http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c1 --- Comment #1 from Guido Berhörster 2010-07-13 22:20:55 UTC --- Created an attachment (id=375737) --> (http://bugzilla.novell.com/attachment.cgi?id=375737) Fix for the lxsession package -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c2 andrea florio changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P3 - Medium Status|ASSIGNED |NEEDINFO InfoProvider| |maintenance@opensuse.org Severity|Normal |Major --- Comment #2 from andrea florio 2010-07-14 08:50:04 UTC --- fixed package is into X11:lxde this is considered a security issue (IMHO). asking for SWAMP ID -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c4 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard| |maint:running:34529:moderat | |e --- Comment #4 from Swamp Workflow Management 2010-07-14 14:19:00 UTC --- The SWAMPID for this issue is 34529. This issue was rated as moderate. Please submit fixed packages as soon as possible. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c Matthias Weckbecker changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|lxsession-logout should |VUL-0: lxsession-logout |lock the screen before |should lock the screen |suspending/hibernating/swit |before |ching users |suspending/hibernating/swit | |ching users -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c6 andrea florio changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |NEEDINFO InfoProvider| |security-team@suse.de AssignedTo|andrea@opensuse.org |security-team@suse.de --- Comment #6 from andrea florio 2010-07-14 14:40:23 UTC --- created request id 42914 assigned back to security team -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c7 Christoph Wickert changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |cwickert@fedoraproject.org --- Comment #7 from Christoph Wickert 2010-07-16 22:01:35 UTC --- Has anybody tried to contact LXDE upstream? I don't see this in their tracker, although I have admin privileges. I consider requesting a CVE without contacting upstream first is bad. I'm also having problems with the patch: - The patch hardcodes the preferred screensaver. - It doesn't only check which screensaver is installed, but not which one is actually running (similar to http://bugzilla.xfce.org/show_bug.cgi?id=3791) - If the screensaver is installed but not running, locking will fail: $ xscreensaver-command -lock xscreensaver-command: no screensaver is running on display :0.0 $ gnome-screensaver-command --lock ** Message: Screensaver is not running! - AFAIK newer versions of gnome-screensaver require a running gnome-session and therefore will not work inside an LXDE session. - Why not use xdg-screensaver? -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c9 --- Comment #9 from andrea florio 2010-07-16 23:47:21 UTC --- (In reply to comment #7)

Has anybody tried to contact LXDE upstream? I don't see this in their tracker, although I have admin privileges. I consider requesting a CVE without contacting upstream first is bad.

i had no time, here upstream bugreport https://sourceforge.net/tracker/?func=detail&aid=3030798&group_id=180858&atid=894869 -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c11 Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #375737|0 |1 is obsolete| | --- Comment #11 from Guido Berhörster 2010-07-17 10:01:17 UTC --- Created an attachment (id=376583) --> (http://bugzilla.novell.com/attachment.cgi?id=376583) More robust fix, goes through a list of known locking commands until one succeeds (In reply to comment #10)

Ok, fair enough. It would be nice to have some kind of configuration for the preferred screensaver, but lxsession is definitely not the right place.

Last but not least: Checking for the running screensaver should be multi-seat save, e.g. if another user runs a screensaver but I'm not, it shouldn't lock my session if I suspend/hibernate.

Checking for the running screensaver through the process list is impossible to do in a portable way and error-prone. I think going through a list of locking commands and checking the exit code to see which one succeeds is more simple and solid. Does this look acceptable for inclusion upstream? If yes, I'll put a patch for the current git version in the SF.net bugtracker and re-submit to Factory and 11.3 Updates later. BTW, this should be changed in XFCE and xdg-screensaver as well. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c13 Guido Berhörster changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Critical |Major --- Comment #13 from Guido Berhörster 2010-07-17 10:29:12 UTC --- (In reply to comment #12)

guido, please continue on the sf tracker linked on comment #9

feel free to commit fixed patch into X11:lxde when ready so that i can finally submit fixed package

Don't worry, I'll take care of submitting this to Factory and 11.3 Updates today. It would just be nice to have upstream comment on this solution. I'll submit a patch against the git version on the upstream tracker. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c14 --- Comment #14 from andrea florio 2010-07-17 10:42:04 UTC --- (In reply to comment #13)

Don't worry, I'll take care of submitting this to Factory and 11.3 Updates today. It would just be nice to have upstream comment on this solution. I'll submit a patch against the git version on the upstream tracker.

i'm sorry i need to do it, there is another pending fix for lxsession that must be submitted with that one as well, so please just write here when the patch is ready to be submitted --- Comment #15 from andrea florio 2010-07-17 10:42:05 UTC --- (In reply to comment #13)

Don't worry, I'll take care of submitting this to Factory and 11.3 Updates today. It would just be nice to have upstream comment on this solution. I'll submit a patch against the git version on the upstream tracker.

