Running an app via shortcut causes future shell invocations to have wrong starting directory.

Bug #1904335 reported by M Conrad
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
mate-desktop (Ubuntu)
New
Undecided
Unassigned

Bug Description

A started process appears to be able to change start up directory for future invocations of other apps.

* Before running dbeaver via menu, mate-terminal shows correct startup in home directory.

* After running dbeaver via [alt]+[f2], mate-terminal still shows correct startup n home directory.

* After running dbeaver via menu, mate-terminal now shows incorrect startup in /usr/share/dbeaver.

*** Potential security issue: It should not be possible for an app to change the startup directory and possibly environment for any subsequent app runs ***

The dbeaver shortcut UI shows:

Type: Application
Name: DBeaver Community
Command: /usr/share/dbeaver/dbeaver
Comment: Universal Database Manager and SQL Client.

The dbeaver desktop entry text shows:

```ini
[Desktop Entry]
Version=1.0
Type=Application
Terminal=false
Name=DBeaver Community
GenericName=UniversaL Database Manager
Comment=Universal Database Manager and SQL Client.
Path=/usr/share/dbeaver/
Exec=/usr/share/dbeaver/dbeaver
Icon=/usr/share/dbeaver/dbeaver.png
Categories=IDE;Development
WM_CLASS=DBeaver
StartupWMClass=DBeaver
StartupNotify=true
Keywords=Database;SQL;IDE;JDBC;ODBC;MySQL;PostgreSQL;Oracle;DB2;MariaDB
MimeType=application/sql

```

Environment info:

```
lsb_release -rd
Description: Ubuntu 20.04.1 LTS
Release: 20.04
```

```
apt-cache policy mate-desktop
mate-desktop:
  Installed: 1.24.0-2
  Candidate: 1.24.0-2
  Version table:
 *** 1.24.0-2 500
        500 http://archive.ubuntu.com/ubuntu focal/universe amd64 Packages
        100 /var/lib/dpkg/status
```

ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: mate-desktop 1.24.0-2
ProcVersionSignature: Ubuntu 5.4.0-53.59-generic 5.4.65
Uname: Linux 5.4.0-53-generic x86_64
NonfreeKernelModules: nvidia_modeset nvidia
ApportVersion: 2.20.11-0ubuntu27.12
Architecture: amd64
CasperMD5CheckResult: skip
CurrentDesktop: MATE
Date: Sun Nov 15 11:27:21 2020
InstallationDate: Installed on 2014-05-08 (2382 days ago)
InstallationMedia: Linux Mint 16 "petra" - Release amd64 20131126
SourcePackage: mate-desktop
UpgradeStatus: Upgraded to focal on 2020-04-25 (204 days ago)

Revision history for this message
M Conrad (mconrad202) wrote :
Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Hi, thanks for reporting this issue.

Have you reported it to the Mate developers?
If not, please do so and link the bug here.

Thanks!

Revision history for this message
M Conrad (mconrad202) wrote :

And where would I do that? I thought reporting against the package would notify upstream if needed?

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

The Mate project is here:

https://mate-desktop.org/

Can I make this bug public so that more people can see it?

Revision history for this message
M Conrad (mconrad202) wrote : Re: [Bug 1904335] Re: Running an app via shortcut causes future shell invocations to have wrong starting directory.

yes

On Tue, Mar 9, 2021 at 7:20 AM Marc Deslauriers <email address hidden>
wrote:

> The Mate project is here:
>
> https://mate-desktop.org/
>
> Can I make this bug public so that more people can see it?
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1904335
>
> Title:
> Running an app via shortcut causes future shell invocations to have
> wrong starting directory.
>
> Status in mate-desktop package in Ubuntu:
> New
>
> Bug description:
> A started process appears to be able to change start up directory for
> future invocations of other apps.
>
> * Before running dbeaver via menu, mate-terminal shows correct startup
> in home directory.
>
> * After running dbeaver via [alt]+[f2], mate-terminal still shows
> correct startup n home directory.
>
> * After running dbeaver via menu, mate-terminal now shows incorrect
> startup in /usr/share/dbeaver.
>
> *** Potential security issue: It should not be possible for an app to
> change the startup directory and possibly environment for any
> subsequent app runs ***
>
> The dbeaver shortcut UI shows:
>
> Type: Application
> Name: DBeaver Community
> Command: /usr/share/dbeaver/dbeaver
> Comment: Universal Database Manager and SQL Client.
>
>
> The dbeaver desktop entry text shows:
>
> ```ini
> [Desktop Entry]
> Version=1.0
> Type=Application
> Terminal=false
> Name=DBeaver Community
> GenericName=UniversaL Database Manager
> Comment=Universal Database Manager and SQL Client.
> Path=/usr/share/dbeaver/
> Exec=/usr/share/dbeaver/dbeaver
> Icon=/usr/share/dbeaver/dbeaver.png
> Categories=IDE;Development
> WM_CLASS=DBeaver
> StartupWMClass=DBeaver
> StartupNotify=true
> Keywords=Database;SQL;IDE;JDBC;ODBC;MySQL;PostgreSQL;Oracle;DB2;MariaDB
> MimeType=application/sql
>
> ```
>
> Environment info:
>
> ```
> lsb_release -rd
> Description: Ubuntu 20.04.1 LTS
> Release: 20.04
> ```
>
> ```
> apt-cache policy mate-desktop
> mate-desktop:
> Installed: 1.24.0-2
> Candidate: 1.24.0-2
> Version table:
> *** 1.24.0-2 500
> 500 http://archive.ubuntu.com/ubuntu focal/universe amd64
> Packages
> 100 /var/lib/dpkg/status
> ```
>
> ProblemType: Bug
> DistroRelease: Ubuntu 20.04
> Package: mate-desktop 1.24.0-2
> ProcVersionSignature: Ubuntu 5.4.0-53.59-generic 5.4.65
> Uname: Linux 5.4.0-53-generic x86_64
> NonfreeKernelModules: nvidia_modeset nvidia
> ApportVersion: 2.20.11-0ubuntu27.12
> Architecture: amd64
> CasperMD5CheckResult: skip
> CurrentDesktop: MATE
> Date: Sun Nov 15 11:27:21 2020
> InstallationDate: Installed on 2014-05-08 (2382 days ago)
> InstallationMedia: Linux Mint 16 "petra" - Release amd64 20131126
> SourcePackage: mate-desktop
> UpgradeStatus: Upgraded to focal on 2020-04-25 (204 days ago)
>
> To manage notifications about this bug go to:
>
> https://bugs.launchpad.net/ubuntu/+source/mate-desktop/+bug/1904335/+subscriptions
>

information type: Private Security → Public
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.