Ubuntu Dock and Top bar accessible from lockscreen

[SchnippenSchnappen]

This is a very serious security issue:

When I lock my desktop with SUPER (windows) + L my screen gets locked and goes to black. Sometimes when I return to my PC and move my mouse to turn my screen back on I notice that the Ubuntu Dock + the Top Bar are accessible from the lockscreen.

I unfortunately can't remember if they were accessible from the moment I locked the screen or became accessible after returning from fade to black. (This is not the first time this issue happened.)

I was able to open the settings menu from the top bar and use all indicators. You can actually start the programs in the Ubuntu Dock and give keyboard inputs to them. For example I was able to start the terminal emulator from the lock screen and run firefox and other applications. So an attacker could run arbitrary commands with user privileges from the lockscreen!

The indicators drop down menus were fully visible on the lock screen while the Dock applications remained hidden "behind" the lockscreen (however still accessible via keyboard as described above).

I have attached a screenshot of the bug. I unfortunately had no camera at hand to film me running terminal commands.

Please contact me if you need additional information.

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: gnome-shell-extension-ubuntu-dock 67ubuntu20.04.5
ProcVersionSignature: Ubuntu 5.4.0-33.37-generic 5.4.34
Uname: Linux 5.4.0-33-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu27.2
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: ubuntu:GNOME
Date: Sat Jun 6 13:35:28 2020
InstallationDate: Installed on 2015-12-22 (1627 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
PackageArchitecture: all
SourcePackage: gnome-shell-extension-ubuntu-dock
UpgradeStatus: Upgraded to focal on 2020-04-25 (42 days ago)
modified.conffile..etc.default.apport: [modified]
mtime.conffile..etc.default.apport: 2015-12-23T12:07:53.769719

[Seth Arnold (seth-arnold)]

Hello, the usual cause of this with gnome is extensions -- try disabling all the extensions, see if you reproduce, and enable them one at a time, etc. You may find one that causes the screen lock to not work as you expect.

Thanks

[SchnippenSchnappen (snibbedisnaps)]

I actually have no gnome extensions installed other than the ones that come preinstalled with Ubuntu. (Screenshot attached.) I also didn't change any settings concerning extensions.

[Sebastien Bacher (seb128)]

Could you add your 'journalctl -b 0' log after getting the issue?

[SchnippenSchnappen (snibbedisnaps)]

This is the log from when I returned to my pc and noticed the dock being accessible on the lock screen and it ends shortly before I actually unlock my pc.

So everything you see in here happened while the lock screen was active.

[Daniel van Vugt (vanvugt)]

Visually this bug looks the same as bug 1876837. So please update your system:

  sudo apt update
  sudo apt full-upgrade
  Reboot.

and tell us if this problem still occurs.

[SchnippenSchnappen (snibbedisnaps)]

The picture in the other issue does indeed look identical to the screen I had however it is a very different issue.

1. I update my system daily by hand. So my system was up to date and the fix of the other issue was installed days ago when my issue occurred.

2. The referenced bug happened after entering a password under certain circumstances. My issue however happened without entering any password whatsoever. I simply moved my mouse to remove fade to black and was presented with the situation as shown in the redacted_apps.png screenshot.

Further differences:
3. I don't have automatic lockscreen set like in the referenced issue.

4. My Keyring is unlocked automatically after boot so there was no way that I had a dialogue active "behind" my lockscreen.

5. My lockscreen did unlock after the first time I entered my password.

[Daniel van Vugt (vanvugt)]

There's a discrepancy between the screenshot in comment #1 and that in comment #3. The screenshot in comment #1 shows extensions clearly running, and the screenshot in comment #3 suggests there are none.

After you have disabled all extensions, please:

1. Log out and in again.

2. Tell us if the bug still happens.

3. Provide a new screenshot of the whole desktop.

4. Run this command:

   gsettings list-recursively org.gnome.shell > settings.txt

   and attach the resulting text file here.

[SchnippenSchnappen (snibbedisnaps)]

(Thanks to everyone who is taking the time out of their day to look into this.)

I think I should note that I can't replicate this issue reliably. It happened "at random" and it didn't happen again since I filed this report. It's just that it wasn't the first time it happened and I saw others have similar issues. That is why I reported it.

Again I want to preface that the extensions shown in the list are the once which came pre-installed with Ubuntu 18.04 (iirc) and I never touched them. (I have some indicator apps but I assume you don't mean them.) I also don't understand why I should disable stock Ubuntu extensions that provide basic functionality like the dock. Would you consider disabling the dock a solution or do you simply try to pin down the culprit?

With that said I can explain the seemingly contractionary pictures. The gnome Tweaks app shows a wrong state. The extensions app shows the correct state. Screenshot attached. This must be a bug in gnome Tweaks.

The gsettings file shows something interesting:
According to the file I have two extensions active that I can't remember ever installing and that do not show up anywhere: org.gnome.shell enabled-extensions ['<email address hidden>', '<email address hidden>']

File attached.

Could it be that there are extensions active that I or someone living with me installed in the past but don't show up in the extensions settings? If yes how do I remove them for further bug testing?

[Daniel van Vugt (vanvugt)]

Gnome Tweaks is completely wrong, which is bug 1718850.

And yes I agree this is concerning:

  org.gnome.shell enabled-extensions ['<email address hidden>', '<email address hidden>']

To address that you might want to delete ~/.local/share/gnome-shell/extensions and then restart.

[SchnippenSchnappen (snibbedisnaps)]

The folder was completely empty (I checked with ls -lsah) but I deleted it anyway and restarted.

gsettings list-recursively org.gnome.shell > settings.txt however still produces the same output.

I guess that some of those "residue" gnome extensions might be causing the bug I reported however I am now more concerned that there seemingly extensions enabled that neither show up in the extensions settings nor in the extensions folder. Also shouldn't the default extensions be listed under "org.gnome.shell enabled-extensions" as well?

Do you know where gsettings is pulling the list of enabled extensions from? Maybe I can dig down from there and get to the bottom of this.

[Daniel van Vugt (vanvugt)]

You can use the 'gsettings' command to clear that:

  gsettings set org.gnome.shell enabled-extensions "[]"

And don't be concerned about the default extensions not showing up there. They are not meant to. Default (system) extensions are considered implied. If you want to see everything more clearly then use:

  gnome-shell-extension-prefs

That all said, extensions don't sound like the problem with this bug...

[Daniel van Vugt (vanvugt)]

Next, please report the issue to the developers at:

  https://gitlab.gnome.org/GNOME/gnome-shell/-/issues

and then tell us the new issue ID.

[SchnippenSchnappen (snibbedisnaps)]

Thanks for helping me disable the extensions.

The bug report at gnome gitlab is here: https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/2905

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Islam (islam)]

I'm experiencing this issue as well on Ubuntu 22.04.