Unity Lockscreen still shows unlocked desktop while shutting down

[Margarita Manterola]

This was reported and supposedly fixed in https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1370017, but the bug is still present in the current Unity version in Trusty. I've reported it in that bug already, but got ignored, so I'm opening a new bug about it.

[Impact and Test Case]

Steps to reproduce:
1 - Log into Unity
2 - Open a terminal.
3 - Lock the screen
4 - From the lockscreen, tell the computer to shut down / restart

Expected behavior:
* Session programs are closed while the screen is still locked
* During shutdown, no user interaction is possible

Observed behavior:
* The lockscreen is gone immediately, with the rest of compiz (e.g. window decorations are not present)
* But it's possible to interact with programs that are still running in the session for about 3 seconds

Observed on an updated Trusty machine, running unity version 7.2.5+14.04.20150521.1-0ubuntu1

This bug is a security vulnerability because during those 3 seconds it could be possible to access and interact with sensitive information. Yes, it's short, but you could take a picture or even rm -rf / if there happened to be a root console available.

=====

[Impact]
A lockscreen should hide the screen content no matter what. A the moment there is no easy way to provide a good shutdown experience if the screen is locked so it's better to disable it. Please note that you can still shut down the system if the screen is locked just switching to unity-greeter using "Swtich Account..." (it's safe in this case)

Needs to be backported to 14.04 LTS because can affect security.

[Test Case]
1 - Lock the screen
2 - Push the hw shutdown button.
3 - Make sure that there is no shutdown option in the end of session dialog.

1 - Lock the screen
2 - Open the session indicator
3 - Make sure there is no shutdown option in the drop down menu

[Regression Potential]
None.

[Margarita Manterola (marga-9)]

Andrea, this bug is just a new filing for https://bugs.launchpad.net/ubuntu/+source/unity/+bug/1370017 which is still not fixed in Trusty. The verification instructions in that bug were wrong, and thus it's marked as "Fix Released" when it's actually not fixed at all.

If it has actually been fixed in vivid, maybe the backported patch missed something?

[Margarita Manterola (marga-9)]

Any news here?

[Marco Trevisan (Treviño) (3v1n0)]

Unfortunately we've some backlog to land, but we're looking into getting this to trunk ASAP and backport to trusty

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.3.2+15.10.20150910.1-0ubuntu1

---------------
unity (7.3.2+15.10.20150910.1-0ubuntu1) wily; urgency=medium

  [ Andrea Azzarone <email address hidden> ]
  * Add unit tests for unity::lockscreen::DBusManager.
  * Add/Update tests for gnome session manager.
  * Do not allow shutdown when screen is locked. (LP: #1460626)
  * Make sure we update the maximized window when "show
    desktop"/"restore desktop". (LP: #1485559)
  * Merge patch from https://launchpadlibrarian.net/216192448/llvm-
    fix.patch (LP: #1491555)
  * Merge patch from https://launchpadlibrarian.net/216276242/low-gfx-
    override.patch (LP: #1491913)

  [ Andrea Azzarone <email address hidden> ]
  * Properly hide decorations when on "Show Desktop" mode. (LP:
    #1485073)

  [ Marco Trevisan (Treviño) ]
  * UnityScreen: force shell to be on top when there's a window
    fullscreen and we've a menu open. (LP: #591189)

 -- Marco Trevisan (Treviño) <[e-mail]> Thu, 10 Sep 2015 15:37:46 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package indicator-session - 12.10.5+15.10.20150915-0ubuntu1

---------------
indicator-session (12.10.5+15.10.20150915-0ubuntu1) wily; urgency=medium

  [ Andrea Azzarone <email address hidden> ]
  * Disable shutdown/reboot in the lockscreen. (LP: #1460626)

  [ Sebastien Bacher ]
  * under unity8 start system-settings instead unity-control-center (LP:
    #1489480)

 -- Sebastien Bacher <email address hidden> Tue, 15 Sep 2015 07:47:28 +0000

[Chris J Arges (arges)]

Hello Margarita, or anyone else affected,

Accepted indicator-session into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/indicator-session/12.10.5+14.04.20151021.1-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello Margarita, or anyone else affected,

Accepted unity into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unity/7.2.6+14.04.20151021-0ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Rohan "HEXcube" Villoth (hexcube)]

Installed all 3 patched 𝐔𝐧𝐢𝐭𝐲 𝟕 version 7.2.6+14.04.20151021-0ubuntu1 packages:

unity
unity-services
libunity-core-6.0-9

and indicator-session version 12.10.5+14.04.20151021.1-0ubuntu1 on 𝐔𝐛𝐮𝐧𝐭𝐮 𝟏𝟒.𝟎𝟒𝐋𝐓𝐒 "Trusty" from the 𝒑𝒓𝒐𝒑𝒐𝒔𝒆𝒅 repo. Tested the new unity and indicator-session and verified they don't show Shutdown option in both shutdown dialog and indicator while in Lockscreen.

