Skip to content
Permalink
Browse files

Disable greeters from loading KDE's debug hander

Some themes may use KDE components which will automatically load KDE's
crash handler.

If the greeter were to then somehow crash, that would leave a crash
handler allowing other actions, albeit as the locked down SDDM user.

Only SDDM users using the breeze theme from plasma-workspace are
affected. Safest and simplest fix is to handle this inside SDDM
disabling kcrash via an environment variable for all future themes that
may use these libraries.

CVE-2015-0856
  • Loading branch information...
davidedmundson committed Oct 13, 2015
1 parent c637727 commit 4cfed6b0a625593fb43876f04badc4dd99799d86
Showing with 4 additions and 0 deletions.
  1. +4 −0 src/daemon/Greeter.cpp
@@ -145,6 +145,10 @@ namespace SDDM {
env.insert(QStringLiteral("XDG_VTNR"), QString::number(m_display->terminalId()));
env.insert(QStringLiteral("XDG_SESSION_CLASS"), QStringLiteral("greeter"));
env.insert(QStringLiteral("XDG_SESSION_TYPE"), m_display->sessionType());

//some themes may use KDE components and that will automatically load KDE's crash handler which we don't want
//counterintuitively setting this env disables that handler
env.insert(QStringLiteral("KDE_DEBUG"), QStringLiteral("1"));
m_auth->insertEnvironment(env);

// log message

0 comments on commit 4cfed6b

Please sign in to comment.
You can’t perform that action at this time.