Description of problem: This seems a bit of a security issue. XFCE doesn't seem to activiate screenlock automatically by itself. This also means that XFCE sessions that have been suspended or hibernated come back up unlocked. How reproducible: 100% Steps to Reproduce: 1. Login in XFCE 2. Walk away or suspend computer. 3. Come back to computer and resume if necessary. Actual results: 3. Desktop is unlocked. Expected results: 4. Desktop to be locked after 5-10 min. Additional info: Seems currently XFCE needs to be locked manually which can't be done when suspending or hibernating. This is also true for F15, and perhaps earlier.
Hmm, this might only apply to @xfce-desktop not XFCE Live.
Well, you need xscreensaver installed. ;) I suppose we could add it to the Xfce group, but there might have been some reason we didn't... Adding Christoph here to see if he recalls. ;)
I'm fine with adding xscreensaver to the Xfce group as 'default', however it wont help us much. (In reply to comment #0) > 2. Walk away or suspend computer. How did you suspend your computer? > Expected results: > 4. Desktop to be locked after 5-10 min. I think this doesn't make sense. It's ok to expect the screen to be locked after hibernate/suspend, but once the machine is hibernate/suspended, time stands still and should not matter any longer. > Seems currently XFCE needs to be locked manually > which can't be done when suspending or hibernating. Xfce will lock the screen if you suspend/hibernate through xfce4-powermanager and it's configured to lock, but not if you suspend/hibernate from the logout window or the panel (xfce4-session's "Session menu" plugin or xfce4-panel's "Action Buttons"). In http://bugzilla.xfce.org/show_bug.cgi?id=4805#c7 and http://bugzilla.xfce.org/show_bug.cgi?id=4805#c23 upstream made it very clear that he will not change this behavior in Xfce 4.8. In 4.10 xfce4-power-manager will become a core component of Xfce and then be used to handle all suspend/hibernate calls. What we could do is to disable the buttons in the logout window through xfconf: $ xfconf-query -n -c xfce4-session -p /shutdown/ShowSuspend -s false -t bool $ xfconf-query -n -c xfce4-session -p /shutdown/ShowHibernate -s false -t bool However this does not fix the panel plugins and I'm not sure if it affects existing installs. For previous discussion please have a look at bug 525395 and bug 587633.
(I am not a big fan of xscreensaver - I would prefer if it defaulted to just blanking the screen.:) (In reply to comment #3) > > Expected results: > > 4. Desktop to be locked after 5-10 min. > > I think this doesn't make sense. It's ok to expect the screen to be locked > after hibernate/suspend, but once the machine is hibernate/suspended, time > stands still and should not matter any longer. Ah, probably my fault for mixing up two issues here. I was also referring to gnome-screensaver not kicking in by itself after an idle period (not just for suspend) - maybe gnome-screener needs to be setup better to work with xfce. This still seems to be the case for F16. So xscreensaver may help for that. > Xfce will lock the screen if you suspend/hibernate through xfce4-powermanager > and it's configured to lock, but not if you suspend/hibernate from the logout > window or the panel (xfce4-session's "Session menu" plugin or xfce4-panel's > "Action Buttons"). > > In http://bugzilla.xfce.org/show_bug.cgi?id=4805#c7 and > http://bugzilla.xfce.org/show_bug.cgi?id=4805#c23 upstream made it very clear > that he will not change this behavior in Xfce 4.8. In 4.10 xfce4-power-manager > will become a core component of Xfce and then be used to handle all > suspend/hibernate calls. Ok I see thanks for the explanation - that makes sense. Good to hear that it will get fixed for F17 hopefully then. > What we could do is to disable the buttons in the logout window through xfconf: > $ xfconf-query -n -c xfce4-session -p /shutdown/ShowSuspend -s false -t bool > $ xfconf-query -n -c xfce4-session -p /shutdown/ShowHibernate -s false -t bool Yeah that might be a good way to improve security though it might confuse current users who are used to the current logout dialog. I guess the ideal solution would be to patch xfce4-session to always lock the screen before suspending or hibernating, until 4.10. > For previous discussion please have a look at bug 525395 and bug 587633. Thanks for all the info. Ok, I changed the summary just to cover gnome-screensaver not activating when the screen times out.
Well, gnome-screensaver not activating after the timeout is not an XFCE problem. GNOME devs decided that they no longer trust the X server to determine if a session is idle but only trust gnome-session: http://git.gnome.org/browse/gnome-screensaver/commit/?id=8c391b54 That's why we had to switch to xscreensaver, complain to your colleague when you meet him. ;) There are some workarounds like http://www.narf.ssji.net/~shtrom/wiki/projets/gnomescreensavernosession but I doubt we can use these kind of hacks in Fedora.
Ok I see... well I guess xscreensaver is the best bet for now. Perhaps I'll try to ask if the maintainer would consider making it just blank the screen by default.
If you install only xscreensaver-base you should get just a blank screen because the screensavers are set to random and none is installed.
I have added xscreensaver-base to the xfce4-desktop group in comps in http://git.fedorahosted.org/git/?p=comps.git;a=commit;h=4b481b87. Anything more we need/should/could do?
Thanks - xscreensaver-base looks good.
Ah, perhaps xscreensaver can be removed now from fedora-livecd-xfce.ks then?
This message is a reminder that Fedora 16 is nearing its end of life. Approximately 4 (four) weeks from now Fedora will stop maintaining and issuing updates for Fedora 16. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as WONTFIX if it remains open with a Fedora 'version' of '16'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Fedora version prior to Fedora 16's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Fedora 16 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora, you are encouraged to click on "Clone This Bug" and open it against that version of Fedora. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Fedora release includes newer upstream software that fixes bugs or makes them obsolete. The process we are following is described here: http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Fedora 16 changed to end-of-life (EOL) status on 2013-02-12. Fedora 16 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora please feel free to reopen this bug against that version. Thank you for reporting this bug and we are sorry it could not be fixed.
(In reply to comment #10) > Ah, perhaps xscreensaver can be removed now from fedora-livecd-xfce.ks then? For the record: This was done as part of the new comps groups for F18.