inconsistent settings for lock screen between xfce4-session and xfce4-power-manager

Bug #1101982 reported by Samantha Davis on 2013-01-20
288
This bug affects 7 people
Affects Status Importance Assigned to Milestone
Xfce4 Power Manager
Fix Released
Undecided
Sean Davis
Xfce4 Session
Fix Released
Wishlist
xfce4-power-manager (Ubuntu)
Undecided
Sean Davis

Bug Description

Linux Mint 14, XFCE edition.

The XFCE power manager consistently fails to lock the screen upon suspend when the computer is put to sleep using the log-out dialog or the Action Buttons applet. The "lock screen when going for suspend/hibernate" option is set to true. The screen locks, as expected, when the computer is told to suspend via the right-click menu for the Power Manager applet in the dock.

To reproduce the bug make sure that "lock screen when going for suspend/hibernate" is set in the control panel then go into the Applications Menu and select "Log Out." Then select "Suspend." The screen ought to lock and then the computer ought to go to sleep. Instead, the computer suspends without locking the screen and when the computer resumes it does not require a password.

This is a security vulnerability as it is far too easy to accidently leave the computer unlocked when one would reasonably expect it to lock itself.

Related branches

In , scar (arch-scar) wrote :

I've marked this bug major, as it causes a user-defined security setting's failure.

I've a full xfce install on Arch Linux, and I've noticed the following:

In xfce4-power-managers settings I've checked the lock screen after resume fom sleep/hibernate option, and when I hibernate or suspend from the power managers tray icon, it follows my settings.

However, I think the REAL way of quitting your desktop is by design, tradition, logic and whatever, is by the xfce4-session-logout dialog. And this one DOES NOT RESPECT the power managers settings. So, on a laptop, if I suspend it, everyone can resume and use my machine without any password checking. I think this is a really serious issue.

Tested: GUI (suspend/hibernate) xfce4-session-logout
        CLI xfce4-session-logout ( with --suspend and --hibernate options)

Does not work.

So there's an inconsistency between the two utilities, and I thionk, because Xfce is a Desktop Environment, its elements should respect each others settings.
And I think the one that has to be modified is Xfce-session-logout, because the power manager works correctly.

package: xfce4-session 4.10.0-3

Did you try “lock screen before sleep” in the last tab of xfce4-session settings?

In , scar (arch-scar) wrote :

Thank you, it did the trick.
Sorry for lamenting.

No problem. I'm retitling and adjusting severity. I think there might already be a bug for the same thing, which I think is planner (or even already fixed) for 4.12

information type: Private Security → Public Security

I've uncovered the problem. There are two options in the XFCE control panel that do the same thing:

* Power Manager -> Extended -> Lock screen when going for suspend/hibernate
* Session and Startup -> Advanced -> Lock screen before sleep

The former seems to only control the behavior of the power manager panel applet (battery charge indicator). The latter seems to only control the behavior of the logout dialog and the action buttons panel applet. These settings ought to be merged because it is unlikely that a user would wish to have different behaviors depending on which applet they use to sleep the computer. Furthermore, enabling an inconsistent security policy is unsafe.

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

affects: ubuntu → xfce4-power-manager (Ubuntu)
Changed in xfce4-power-manager (Ubuntu):
status: New → Triaged
Changed in xfce4-power-manager (Ubuntu):
status: New → Confirmed

As for inconsistency, they use different methods for launching suspend and hibernate: you can notice that, if you have lock-on-sleep unchecked for both, and use gnome-screensaver daemon or light-locker: if you suspend by xfce4-session, it will lock, but not if you suspend by xfce4-power-manager.

Jarno Suni (jarnos) wrote :

There is some advantage in having a separate setting in the power manager: The power manager is used also in e.g. Lubuntu, in which there would be hard to change all Xfce settings. Maybe the both ways could change same variable, though.

affects: linuxmint → xfce4-session
Changed in xfce4-session:
importance: Undecided → Unknown
status: New → Unknown
summary: - XFCE will not lock screen when suspending via log out dialog.
+ inconsistent settings for lock screen between xfce4-session and xfce4
+ -power-manager
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in xfce4-session (Ubuntu):
status: New → Confirmed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package xfce4-power-manager - 1.2.0-3ubuntu4

---------------
xfce4-power-manager (1.2.0-3ubuntu4) trusty; urgency=medium

  * Add 09_sync_session_xfpm_lock_setting.patch (LP: #1101982)
 -- Sean Davis <email address hidden> Mon, 07 Apr 2014 10:09:14 -0500

Changed in xfce4-power-manager (Ubuntu):
status: Triaged → Fix Released
no longer affects: xfce4-session (Ubuntu)
Pasi Lallinaho (knome) on 2014-04-14
Changed in xfce4-power-manager (Ubuntu):
assignee: nobody → Sean Davis (smd-seandavis)
Changed in xfce4-power-manager:
assignee: nobody → Sean Davis (smd-seandavis)
Changed in xfce4-session:
importance: Unknown → Wishlist
status: Unknown → Confirmed

It still does not work in version 4.10.1.

I've tested it with checkbox checked and unchecked in xfce4-session.

What if system does not have xfce4-session installed? Does xfce4-power-manager let you change the setting in its own UI then? (In my Ubuntu Studio 14.04 the option is dimmed and can not be used there; same thing with Hibernate and Suspend.) As for xfce4-session-logout and Action Buttons on panel, I think the clearest and most flexible way would be to add (optional) items for both suspend and suspend with lock (and same thing for hibernate, if that has not been dropped off).

(In reply to Netrix from comment #6)
> It still does not work in version 4.10.1.
>
> I've tested it with checkbox checked and unchecked in xfce4-session.

What version of xfce4-power-manager did you use?

This bug has indeed been fixed via xfce4-power-manager >=1.3.0 and the two settings are in sync now.

Changed in xfce4-session:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public Security information  Edit
Everyone can see this security related information.

Duplicates of this bug

Other bug subscribers

Related blueprints

Remote bug watches

Bug watches keep track of this bug in other bug trackers.