Lock screen doesn't emit ActiveChanged signal

[Marc Deslauriers]

tl;dr; Unity doesn't emit the ActiveChanged signal when the screen is locked/unlocked

Long version:

unity-settings-daemon's automount plugin has code to detect whether the screen is locked or not before automatically mounting a volume. This prevents someone from inserting a USB thumb drive when the screen is locked and exploiting a possible nautilus thumbnailer vulnerability. (See bug #714958 for original implementation details.)

In Ubuntu 14.04, this code no longer works. Inserting a USB thumb drive while the screen is locked results in a Nautilus window opening underneath the lock screen, and the contents of the USB thumb drive being read.

Since the screen lock got switched to Unity in Ubuntu 14.04, Unity no longer emits the org.gnome.ScreenSaver ActiveChanged signal when the screen gets locked or unlocked.

To test:

1- in terminal, type:
dbus-monitor "type='signal',sender='org.gnome.ScreenSaver',interface='org.gnome.ScreenSaver'"
2- Lock the screen
3- Unlock the screen
4- Notice that no signal was received

ProblemType: Bug
DistroRelease: Ubuntu 15.04
Package: unity 7.3.2+15.04.20150330-0ubuntu1
ProcVersionSignature: Ubuntu 3.19.0-10.10-generic 3.19.2
Uname: Linux 3.19.0-10-generic x86_64
ApportVersion: 2.17-0ubuntu1
Architecture: amd64
CompizPlugins: No value set for `/apps/compiz-1/general/screen0/options/active_plugins'
CurrentDesktop: Unity
Date: Tue Mar 31 15:15:48 2015
InstallationDate: Installed on 2013-11-26 (489 days ago)
InstallationMedia: Ubuntu 13.10 "Saucy Salamander" - Release amd64 (20131016.1)
SourcePackage: unity
UpgradeStatus: Upgraded to vivid on 2015-03-07 (24 days ago)

[Marc Deslauriers (mdeslaur)]

This is CVE-2015-1319

[Marco Trevisan (Treviño) (3v1n0)]

Mh, I think we should fix the problem in unity-settings-daemon, by connecting at the com.canonical.Unity.Session.Locked signal instead.

Since in unity the screensaver != lockscreen, and we emit the org.gnome.ScreenSaver.ActiveChanged only when the screensaver is shown (and this generally happens after that the lockscreen has been configured).

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity-settings-daemon - 15.04.1+15.10.20150630.1-0ubuntu1

---------------
unity-settings-daemon (15.04.1+15.10.20150630.1-0ubuntu1) wily; urgency=medium

  [ CI Train Bot ]
  * New rebuild forced.

  [ Dmitry Shachnev ]
  * xsettings: fix some settings not being updated with the latest glib

  [ Marco Trevisan (Treviño) ]
  * AutoMount: also try to connect to Unity Session and delay automounts
    when locked (LP: #1438870)

 -- CI Train Bot <email address hidden> Tue, 30 Jun 2015 15:48:02 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package unity-settings-daemon - 14.04.0+14.04.20150825-0ubuntu2

---------------
unity-settings-daemon (14.04.0+14.04.20150825-0ubuntu2) trusty-security; urgency=medium

  * SECURITY UPDATE: Drives automount while screen is locked
    (LP: #1438870)
    - plugins/automount/gsd-automount-manager.c: also monitor Unity screen
      lock.
    - CVE-2015-1319

 -- Marc Deslauriers <email address hidden> Fri, 11 Sep 2015 13:44:35 -0400