Logon screen can be bypassed using various shortcuts

[N0rbert]

Original bug-report was reported at https://pad.lv/1948339 about Ubuntu MATE 21.10. Previous releases like 20.10 and 21.04 are affected too.

The essence of the above bug-report:

It turns out that several keyboard shortcuts are allowed while Ubuntu Mate is locked (arctica-greeter):

• Mod4 + S (mate-search-tool)
• Mod4 + E (Open Caja / File Explorer)
• CTRL + Shift + Esc (mate-system-monitor)
• PRNT (Screenshot)

All of the mentioned shortcuts could be used to spawn a file explorer (Caja) or various other binaries as user "lightdm", who owns the logon screen.

Although an interactive terminal like mate-terminal, xterm, lxterm etc. could not be opened directly, there are various options to run commands as the lightdm user, for example by creating a shell script using "caja", and execute it directly using the GUI.

I've attached Proof-of-Concept GIFs for all shortcuts mentioned above. There might be additional shortcuts that could be used to achieve the same, however I'm not aware about every shortcut that is configured, but I suppose that the root cause is located somewhere in arctica-greeter, rather than within every single binary launched by shortcuts.

The bug was reproduced on a fresh installation of Ubuntu Mate 21.10.

Please find additional version details below:

$ apt-cache policy lightdm

lightdm:
Installed: 1.30.0-0ubuntu4
Candidate: 1.30.0-0ubuntu4
Version table:
*** 1.30.0-0ubuntu4 500
500 http://de.archive.ubuntu.com/ubuntu impish/universe amd64 Packages
100 /var/lib/dpkg/status

$ apt-cache policy arctica-greeter

arctica-greeter:
Installed: 0.99.1.5-2nmu1
Candidate: 0.99.1.5-2nmu1
Version table:
*** 0.99.1.5-2nmu1 500
500 http://de.archive.ubuntu.com/ubuntu impish/universe amd64 Packages
100 /var/lib/dpkg/status

Thanks,
Basti

[N0rbert]

Bug about lightdm is here - canonical/lightdm#214 .

[bka-dev]

Good evening all,

took a while to narrow down the reason why keybindings are accepted at all.

Turns out, that arctica-greeter is invoking an instance of the "marco" window manager that contains an event listener for any configured/hardcoded marco keybindings.

These are usually stored by dconf at location /org/mate/marco/global-keybindings/

The invocation of marco was introduced with 9b3526d on Jun 16, 2018 and released with arctica-greeter 0.99.1.1 on Feb 6, 2019.

Since I don't know the inner workings of arctica-greeter and ayatana-indicators in combination with marco, I'm not providing a fix here. However it looks like the invocation of marco was only introduced for usability reasons, as per the ChangeLog ("Makes handling windows opened via some of the indicators much more organic"), so it probably wouldn't break anything if the added code parts would be removed.
Hope this helps.

Cheers,
Basti

[bka-dev]

I removed most of the code that was introduced with 9b3526d in #30 .

Compiled and installed in a VM running Ubuntu Mate 21.10. Seems to work quite well, but please double check.

[uli42]

Dumb(?) question: would it make sense to include a stripped down version of marco (without the keybinding stuff)? Bastian Kanbach ***@***.***> schrieb am Mo., 28. Feb. 2022, 10:44:

…

I removed most of the code that was introduced with 9b3526d <9b3526d> in #30 <#30> . Compiled and installed in a VM running Ubuntu Mate 21.10. Seems to work quite well, but please double check. — Reply to this email directly, view it on GitHub <#28 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABQHBZHXKGQKWNFTXESGCKLU5M7WRANCNFSM5GP2ZYTQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[bka-dev]

It seems like marco also ships "marco-message" that is able to send commands to the marco daemon.

It could be invoked like marco-message disable-keybindings to disable keybindings.

However this still leaves a tiny time window during which key bindings are allowed, since marco needs to be invoked first. I did not find any command line switch yet that would start marco without keybindings. Also i don't know for sure how two subsequent invocations of Process.spawn_async would behave in terms of race-conditions etc.

Doesn't feel like a very elegant solution to me

[bka-dev]

Hi all,

the implemented fix worked fine for marco.

Actually I just discovered another issue, affecting "mate-settings-daemon" this time (also mentioned on Launchpad.

I installed MATE 22.04 on another system with some special keys on the keyboard and one of the keys (Fn + F9) on the connected keyboard is launching "mate-search-tool". I did some further research and noticed that this time different component is affected: mate-settings-daemon.

When I terminated mate-settings-daemon via SSH connection, the keybinding was no longer accepted.

20.04.3 does not seem to be affected, as slick-greeter is not relying on mate-settings-daemon. So it's probably 20.10 up to 22.04.

I will add a separate issue within the arctica-greeter project.

Not sure what the best fix is - either something similar like "marco --no-keybindings", or by not invoking mate-settings-daemon at all, although I guess this could break some ayatana-indicators features.

[sunweaver]

This issue has probably been resolved via 0199f9a

Please check and provide feedback, if issues like those observed still exist with that patch applied (and the rfkill follow-up).

[bka-dev]

Pulled a current copy of the arctica-greeter repo, compiled it, and installed it on a fresh Ubuntu MATE 22.10 installation.

The issue still exists.

I could use the keybinding "Fn"-Key + F9 to open "mate-search-tool". My keyboard has a little search icon, printed on the F9 key.

[bka-dev]

Good evening @sunweaver ,

were you able to reproduce the issue as well? It currently only affects special keybindings like those on specially labelled keys.

[sunweaver]

Finally amended via 7a865a1.