[Bug 1101393] New: Suspend/Resumes shows desktop content before loading a lockscreen with potential privacy concerns
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393 Bug ID: 1101393 Summary: Suspend/Resumes shows desktop content before loading a lockscreen with potential privacy concerns Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Xfce Assignee: bnc-team-xfce@forge.provo.novell.com Reporter: maurizio.galli@gmail.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- I'm reporting this as I believe there are potential consequences for user's security and privacy. When system resumes from suspend, there's a small 1-2 seconds delay before prompting a lockscreen. Within this delay, the content of the desktop before suspend is fully visible, same as if it was unlocked. After 1-2 seconds, it shows the locked screen. I tried with several lockscreens such as xscreensaver and light-locker but the result is always the same. I suspect it's a race condition. Steps to reproduce: 1. Suspend system through menu or by closing laptop lid 2. Resume by pressing the power button or by opening laptop lid 3. It should be expected to see a lock screen but instead desktop content is shown I've tried to make the lockscreen load before suspend through a systemd service but I did not succeed. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c1
--- Comment #1 from Maurizio Galli
I'm reporting this as I believe there are potential consequences for user's security and privacy.
When system resumes from suspend, there's a small 1-2 seconds delay before prompting a lockscreen. Within this delay, the content of the desktop before suspend is fully visible, same as if it was unlocked. After 1-2 seconds, it shows the locked screen.
I tried with several lockscreens such as xscreensaver and light-locker but the result is always the same.
I suspect it's a race condition.
Steps to reproduce: 1. Suspend system through menu or by closing laptop lid 2. Resume by pressing the power button or by opening laptop lid 3. It should be expected to see a lock screen but instead desktop content is shown
I've tried to make the lockscreen load before suspend through a systemd service but I did not succeed.
EDIT: Suspend from the menu locks the screen first and then suspend as per the desired behavior. However when opening and closing the laptop lid, Suspend triggers the behavior described above. Updated steps to reproduce: 1. Suspend system by closing laptop lid 2. Resume by pressing the power button or by opening laptop lid 3. It should be expected to see a lock screen but instead desktop content is shown -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c2
--- Comment #2 from Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c6
Stefan Seyfried
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c7
--- Comment #7 from Takashi Iwai
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c8
--- Comment #8 from Stefan Seyfried
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c9
--- Comment #9 from Stefan Seyfried
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c10
Stefan Seyfried
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c11
Stanislav Brabec
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c12
--- Comment #12 from Maurizio Galli
I reproduced the issue.
The problem is, that xscreensaver (our default in XFCE) by default has the feature "fade to black on activation" with a fade time of 3 seconds.
So what is happening is:
* suspend is triggered * xfce4-power-manager calls xflock4 * xflock4 calls xscreensaver-command -lock
While this is happening, suspend continues. Suspend is fast, after resume, xscresensaver is still fading to black and locking the screen.
Not sure how to fix that, other than unconfiguring the "fade to black" thing in xscreensaver.
Maurizio: please try to reproduce after disabling the fade-to-black option in xscreensaver preferences.
(I never noticed this, because I use i3lock-xlock-compat instead of xscreensaver)
Hi Stefan, Yes I confirm the "fade to black" behavior but only when using xfwm. With Compton as compositor the issue persists. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c13
--- Comment #13 from Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c14
Stanislav Brabec
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c15
--- Comment #15 from Stanislav Brabec
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c16
--- Comment #16 from Takashi Iwai
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c17
--- Comment #17 from Stanislav Brabec
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c18
--- Comment #18 from Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c19
--- Comment #19 from Maurizio Galli
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c20
Vinzenz Vietzke
Hello, the default behavior with xscreensaver seem to be "normal" now, I'm wondering if we can close this bug as resolved?
What do you mean by "normal"? -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c21
--- Comment #21 from Maurizio Galli
With a fresh TW install I still have a quick glimpse on the desktop, both after suspending from menu and hotkey.
(In reply to Maurizio Galli from comment #19)
Hello, the default behavior with xscreensaver seem to be "normal" now, I'm wondering if we can close this bug as resolved?
What do you mean by "normal"?
I meant that the "glimpse" of the desktop after suspend no longer appeared to me thus no longer able to reproduce it unless i enable "fading" in xscreensaver settings. I still think this is a serious issue and if at this point it cannot be resolved, I would also encourage testing other screen lockers to see if they produce similar behavior. -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c22
--- Comment #22 from Vinzenz Vietzke
I still think this is a serious issue and if at this point it cannot be resolved, I would also encourage testing other screen lockers to see if they produce similar behavior.
Absolutely! Looking at the release notes of xfce4-screensaver (#1130194) it might be an option to test:
- Faster screen locking when activated
-- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c23
--- Comment #23 from Vinzenz Vietzke
- Faster screen locking when activated
Sean Davis wrote some more details: "Added support for screen locking when the system goes to sleep (Xfce #15001), via a shared preference with Xfce Power Manager. A new configuration option, “Lock Screen with System Sleep” was added to the Screensaver Preferences dialog to accommodate this." For further reference: https://bugzilla.xfce.org/show_bug.cgi?id=15001 -- You are receiving this mail because: You are on the CC list for the bug.
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c24
--- Comment #24 from Stanislav Brabec
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393
http://bugzilla.opensuse.org/show_bug.cgi?id=1101393#c25
Maurizio Galli
xscreensaver-5.43 is now going to Factory.
It fixes lock after fade in a different way.
It adds systemd assisted lock on suspend.
Thank you for the work! At least with my current setup the issues with xscreensaver seem to be completely gone. Although Xfce uses xfce4-screensaver now and has some issues being ironed out as well, I'd like to close this report as fixed. -- You are receiving this mail because: You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@novell.com