gnome-screensaver doesn't blank screen on lock with xfwm4 compositing

[Radomir Dopieralski]

Binary package hint: gnome-screensaver

The problem is that when:
   * you use xfwm4, and
   * you have compositing enabled, and
   * you have "display fullscreen overlays directly" enabled,
then the gnome-screensaver doesn't blank your screen when locking,
so anybody can see the screen -- which may contain sensitive information.

[GeorgeB (solar.george-deactivatedaccount)]

Confirmed

* Still affects me when I have "display fullscreen overlays directly" disabled

[Ted Gould (ted)]

I don't believe this is a bug in GNOME Screensaver, rather XFWM. There was some compiz activity that was similar causing a security update to Gutsy quickly after it's release. It might be a similar bug, though I'm unfamiliar with it.

[Ian Howson (ianhowson)]

I can confirm that the bug is still present in Hardy.

[Brian Murray (brian-murray)]

Ted that bug, bug 145123, was worked around in GNOME Screensaver, here's the change log entry:

gnome-screensaver (2.20.0-0ubuntu4.2) gutsy-security; urgency=low

  * SECURITY UPDATE: screen lock bypass via shortcuts when compiz running.
  * Add debian/patches/05_locking_for_compiz.patch: patch for lock dialog for
    when Compiz is enabled from Michael Vogt (LP: #145123).

And then fixed in compiz for Hardy:

compiz (1:0.6.2+git20071018-0ubuntu2) hardy; urgency=low

  * debian/patches/030_fix_screensaver:
    - never unredirect the gnome-screensaver window to prevent
      breaking the keyboard grab (#145123)

[Philipp Edelmann (tukss)]

In the Debian bug report they say that version 4.4.2-4 (compared to 4.4.2-2ubuntu1 in Ubuntu) fixes the bug.

[Lionel Le Folgoc (mrpouit)]

That's fixed in intrepid too.

[Marc Deslauriers (mdeslaur)]

I would seem this got fixed in xfwm4...closing the gnome-screensaver task.