Sugar-Emulator has no access control

[mungewell]

Binary package hint: sugar

Sugar-Emulator uses the '-ac' flag in the Xephyr command line, with turns off access control.

This means that anyone on the network can attach to the display/keyboard/mouse and interfer with the operation of Sugar (such as running xeyes, which goes full screen and can not be cancelled!).

With Xephyr on display :1
--
simon@destiny:~$ netstat -an
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:6001 0.0.0.0:* LISTEN
tcp6 0 0 :::6001 :::* LISTEN
--

Simon.

[mungewell (simon-mungewell)]

A quick fix for this would be to use the Xauth file of the running/calling user.

The emulator.py should call 'xauth add <$display> . <random 128bit/32hex char>', and then Xephyr can be called without the '-ac' flag.

The Xephyr server still listens on the TCP/IP ports, but does not allow others to connect unless they have imported the same key to their Xauth file.

Simon.

[Morgan Collett (morgan)]

Reported upstream - I'll get your patch reviewed

[mungewell (simon-mungewell)]

Slight problem with patch, 1 in 16 chance that xauth will fail as leading 0 is dropped, new to python so don't know how to fix this....

--
DEBUG:sugar-emulator:Xauth command: xauth add :3 . a3dd93f39f280dad34d58d6f301a84f
xauth: (argv):1: key contains odd number of or non-hex characters
--

Simon.

[mungewell (simon-mungewell)]

Slightly better way of fixing leading zeros...

change
cmd2.append('%s' % hex(random.getrandbits(128))[2:-1])
for
cmd2.append('%032X' % random.getrandbits(128))

Simon.

[Luke Faraone (lfaraone)]

Upstream has deferred to 0.86, so it'll be in Jaunty+1

[David Farning (dfarning)]

This has been fixed as of the most recent release of sugar .88 on 10.4

[Brian Murray (brian-murray)]

I imagine it was meant for the Ubuntu status and importance to be set to Fix Released and Critical - not the upstream task which was unset by the bug watch updater.