Bug 1268900 - lxdm: X server started without -auth, exposing it to connections form any local user
Summary: lxdm: X server started without -auth, exposing it to connections form any loc...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: lxdm
Version: 23
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Mamoru TASAKA
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 1283581
Blocks: CVE-2015-8308
TreeView+ depends on / blocked
 
Reported: 2015-10-05 15:07 UTC by Tomas Hoger
Modified: 2015-11-23 12:23 UTC (History)
9 users (show)

Fixed In Version: lxdm-0.4.1-10.fc22
Clone Of:
Environment:
Last Closed: 2015-11-23 12:23:11 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Patch re-diffed for 0.4.1 (1.90 KB, patch)
2015-10-08 11:39 UTC, Tomas Hoger
no flags Details | Diff

Description Tomas Hoger 2015-10-05 15:07:11 UTC
Description of problem:

X server in F22 allows X clients to connect even when they have no valid MIT-MAGIC authentication cookie.  Connections are accepted from different users (i.e. are not related to 'xhost +si:localuser:`id -un`').  I could reproduce this with both X session started from *dm (lxdm in my case) as well as X server started manually from the text console.  Besides Xorg, I quickly tested with Xephyr and Xnest - they also seem affected in the same way.

Version-Release number of selected component (if applicable):

xorg-x11-server-Xorg-1.17.2-2.fc22.x86_64

Steps to Reproduce:
1. User1 opens X session - via DM or startx.
2. User2 connects on other text virtual terminal or via ssh.
3. User2 sets DISPLAY to :0 and can connect to User1's X session - start new X apps or use xwd to steal info (it seems session has to be active / displayed for at least xwd -root to work).

Actual results:

User2 is allowed to connect to User1's X session.

Expected results:

xterm: Xt error: Can't open display: :0

Comment 1 Tomas Hoger 2015-10-06 10:33:17 UTC
I did some more testing, and I could not reproduce with a defaultish (I changed /etc/gdm/custom.conf to WaylandEnable=false) F22 installation.  I could not reproduce with GNOME sessions (shell or classic) started from gdm.  I could reproduce with Xephyr or Xnest started within GNOME session.  I could also reproducer after replacing gdm with lxdm with the default GNOME shell session, and also start applications on the lxdm's pre-login screen.

Comment 2 Tomas Hoger 2015-10-06 13:18:07 UTC
Ok, I think I got confused by lxdm doing the wrong thing (starting X server without -auth), plus my pebkac mistake when testing (sometimes starting X server directly and sometimes using startx).

I'm re-assigning to lxdm to have it fixed to properly start X server with -auth.

Comment 3 Ray Strode [halfline] 2015-10-06 21:19:45 UTC
right, X without -auth implies anyone local can connect. if lxdm is doing that, it needs to be fixed.

Comment 4 Tomas Hoger 2015-10-06 21:32:34 UTC
(In reply to Ray Strode [halfline] from comment #3)
> if lxdm is doing that, it needs to be fixed.

I already mailed upstream author dgod.osa@gmail about this.

Comment 5 Tomas Hoger 2015-10-07 13:58:05 UTC
I got no response from upstream yet, but I noticed this commit that was added to upstream git few hours ago:

http://git.lxde.org/gitweb/?p=lxde/lxdm.git;a=commitdiff;h=e8f387089e241360bdc6955d3e479450722dcea3

Comment 6 Tomas Hoger 2015-10-08 06:55:34 UTC
I actually got a "Should be fixed in git now." response from upstream, but it ended up in my spam folder.

Comment 7 Mamoru TASAKA 2015-10-08 09:47:04 UTC
F-22 lxdm is so old (published more than 3 years ago) and extra check is needed (and I don't use F-22 any longer)

Comment 8 Tomas Hoger 2015-10-08 11:39:49 UTC
Created attachment 1080978 [details]
Patch re-diffed for 0.4.1

(In reply to Mamoru TASAKA from comment #7)
> F-22 lxdm is so old (published more than 3 years ago) and extra check is
> needed (and I don't use F-22 any longer)

Upstream patch applies rather cleanly to 0.4.1 in F22.  Attaching re-diffed patched.

Scratch build for F22 is here:
http://koji.fedoraproject.org/koji/taskinfo?taskID=11372079

With the patch, X is now started with -auth argument as expected.

Comment 9 Tomas Hoger 2015-10-08 11:48:01 UTC
Making this bug public.

Comment 10 Tomas Hoger 2015-10-08 11:51:18 UTC
Mamoru, if you're going to prepare updates for F21 and F22, consider also applying the fix for bug 846086.  Upstream patch for that issue is available.

Comment 11 Fedora Update System 2015-10-08 14:33:04 UTC
lxdm-0.4.1-10.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-adbae85c55

Comment 12 Fedora Update System 2015-10-08 14:33:55 UTC
lxdm-0.4.1-10.fc21 has been submitted as an update to Fedora 21. https://bodhi.fedoraproject.org/updates/FEDORA-2015-7766c0d939

Comment 13 Mamoru TASAKA 2015-10-08 14:37:27 UTC
F-23 is via
https://bodhi.fedoraproject.org/updates/FEDORA-2015-44deee4d7a

Comment 14 Tomas Hoger 2015-10-09 07:57:11 UTC
The git version with the above fix was tagged and released as lxdm 0.5.2.

Comment 15 Fedora Update System 2015-10-09 12:51:34 UTC
lxdm-0.4.1-10.fc21 has been pushed to the Fedora 21 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update lxdm'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-7766c0d939

Comment 16 Fedora Update System 2015-10-09 13:54:48 UTC
lxdm-0.4.1-10.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update lxdm'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-adbae85c55

Comment 17 Fedora Update System 2015-10-09 13:56:13 UTC
lxdm-0.5.1-7.D20151007gite8f38708.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update lxdm'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-44deee4d7a

Comment 18 Fedora Update System 2015-10-17 22:55:18 UTC
lxdm-0.4.1-10.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2015-10-17 23:20:24 UTC
lxdm-0.4.1-10.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.

Comment 20 Fedora Update System 2015-11-01 02:44:54 UTC
lxdm-0.5.1-7.D20151007gite8f38708.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 21 Mamoru TASAKA 2015-11-20 09:00:49 UTC
Now NFS user is seeing bug 1283581 . I am currently thinking of reverting this. Also (perhaps) the same bug report on the upstream:
http://sourceforge.net/p/lxde/bugs/786/

Comment 22 Tomas Hoger 2015-11-20 09:19:09 UTC
(In reply to Mamoru TASAKA from comment #21)
> Now NFS user is seeing bug 1283581 . I am currently thinking of reverting
> this.

I do not think this should be made insecure by default to address some non-standard use case, where the actual root cause is not yet understood.

Comment 23 Tomas Hoger 2015-11-23 12:23:11 UTC
I'm re-closing this, as bug 1283581 is apparently getting fixed without needing to revert the fix for this issue.


Note You need to log in before you can comment on or make changes to this bug.