Bug 1306165
| Summary: | GDM allows taking screenshots in locked session | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jean-Christophe Baptiste <jc> | ||||
| Component: | gdm | Assignee: | Ray Strode [halfline] <rstrode> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 23 | CC: | fedora, rstrode | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-12-11 19:11:29 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
I think this issue is gone on F24, at least for Gnome+Wayland sessions. This message is a reminder that Fedora 23 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 23. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a Fedora 'version' of '23'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora 23 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged change the 'version' to a later Fedora version prior this bug is closed as described in the policy above. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. Yes, it is gone. Let's close it. |
Created attachment 1122694 [details] Screenshot taken while the screen was locked Description of problem: I was surprised to find out that while my gnome-shell session was locked in GDM, it was still possible to take screenshots following specific steps. In other words, a locked session still allow some shortcuts to call an external program. I believe it is a security issue, even if it is a moderate one. Anyone could flood the victim's disk with thousands of images, by keeping the [PrintScr] key pressed. Also, if the key happened to be remapped by the user to another program, who knows what the consequence could be. How reproducible: Steps to Reproduce: 1. Lock the gnome-session 2. Right click in the user password field 3. Take a screenshot by pressiong the [PrintScr] key 4. Eventually keep the key pressed if you want to flood the Picture directory of the victim Actual results: A screenshot is taken like usual and saved in the Picture folder of the active user. See enclosure of an example screenshot. Expected results: I would expect that it is blocked like in this context menu like it is in any other part of the locked screen. I believe it is essential that no external, background task could be launched while the screen is locked, even if the risk appears to be low at first.