inconsistent settings for lock screen between xfce4-session and xfce4-power-manager

[Samantha Davis]

Linux Mint 14, XFCE edition.

The XFCE power manager consistently fails to lock the screen upon suspend when the computer is put to sleep using the log-out dialog or the Action Buttons applet. The "lock screen when going for suspend/hibernate" option is set to true. The screen locks, as expected, when the computer is told to suspend via the right-click menu for the Power Manager applet in the dock.

To reproduce the bug make sure that "lock screen when going for suspend/hibernate" is set in the control panel then go into the Applications Menu and select "Log Out." Then select "Suspend." The screen ought to lock and then the computer ought to go to sleep. Instead, the computer suspends without locking the screen and when the computer resumes it does not require a password.

This is a security vulnerability as it is far too easy to accidently leave the computer unlocked when one would reasonably expect it to lock itself.

[scar (arch-scar)]

I've marked this bug major, as it causes a user-defined security setting's failure.

I've a full xfce install on Arch Linux, and I've noticed the following:

In xfce4-power-managers settings I've checked the lock screen after resume fom sleep/hibernate option, and when I hibernate or suspend from the power managers tray icon, it follows my settings.

However, I think the REAL way of quitting your desktop is by design, tradition, logic and whatever, is by the xfce4-session-logout dialog. And this one DOES NOT RESPECT the power managers settings. So, on a laptop, if I suspend it, everyone can resume and use my machine without any password checking. I think this is a really serious issue.

Tested: GUI (suspend/hibernate) xfce4-session-logout
        CLI xfce4-session-logout ( with --suspend and --hibernate options)

Does not work.

So there's an inconsistency between the two utilities, and I thionk, because Xfce is a Desktop Environment, its elements should respect each others settings.
And I think the one that has to be modified is Xfce-session-logout, because the power manager works correctly.

package: xfce4-session 4.10.0-3

[Yves-Alexis Perez (corsac)]

Did you try “lock screen before sleep” in the last tab of xfce4-session settings?

[scar (arch-scar)]

Thank you, it did the trick.
Sorry for lamenting.

[Yves-Alexis Perez (corsac)]

No problem. I'm retitling and adjusting severity. I think there might already be a bug for the same thing, which I think is planner (or even already fixed) for 4.12

[Samantha Davis (samantha-april-davis)]

I've uncovered the problem. There are two options in the XFCE control panel that do the same thing:

* Power Manager -> Extended -> Lock screen when going for suspend/hibernate
* Session and Startup -> Advanced -> Lock screen before sleep

The former seems to only control the behavior of the power manager panel applet (battery charge indicator). The latter seems to only control the behavior of the logout dialog and the action buttons panel applet. These settings ought to be merged because it is unlikely that a user would wish to have different behaviors depending on which applet they use to sleep the computer. Furthermore, enabling an inconsistent security policy is unsafe.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jarno Suni (jarnos)]

As for inconsistency, they use different methods for launching suspend and hibernate: you can notice that, if you have lock-on-sleep unchecked for both, and use gnome-screensaver daemon or light-locker: if you suspend by xfce4-session, it will lock, but not if you suspend by xfce4-power-manager.

[Jarno Suni (jarnos)]

There is some advantage in having a separate setting in the power manager: The power manager is used also in e.g. Lubuntu, in which there would be hard to change all Xfce settings. Maybe the both ways could change same variable, though.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xfce4-power-manager - 1.2.0-3ubuntu4

---------------
xfce4-power-manager (1.2.0-3ubuntu4) trusty; urgency=medium

  * Add 09_sync_session_xfpm_lock_setting.patch (LP: #1101982)
 -- Sean Davis <email address hidden> Mon, 07 Apr 2014 10:09:14 -0500

[Thaddaeus Tintenfisch (thad-fisch-deactivatedaccount)]

http://git.xfce.org/xfce/xfce4-power-manager/commit/?id=bed10b8068d549bf0dd59542c90dec9f6b576e64

[Chris Bainbridge (chris-bainbridge)]

This issue is already fixed in xfce4-power-manager
according to https://bugs.launchpad.net/xfce4-session/+bug/1101982 and http://git.xfce.org/xfce/xfce4-power-manager/commit/?id=bed10b8068d549bf0dd59542c90dec9f6b576e64

[Netrix89 (netrix89)]

It still does not work in version 4.10.1.

I've tested it with checkbox checked and unchecked in xfce4-session.

[Jarno Suni (jarnos)]

What if system does not have xfce4-session installed? Does xfce4-power-manager let you change the setting in its own UI then? (In my Ubuntu Studio 14.04 the option is dimmed and can not be used there; same thing with Hibernate and Suspend.) As for xfce4-session-logout and Action Buttons on panel, I think the clearest and most flexible way would be to add (optional) items for both suspend and suspend with lock (and same thing for hibernate, if that has not been dropped off).

[Jarno Suni (jarnos)]

(In reply to Netrix from comment #6)
> It still does not work in version 4.10.1.
>
> I've tested it with checkbox checked and unchecked in xfce4-session.

What version of xfce4-power-manager did you use?

[Simon Steinbeiß (ochosi)]

This bug has indeed been fixed via xfce4-power-manager >=1.3.0 and the two settings are in sync now.