Thanks for the quick upload, but you’ve introduced a syntax error in /etc/gdm/failsafeXinit (empty shell functions are not allowed), breaking the failsafe menu entirely:
This might be fortunate from a security standpoint, though, because “Open a terminal” is not the only possible attack on the menu. Some others that I found fairly quickly are
Troubleshoot the error → Review the xserver log file → File → Open → /etc/passwd
Troubleshoot the error → Review the startup errors → File → Open → /etc/passwd
Troubleshoot the error → Edit configuration file → File → Open → /etc/passwd
And who knows what damage you might be able to do even with just dexconf or xorgconf (setting a malicious ModulePath?).
Basically, all options other than “Run Ubuntu in low-graphics mode for just this session” are fundamentally dangerous; they need to be password-protected.
Thanks for the quick upload, but you’ve introduced a syntax error in /etc/gdm/ failsafeXinit (empty shell functions are not allowed), breaking the failsafe menu entirely:
run_terminal() {
# Causes bug #310126
# gnome-terminal
}
This might be fortunate from a security standpoint, though, because “Open a terminal” is not the only possible attack on the menu. Some others that I found fairly quickly are
Troubleshoot the error → Review the xserver log file → File → Open → /etc/passwd
Troubleshoot the error → Review the startup errors → File → Open → /etc/passwd
Troubleshoot the error → Edit configuration file → File → Open → /etc/passwd
And who knows what damage you might be able to do even with just dexconf or xorgconf (setting a malicious ModulePath?).
Basically, all options other than “Run Ubuntu in low-graphics mode for just this session” are fundamentally dangerous; they need to be password-protected.