3 ms·
Unprivileged application is able to bypass GNOME Lockscreen
- okasaki 3y agoClosed wontfix. According to the GNOME dev, unlocking your screensaver by pressing a joystick button is not a security issue.
- zer00eyz 3y agoNot just wontfix... with the proposed solution of "the way to lock down programs from this sort of access is to use flatpak" Bwawwwhhhaaaahhh There is so much drama between Gnome and Wayland that if you spend any amount of time looking you will run out of popcorn.
- josephcsible 3y agoI could understand a little bit if this were reported as a vulnerability in joystickwake, but it seems completely insane to think it could possibly be a vulnerability in GNOME. Code running as you can do things as you, news at 11.
- okasaki 3y agoNo, it's completely insane that pressing a joystick button can remove the screen lock and this isn't seen as a security issue. For example in Windows, the screen lock can't be removed without the user authenticating.
- josephcsible 3y agoBy default that would be insane, but if you install and run a program under your credentials to let it do that, that's not GNOME's fault. Also, Windows does let programs do that, via custom credential providers. See, e.g., https://learn.microsoft.com/en-us/archive/msdn-magazine/2007/january/custom-login-experiences-credential-providers-in-windows-vista https://learn.microsoft.com/en-us/archive/msdn-magazine/2007... and https://stackoverflow.com/a/35173886/7509065 https://stackoverflow.com/a/35173886/7509065