Tries to install the plugins at login screen LMDE

[Dan Linderman]

For some reason at every boot it tries to install all the plugins at the login screen on Linux Mint Debian Edition. I'm using the latest version of Mint, and latest pipelight and wine compholio from Debian wheezy repository http://download.opensuse.org/repositories/home:/DarkPlayer:/Pipelight/Debian_7.0/ ./

[Erich E. Hoover (ehoover)]

I assume that you notice this because of the dialog that pops up informing you that the plugin is installing. That means that the login screen loads all the configured plugins. I would suggest that this is a serious security issue and that you should immediately contact the project that develops the login screen for Mint. This would likely allow a malicious plugin to see what you are doing at login.

[Sebastian Lackner (slackner)]

I assume that the installation of plugins as a regular user works well, is
this right?

As Erich has already mentioned, even more critical than that the
installation fails with Pipelight, is the fact, that plugins are loaded
during the login screen. This could be used by a plugin to record for
example the entered password or to run a shell without having the user to
enter a password.

Did you already contact the Linux Mint team about this issue? If not we can
also do this for you.

2014-05-13 16:09 GMT+02:00 Erich E. Hoover <email address hidden>:

> I assume that you notice this because of the dialog that pops up
> informing you that the plugin is installing. That means that the login
> screen loads all the configured plugins. I would suggest that this is a
> serious security issue and that you should immediately contact the
> project that develops the login screen for Mint. This would likely
> allow a malicious plugin to see what you are doing at login.
>
> --
> You received this bug notification because you are subscribed to
> Pipelight.
> Matching subscriptions: pipelight
> https://bugs.launchpad.net/bugs/1318864
>
> Title:
> Tries to install the plugins at login screen LMDE
>
> Status in Pipelight:
> New
>
> Bug description:
> For some reason at every boot it tries to install all the plugins at
> the login screen on Linux Mint Debian Edition. I'm using the latest
> version of Mint, and latest pipelight and wine compholio from Debian
> wheezy repository
>
> http://download.opensuse.org/repositories/home:/DarkPlayer:/Pipelight/Debian_7.0/
> ./
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/pipelight/+bug/1318864/+subscriptions
>

[Dan Linderman (dlindyds)]

I posted it on their forums but there wasnt much reply... If you know how
yo reach the devs directly please do
On May 21, 2014 8:31 AM, "Sebastian Lackner" <email address hidden> wrote:

> I assume that the installation of plugins as a regular user works well, is
> this right?
>
> As Erich has already mentioned, even more critical than that the
> installation fails with Pipelight, is the fact, that plugins are loaded
> during the login screen. This could be used by a plugin to record for
> example the entered password or to run a shell without having the user to
> enter a password.
>
> Did you already contact the Linux Mint team about this issue? If not we can
> also do this for you.
>
>
> 2014-05-13 16:09 GMT+02:00 Erich E. Hoover <email address hidden>:
>
> > I assume that you notice this because of the dialog that pops up
> > informing you that the plugin is installing. That means that the login
> > screen loads all the configured plugins. I would suggest that this is a
> > serious security issue and that you should immediately contact the
> > project that develops the login screen for Mint. This would likely
> > allow a malicious plugin to see what you are doing at login.
> >
> > --
> > You received this bug notification because you are subscribed to
> > Pipelight.
> > Matching subscriptions: pipelight
> > https://bugs.launchpad.net/bugs/1318864
> >
> > Title:
> > Tries to install the plugins at login screen LMDE
> >
> > Status in Pipelight:
> > New
> >
> > Bug description:
> > For some reason at every boot it tries to install all the plugins at
> > the login screen on Linux Mint Debian Edition. I'm using the latest
> > version of Mint, and latest pipelight and wine compholio from Debian
> > wheezy repository
> >
> >
> http://download.opensuse.org/repositories/home:/DarkPlayer:/Pipelight/Debian_7.0/
> > ./
> >
> > To manage notifications about this bug go to:
> > https://bugs.launchpad.net/pipelight/+bug/1318864/+subscriptions
> >
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1318864
>
> Title:
> Tries to install the plugins at login screen LMDE
>
> Status in Pipelight:
> New
>
> Bug description:
> For some reason at every boot it tries to install all the plugins at
> the login screen on Linux Mint Debian Edition. I'm using the latest
> version of Mint, and latest pipelight and wine compholio from Debian
> wheezy repository
>
> http://download.opensuse.org/repositories/home:/DarkPlayer:/Pipelight/Debian_7.0/
> ./
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/pipelight/+bug/1318864/+subscriptions
>

[fabian (fabians-interia)]

This situation is the same in Linux Mint 17 Mate edition based on Ubuntu

[Michael Müller (mqchael)]

Hi,

I reported the bug at https://github.com/linuxmint/mdm/issues/96 so that this problem hopefully get fixed in MDM.

Michael

[Sebastian Lackner (slackner)]

Hi,

I have just committed a workaround for this problem (see: https://bitbucket.org/mmueller2012/pipelight/commits/93d45713cbaaf3edf4b808bd7e91bb3d395d98a9 ), which will become active by running:

sudo pipelight-plugin --update

This doesn't prevent the plugin from loading, but should prevent the dialog from showing up. We will have to wait for the MDM guys for a proper fix.

If you want to be sure that MDM isn't loaded at all, the only reliable way is to not enable plugins system-wide:

# Disable all system wide plugins
sudo pipelight-plugin --disable-all

# Only enable the plugins you want for the local user (NO SUDO!)
pipelight-plugin --enable silverlight

Regards,
Sebastian

[Clement Lefebvre (clementlefebvre)]

Hi,

Thanks for reporting this to us.