Keep the screen locked if autologin or nopasswdlogin is enabled

[Humphrey van Polanen Petel]

[Impact]
After <Super>-L the screen is 'locked' and a password is required to resume operating.
However, restarting the computer will present an 'open' system again.
As a consequence, the computer cannot be protected against unauthorized access by this method.

[Test Case]
1. Activate autologin.
2. Lock the screen
3. Reboot the system (you need to select 'Switch Account...' from the session menu first)
4. After reboot make sure the screen is still locked.

[Regression Potential]
None.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: unity 7.2.6+14.04.20151021-0ubuntu1
ProcVersionSignature: Ubuntu 3.16.0-76.98~14.04.1-generic 3.16.7-ckt27
Uname: Linux 3.16.0-76-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.21
Architecture: amd64
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CurrentDesktop: Unity
Date: Sat Jul 9 08:44:39 2016
InstallationDate: Installed on 2015-09-08 (304 days ago)
InstallationMedia: Ubuntu 14.04.2 LTS "Trusty Tahr" - Release amd64 (20150218.1)
SourcePackage: unity
UpgradeStatus: No upgrade log present (probably fresh install)

[Seth Arnold (seth-arnold)]

Could you open the system settings, user panel, and see if the "automatic login" setting is enabled for your user? (It isn't for my user, I must log in every time I reboot my machine.)

Thanks

[Seth Arnold (seth-arnold)]

I suppose I should add another caution that regardless of the setting of the "automatic login" setting on user accounts, it's possible that anyone that can interact with the computer during early boot can use e.g. "init=/bin/sh" at the kernel command line to boot into an environment without any passwords, which can then be used to change nearly everything on the system.

If you wish to keep your data private, a simple screen lock and login passwords are not sufficient; full disk encryption or per-user encrypted mounts (eCryptfs) are required.

Thanks

[Humphrey van Polanen Petel (hpvpp)]

My system is set for "automatic login".

I recognize that the system is vulnerable at boot.

However, I submit
that the lock screen insinuates that the system has been secured against unauthorized access and
that the average user has the tendency to trust what the system tell it so that
therefore
the lock screen utility *must* be improved.

I suggest to let the lock screen utility disable automatic login (and set a flag to restore the previous setting).

[Andrea Azzarone (azzar1)]

"automatic login" is not enabled by default, marking as opinion.

[Andrea Azzarone (azzar1)]

Added to Trello: https://trello.com/c/W4mtmU64/23-bug-1600389-lock-screen-is-not-safe

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.5.0+17.04.20170109-0ubuntu1

---------------
unity (7.5.0+17.04.20170109-0ubuntu1) zesty; urgency=medium

  [ Andrea Azzarone ]
  * Round gtk scaling factor to closest integer. (LP: #1649736)
  * Keep the screen locked if rebooting with autologin. (LP: #1600389)

  [ Eleni Maria Stea ]
  * shouldn't create blur rectangles when there's no blur, skips the
    blur rects processing in low gfx.

 -- Marco Trevisan (Treviño) <[e-mail]> Mon, 09 Jan 2017 15:10:02 +0000

[Brian Murray (brian-murray)]

Hello Humphrey, or anyone else affected,

Accepted unity into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unity/7.4.5+16.04.20171116 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Łukasz Zemczak (sil2100)]

Hello Humphrey, or anyone else affected,

Accepted unity into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unity/7.4.5+16.04.20171201.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Humphrey van Polanen Petel (hpvpp)]

Sorry for not responding earlier.

tests run after locking screen
1 - suspend
2 - switch session, shutdown, restart
3 - switch to guest account, shutdown, restart
4 - disconnected power

in all cases the system came up with the screen locked

if these were all options then the patch has solved the problem
if I missed something then please reopen and tell me what to test

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity - 7.4.5+16.04.20171201.3

---------------
unity (7.4.5+16.04.20171201.3) xenial; urgency=medium

  [ Marco Trevisan (Treviño) ]
  * InputMonitor: add an unity class that monitors XInput2 events and
    converts them to XEvent
  * EdgeBarrierController: use InputMonitor to get the barrier events
    instead of relying on its implementation
  * DecorationsMenuLayout: use input monitor for menu scrubbing (LP:
    #1614597)
  * PanelView: use InputMonitor to track menu events
  * LockScreenPanel: use InputMonitor events instead of mouse polling
    for menu scrubbing
  * MenuManager: add support for mouse trackers with triangle algorithm
    support (LP: #1618405)
  * PanelView: scale gradient refinement properly
  * PanelService: don't allow to deactivate menus if they've been opened
    too shortly
  * LockScreenController: ignore icon_paths_changed signal in
    menumanager for Lockscreen
  * LockScreenController: use InputMonitor to get all the events and
    hide the Blank Window (LP: #1321075)
  * LockScreenController: use input monitor to get the events to switch
    monitor (LP: #1316862)
  * LauncherOptions: use track_obj to manage option changes (LP:
    #1622995)
  * UnityScreen: toggle gestures recognition on lock (LP: #1645507)
  * GnomeSessionManager: add gcancellable to instance and use it for
    calls with temporary proxies
  * BackgroundSettings: use gnome-bg to generate textures with proper
    scaling (LP: #1666359)
  * UnityWindow: safely check validity of UnityWindow from scaled one
    (LP: #1659847)
  * Panel: ensure the menu-manager tracker is updated to match monitor
    (LP: #1671432)
  * compiz-profile-setter: tool to update the current profile and use in
    systemd and Unity settings (LP: #1668950)
  * BGHash, UnityScreen: get desktop averageColor from compiz
  * Launcher: disable or reduce most icon effects on lowgfx (LP:
    #1700859)
  * PanelController: ensure we disconnect from signals on destruction
    (LP: #1504870)
  * tools: add migration script to set the default values for unity-
    lowgfx profile

  [ Andrea Azzarone ]
  * Properly handle the file manager copy dialog in
    FileManagerLauncherIcon and in StorageLauncherIcon. (LP: #1575452,
    LP: #1609845)
  * Correctly position the force quit dialog when scaling is different
    than 1.0 (LP: #1637991)
  * GnomeSession: Retrieve the session id using dbus if $XDG_SESSION_ID
    is not set
  * Round gtk scaling factor to closest integer. (LP: #1649736)
  * Keep the screen locked if rebooting with autologin. (LP: #1600389)
  * Use g_mkdir_with_parents instead of mkdir.
  * Lockscreen: always draw the background-color in the lockscreen (LP:
    #1702701)
  * Refactor the way UserAuthenticator is created and passed around.
    Handle failures to create new threads and fallback to a "Switch to
    greeter..." button in case of failure. (LP: #1311316)
  * Wait until the color buffer is cleared before suspending. (LP:
    #1532508)

  [ Kai-Heng Feng ]
  * UnitySettings: If scale-factor is not set, find and set right scale
    for HiDPI displays.

  [ Eleni Maria Stea ]
  * shouldn't create blur rectangles when there's ...

[Steve Langasek (vorlon)]

The verification of the Stable Release Update for unity has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.