Bug 1306165 - GDM allows taking screenshots in locked session
GDM allows taking screenshots in locked session
Status: CLOSED CURRENTRELEASE
Product: Fedora
Classification: Fedora
Component: gdm (Show other bugs)
23
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Ray Strode [halfline]
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-10 03:26 EST by Jean-Christophe Baptiste
Modified: 2016-12-11 14:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-12-11 14:11:29 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Screenshot taken while the screen was locked (784.04 KB, image/png)
2016-02-10 03:26 EST, Jean-Christophe Baptiste
no flags Details

  None (edit)
Description Jean-Christophe Baptiste 2016-02-10 03:26:03 EST
Created attachment 1122694 [details]
Screenshot taken while the screen was locked

Description of problem:

I was surprised to find out that while my gnome-shell session was locked in GDM, it was still possible to take screenshots following specific steps.

In other words, a locked session still allow some shortcuts to call an external program.

I believe it is a security issue, even if it is a moderate one.

Anyone could flood the victim's disk with thousands of images, by keeping the [PrintScr] key pressed.
Also, if the key happened to be remapped by the user to another program, who knows what the consequence could be.

How reproducible:


Steps to Reproduce:
1. Lock the gnome-session
2. Right click in the user password field
3. Take a screenshot by pressiong the [PrintScr] key
4. Eventually keep the key pressed if you want to flood the Picture directory of the victim

Actual results:

A screenshot is taken like usual and saved in the Picture folder of the active user.
See enclosure of an example screenshot.

Expected results:

I would expect that it is blocked like in this context menu like it is in any other part of the locked screen.

I believe it is essential that no external, background task could be launched while the screen is locked, even if the risk appears to be low at first.
Comment 1 Christian Stadelmann 2016-09-16 13:07:32 EDT
I think this issue is gone on F24, at least for Gnome+Wayland sessions.
Comment 2 Fedora End Of Life 2016-11-24 10:29:06 EST
This message is a reminder that Fedora 23 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 23. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '23'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 23 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 3 Jean-Christophe Baptiste 2016-12-11 14:11:29 EST
Yes, it is gone. Let's close it.

Note You need to log in before you can comment on or make changes to this bug.