address timedlogin bug leading to wrong session getting unlocked
Burghard Britzke reported to security@gnome.org that he has found a bug in GDM's timed login implementation.
Under the right circumstances, after the timed login timeout expires, a running session may get misassociated with the timed login user instead of the user that started the session. Further attempts to log in as the timed login user will instead unlock the misassociated user session.
This only affects X.org since, we kill the login screen on wayland after login.
Steps to reproduce:
- create two users bubi(1000) and user gast(1001)
- edit the
[daemon]
section of/etc/gdm/custom.conf
to enable timed login for the gast user
[daemon]
TimedLoginEnable=true
TimedLogin=gast
TimedLoginDelay=10
- restart
- login as user bubi(1000)
- lock the screen
- select
Login as different user
below the password field - select
gast
from the user list and enter the password for thegast
user - notice that the
bubi
user is unlocked instead of thegast
user