i'm sorry i need to do it, there is another pending fix for lxsession that must be submitted with that one as well, so please just write here when the patch is ready to be submitted -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c17 --- Comment #17 from andrea florio 2010-07-17 12:33:13 UTC --- ok, submitted request: osc submitreq -m"fixed bnc#623192 and bnc#622083 , SWAMPID 34529, patchinfo will be handled by security team as required on bug report bnc#622083 comment#4" created request id 43167 @ security team, (and Matthias Weckbecker) please fill the patchinfo so it can fit both bugs, this one and bnc#623192 as well -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c19 --- Comment #19 from andrea florio 2010-07-20 14:38:46 UTC --- this is not something lxsession care. it's up to the software used as screensaver. feel free to open a bug report against xscreensaver and any other screensaver software that lack such capability -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c21 Swamp Workflow Management changed: What |Removed |Added ---------------------------------------------------------------------------- Status Whiteboard|maint:running:34529:moderat |maint:running:34529:moderat |e |e maint:released:11.3:34605 --- Comment #21 from Swamp Workflow Management 2010-07-23 11:13:17 UTC --- Update released for: lxsession, lxsession-debuginfo, lxsession-debugsource Products: openSUSE 11.3 (debug, i586, x86_64) -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c23 --- Comment #23 from Christoph Wickert 2010-07-23 11:46:10 UTC --- (In reply to comment #19)

this is not something lxsession care. it's up to the software used as screensaver. feel free to open a bug report against xscreensaver and any other screensaver software that lack such capability

As long as you cannot guarantee that the screen can be unlocked, you are making the problem worse than it is. IMHO you should disable the switch user functionality in lxsession. (In reply to comment #20)

That is a non-issue and not releated to lxsession-logout, you don't need to hibernate or suspend, activation of the screensaver will also lock the screen.

Only if the user configures locking, by default it will only blank.

And that's why xscreensaver and gnome-screensaver offer logging in as another user (provided your OS and login manager support that).

xscreensaver, which is the default screensaver in LXDE (and the only one working) does NOT support user switching. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c24 --- Comment #24 from Guido Berhörster 2010-07-23 12:47:40 UTC --- (In reply to comment #23)

(In reply to comment #20)

...

That is a non-issue and not releated to lxsession-logout, you don't need to hibernate or suspend, activation of the screensaver will also lock the screen.

Only if the user configures locking, by default it will only blank.

No, on openSUSE both gnome-screensaver and xscreensaver lock after 10 min by default, so this is consistent behavior. Furthermore OS X, Windows, the GNOME and KDE power managers all lock the screen by default when suspending or hibernating.

...

And that's why xscreensaver and gnome-screensaver offer logging in as another user (provided your OS and login manager support that).

xscreensaver, which is the default screensaver in LXDE (and the only one working) does NOT support user switching.

xscreensaver does support user switching but it needs a capable login manager. LXDM seems broken in this regard, with GDM xscreensaver user switching works fine. Just one more reason not to use LXDM. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=622083 https://bugzilla.novell.com/show_bug.cgi?id=622083#c26 --- Comment #26 from Christoph Wickert 2010-11-18 11:20:18 UTC --- (In reply to comment #13)

I'll submit a patch against the git version on the upstream tracker.

AFAICS this didn't happen, upstream's bugtracker still only has the old patch. We now have another problem: lxsession 0.4.5 uses upower for hibernate/standby. After locking the screen the user is no longer allowed to do this. lxsession just locks the screen and when you unlock it, the logout dialog is still there and says "not authorized". -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=622083 https://bugzilla.novell.com/show_bug.cgi?id=622083#c28 --- Comment #28 from Christoph Wickert 2010-11-18 12:50:10 UTC --- (In reply to comment #27)

(In reply to comment #26)

...

(In reply to comment #13)

...

I'll submit a patch against the git version on the upstream tracker.

AFAICS this didn't happen, upstream's bugtracker still only has the old patch.

It has been there since July 17th, did you even look? http://sourceforge.net/tracker/?func=detail&aid=3030907&group_id=180858&atid=894871

Yes I did. The only bug report linked in this bug is http://sourceforge.net/tracker/?func=detail&aid=3030798&group_id=180858&atid=894869 and not http://sourceforge.net/tracker/?func=detail&aid=3030907&group_id=180858&atid=894871 where you added your patch. You should have attached your patch to he old bug that Andrea mentioned before instead of opening a new one. Things like this make it hard to track the issue. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

http://bugzilla.novell.com/show_bug.cgi?id=622083 http://bugzilla.novell.com/show_bug.cgi?id=622083#c30 --- Comment #30 from Bernhard Wiedemann --- This is an autogenerated message for OBS integration: This bug (622083) was mentioned in https://build.opensuse.org/request/show/43167 11.3:Test / lxsession https://build.opensuse.org/request/show/43169 Factory / lxsession -- You are receiving this mail because: You are on the CC list for the bug.