Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1110857 > unrolled thread
| Started by | HG <hg_code@gmx.de> |
|---|---|
| First post | 2022-07-25 08:30 +0200 |
| Last post | 2022-08-03 16:10 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1016004: lightdm: re-login possible without password after "dm-tool lock" HG <hg_code@gmx.de> - 2022-07-25 08:30 +0200
Bug#1016004: lightdm: re-login possible without password after "dm-tool lock" Yves-Alexis Perez <corsac@debian.org> - 2022-07-29 17:10 +0200
Bug#1016004: lightdm: re-login possible without password after "dm-tool lock" HG <hg_code@gmx.de> - 2022-08-03 16:10 +0200
| From | HG <hg_code@gmx.de> |
|---|---|
| Date | 2022-07-25 08:30 +0200 |
| Subject | Bug#1016004: lightdm: re-login possible without password after "dm-tool lock" |
| Message-ID | <EMZLj-dGae-3@gated-at.bofh.it> |
Package: lightdm
Version: 1.2.6.0-4
I have observed this unexpected behavior on a Raspberry Pi running an (always updated) vanilla Raspberry Pi OS.
Here is how to reproduce it:
* Use lightdm, have a user account with a passwort (no auto login used)
* start the computer
-> The login screen will show up after a while.
* log in with the username and the password (in the graphical user interface)
-> graphical user session will be displayed
* start a terminal, type: "dm-tool lock"
(It is a frequent hint in the internet to have a graphical shortcut for this commant in order to generate a "lock user session" functionality on the Raspi.)
-> The login screen appears again. (So far everything is fine.)
* Press Alt + Ctrl + F1
-> The console login will apear (just ignore it)
* Press Alt + Ctrl + F7
-> The graphical user session re-appears. But his happend without the need to type the user password!
Expectation of correct behavior:
I would expect to need to type the user password before I can re-access the user session after a "lock" of the user session.
I perceive this as a security bug, because the user session is not secured in the way the user probably expects it when he sees the re-login screen after his "lock" command. (My kids found this behavior when they tried all the keys on the keyboard in order to re-gain access to the computer having their favorite game installed.)
Let me know if you need further information on the behavior itself or on other installed packages on the computer.
[toc] | [next] | [standalone]
| From | Yves-Alexis Perez <corsac@debian.org> |
|---|---|
| Date | 2022-07-29 17:10 +0200 |
| Message-ID | <EOzMJ-eDmg-7@gated-at.bofh.it> |
| In reply to | #1110857 |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Mon, 2022-07-25 at 08:23 +0200, HG wrote: > * start a terminal, type: "dm-tool lock" > (It is a frequent hint in the internet to have a graphical shortcut for > this commant in order to generate a "lock user session" functionality on the > Raspi.) Hi HG, it's a strong indication to not blindly trust everything on the Internet, unfortunately. dm-tool lock will request screen locking but it needs to have an actual locker installed and so far that means light-locker. If it's not installed then indeed nothing will be locked. So either don't use dm-tool lock, or install light-locker. Regards, - -- Yves-Alexis -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAmLj9dcACgkQ3rYcyPpX RFtxXAf/R0xCjDvncsy4sprwnkZgpP+VAgvCPh8UO0zqK6oqdQnqRQI2bhS5yJd4 z5Loc69Z6leRI9c8AmoM3ntZJ6g54+0XrM9nheoDwDbFYRy0yzh0a6HeUhk4vPVh cqDTMOoUu2DV/WS1FmOA4xg0GyFd+c/uGMmbSETOs0NST7ApaIB2e1TcAayfZ6/w Twu0Wi1x6EVu5GWOV/GV7u4iVjCXzaZYLEmFK3JpKdqztjJK3EyYoDOfLDIjNPfS H0w2R0KfKMea4yhCf7cwAx6fRslzFn9aGw74GWexkg55D6ax3v0DLsfY7ABsLU3D ortKYu86Y6Vf9XT4Q+APU/AmcLzusQ== =+EB7 -----END PGP SIGNATURE-----
[toc] | [prev] | [next] | [standalone]
| From | HG <hg_code@gmx.de> |
|---|---|
| Date | 2022-08-03 16:10 +0200 |
| Message-ID | <EQnep-fI0p-1@gated-at.bofh.it> |
| In reply to | #1111338 |
Thank you for your explanations, Yves-Alexis. I have now tried what you suggested: * I installed light-locker (1.8.0-3) * restarted the OS * typed "dm-tool lock" into a console * result: the screen is perfectly locked. So once light-locker is installed, the screen locking works perfectly well and my "buggy" behavior described previoulsy, is gone. Still, I would like to try to improve the situation here. Two ideas come to my mind: 1. When I type "dm-tool lock", before installing light-locker package at all, I do not get an error message. The software just silently fails to do the requested and security relevant action. Would it be possible to at least issue an error message (on the console at least) from dm-tool when screen locking is requested but no screen locking software is installed? 2. Would it be reasonably possible to introduce some package dependendies to avoid that dummy users (like me) get into this trouble? Could maybe the package "light-locker" be a (at least recommended) package dependency of the package "lightdm" (including the dm-tool command)? Would this generate other trouble or might this be a feasible improvement?
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web