lightdm DBus interface allows unlocking other user sessions

[Peter de Ridder]

The lightdm DBus interface provides SwitchToUser. With this an arbitrary user can unlock another user's session.

Applications like blueproximity can run dm-tool lock and dm-tool SwitchToUser $USER to lock and unlock the user's session.
But replacing $USER with the username of another locked session will just switch to that session and unlocking it.

Steps to reproduce:
log in User1
run dm-tool lock
log in User2
run dm-tool switch-to-user User1

What happens:
This will switch back to the User1 session.
I've tested this with both archlinux and ubuntu saucy.

What should happen:
If dm-tool switch-to-user isn't ran by the same user as provided: It should switch to the greeter unlock screen.
If dm-tool switch-to-user is ran by the same user (maybe same session too): It should unlock that session.

[Robert Ancell (robert-ancell)]

I can confirm this is a regression since 1.7.5 - LightDM was unlocking the session being switched to regardless of if the user had authentication in a greeter or not.

I agree that the preferred behaviour is to switch to a greeter, but we should track that as a separate feature request.

Thanks for finding this problem!

[PS Jenkins bot (ps-jenkins)]

Fix committed into lp:lightdm at revision None, scheduled for release in lightdm, milestone Unknown

[Robert Ancell (robert-ancell)]

See lp~robert-ancell/lightdm/always-show-greeter-on-switch (merge proposal [1]) for support to show the greeter for authentication when switching users.

[1] https://code.launchpad.net/~robert-ancell/lightdm/always-show-greeter-on-switch/+merge/181970