also seem to have the effect of making Ubuntu's packaging of an agent pointless, since it's equivalent to giving the host a root shell it can use at any time. Given that the package is in main, has this new architecture had a security review? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164943 Title: [SRU][FFE] Please update to version 20260819.00 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/google-guest-agent/+bug/2164943/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
