Rygel autostarts on Ubuntu 19.10

Bug #1848692 reported by Jens Georg on 2019-10-18
276
This bug affects 4 people
Affects Status Importance Assigned to Milestone
rygel (Ubuntu)
High
Unassigned
Eoan
High
Sebastien Bacher

Bug Description

[ Impact ]
The user medias can end up being shared without action/notification

[ Test Case ]
Log into a non GNOME/Ubuntu session and look at the rygel systemd user job status (or available media on the network)

[ Regression potential ]
Installing the rygal package isn't going to lead to the service to be active by default, which is a behaviour change and be the opposite of what some users would expect

------------------------------------

I just received this question on IRC:

11:16 <~phako> hi 11:16 < Fabzgy> I ve upgraded to Ubuntu 19.10 yesterday 11:16 < Fabzgy> now rygel is automatically started when I reboot my system 11:17 < Fabzgy> My colleague at work just informed me that all my pictures & videos are available to the entire company

That would be _REALLY_ bad

Jens Georg (yg-jensge) wrote :

The user has updated from 19.04 and is not using GNOME or Ubuntu's session. He could not remember the name of the WM.

I checked on a new VM. It gets installed, starts but then is stopped. I'd assume if you are not using GNOME there might be an issue with stopping it after auto-start due to media-sharing being disabled?

Jens Georg (yg-jensge) wrote :

Yes. As soon as you are not running g-c-c, you're fucked. See screen-shot when logging in from text console

information type: Private Security → Public Security
Jens Georg (yg-jensge) wrote :

That is gnome-settings-daemon turning it off when running, not gnome-control-center, of course.

Sebastien Bacher (seb128) wrote :

Thanks for the report Jens. I don't think we do anything specific in the Ubuntu packaging, the systemd service is the upstream one no? Do you know how it's working on other distribution?

Having a default configuration of not sharing anything by default, or not being enabled by default could make more sense no?

Changed in rygel (Ubuntu):
importance: Undecided → High
status: New → Confirmed
Jens Georg (yg-jensge) wrote :

Yes, the systemd user service file is the one from upstream, but for some reason it gets enabled automatically and globally in the user session (/etc/systemd/user/default.target.wants)

Fedora doesn't do that, at least to my knowledge

Jens Georg (yg-jensge) wrote :

There is no configuration to not share anything. If you don't want to share anything, you don't run it, so not enabling it by default is the only option

Sebastien Bacher (seb128) wrote :

The behaviour is indeed Debian(&Ubuntu) specific, it's made by that utility
https://manpages.debian.org/testing/debhelper/dh_installsystemduser.1.en.html

The command is automatically called with the compat version 12, which is used since Ubuntu 19.10

I will change the package to opt out from the auto-enabling

Changed in rygel (Ubuntu):
status: Confirmed → In Progress
Changed in rygel (Ubuntu):
status: In Progress → Fix Committed
description: updated

Hello Jens, or anyone else affected,

Accepted rygel into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/rygel/0.38.1-2ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in rygel (Ubuntu Eoan):
status: New → Fix Committed
tags: added: verification-needed verification-needed-eoan
Jens Georg (yg-jensge) wrote :

Just upgrading the package does not make any difference for me. It is still enabled in the default user session and is still running.

Sebastien Bacher (seb128) wrote :

Hum, right, the change should work for the cases where rygel is installed for the first time with the fixed package but is not enough for upgrades, I need to have another look to what can be done in that case.
The new install case should be testable by doing an dpkg --purge rygel and by doing a dpkg -i of the SRU version then

Jens Georg (yg-jensge) wrote :

Confirmed, for the new install scenario it works

Changed in rygel (Ubuntu Eoan):
assignee: nobody → Sebastien Bacher (seb128)
Robie Basak (racb) wrote :

Hello Jens, or anyone else affected,

Accepted rygel into eoan-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/rygel/0.38.1-2ubuntu3.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-eoan to verification-done-eoan. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-eoan. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Jens Georg (yg-jensge) wrote :

Tested with 0.38.1-2ubuntu3.2. It disables the service and after reboot it's no longer running, so the upgrade path also looks fine now

tags: added: verification-done-eoan
removed: verification-needed-eoan

The same problem reported by Fabzgy applies to me, too: after I have installed 19.10 at home and upgraded to 19.10 at work, all my photos/videos were exposed without any kind of auth request both in my home network and ALL the company network.

It took me hours to identify which process was leaking my data then I discovered it was rygel which I have never installed.

It has been a great PITA. This is the first time in 15 years that I am indignant by Ubuntu.

Just checked my mate's PC which I have upgraded from Ubuntu MATE 19.04 to 19.10 and the same problem applies to her too.

Alessandro Polverini (polve) wrote :

I run kubuntu and I had rygel running, WTF!!

This enormous hole should be fixed very very soon!

Changed in rygel (Ubuntu Eoan):
importance: Undecided → High
tags: removed: verification-needed

The verification of the Stable Release Update for rygel has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rygel - 0.38.1-2ubuntu3.2

---------------
rygel (0.38.1-2ubuntu3.2) eoan; urgency=medium

  * debian/rygel.postinst:
    - disable the systemd unit when upgrading from a buggy version as well,
      the --no-enable is just working for new installations (lp: #1848692)

rygel (0.38.1-2ubuntu3.1) eoan; urgency=medium

  * debian/rules:
    - use 'dh_installsystemduser --no-enable' to not risk enabling media
      sharing for users who don't expect it. GNOME defaults to disable
      rygel on login but that's not the case of other desktops, since that
      can be a privacy issue it's better to default to a safe behaviour.
      (lp: #1848692)

 -- Sebastien Bacher <email address hidden> Wed, 30 Oct 2019 11:31:07 +0100

Changed in rygel (Ubuntu Eoan):
status: Fix Committed → Fix Released
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rygel - 0.38.2-3ubuntu2

---------------
rygel (0.38.2-3ubuntu2) focal; urgency=medium

  * debian/rygel-2.6-dev.install:
    - install the documentation again, it's shipped correctly with the
      new tarball version

 -- Sebastien Bacher <email address hidden> Tue, 05 Nov 2019 17:01:30 +0100

Changed in rygel (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Other bug subscribers