[Launchpad Janitor (janitor)]

This bug was fixed in the package indicator-session - 12.10.5+14.04.20151021.1-0ubuntu1

---------------
indicator-session (12.10.5+14.04.20151021.1-0ubuntu1) trusty; urgency=medium

  [ CI Train Bot ]
  * No-change rebuild.

indicator-session (12.10.5+14.04.20151021-0ubuntu1) trusty; urgency=medium

  * Disable shutdown if screen is locked (lp: #1460626)

 -- Marco Trevisan (Treviño) <[e-mail]> Wed, 21 Oct 2015 15:53:04 +0000

[Chris J Arges (arges)]

The verification of the Stable Release Update for indicator-session has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.2.6+14.04.20151021-0ubuntu1

---------------
unity (7.2.6+14.04.20151021-0ubuntu1) trusty; urgency=medium

  * New upstream release

  [ Andrea Azzarone ]
  * Merge patch from https://launchpadlibrarian.net/216276242/low-gfx-
    override.patch (LP: #1491913)
  * Properly hide decorations when on "Show Desktop" mode. (LP: #1485073)
  * Do not handle events coming from viewports not actually containing the window.
    (LP: #1449654)
  * Make sure new icons are added to the model before calling SortAndUpdate
    (LP: #1458950)
  * GnomeSessionManager: Do not allow shutdown when screen is locked. (LP: #1460626)
  * GnomeSessionManager: Do not allow shutdown when screen is locked.

  [ Chris Townsend ]
  * When looking for the top-most valid window in a VP, also check if the window
    is focused if the window is set to Always on Top. This allows Launcher icon
    spread to work properly when a window is minimized an Always on Top exists in
    the group. (LP: #1131385)
  * Wait on Spread to be terminated before showing the Quicklist. (LP: #1441626)
  * If dragging an application:// uri type from the Dash to the desktop, change it
    to a file:// uri type so Nautilus can understand the type a make a copy of it
    on the desktop. (LP: #1241972)
  * Enable real page up/page down key navigation in the Dash. When using these
    keys the view scrolls the length of the visible view. (LP: #913612)
  * Save the active window when showing the Hud so the correct window is focused
    when hiding the Hud. Fixes issue when "Always on Top" windows are present.
    (LP: #1366583)
  * Save the active window when showing the Dash so the correct window is focused
    when hiding the Dash. Fixes issue when "Always on Top" windows are present.
    (LP: #1446634)
  * When using keyboard navigation in the Dash, skip category headers that are not
    expandable. Also, do not highlight the category header when the mouse cursor
    is over it. (LP: #1045933)
  * Also use the Compiz show() method when forcing an unmapped window to be
    visible when clicking on it's active Launcher icon. (LP: #989588)
  * Add option to enable and disable Unity low graphics mode on the fly in ccsm or
    via gsettings. (LP: #1412937)
  * UScreen, PanelService: get monitor at position, ignoring pre-
    multipled Gdk scale factor (LP: #1351591)

  [ Marco Trevisan (Treviño) ]
  * ResultViewGrid: wait for double-click event only if the relative result needs
    the Preview (LP: #1291950)
  * OverlayWindowButtons: trigger a queuedraw also when a child requires a redraw
    (LP: #1461618)
  * GnomeSessionManager: Request ScreenSaver (de)activation on VT changes (LP:
    #1405349)
  * UScreen, PanelService: get monitor at position, ignoring pre-multipled Gdk
    scale factor (LP: #1351591)
  * UScreen, PanelService: get monitor at position, ignoring pre-
    multipled Gdk scale factor (LP: #1351591)

 -- Marco Trevisan (Treviño) <[e-mail]> Wed, 21 Oct 2015 15:54:44 +0000

[Rohan "HEXcube" Villoth (hexcube)]

Marking the bug as "Fix Released" for Unity 7.2, coz Unity 7.2.6 update got released for Ubuntu 14.04LTS