Skip to content

Commit

Permalink
Disable greeters from loading KDE's debug hander
Browse files Browse the repository at this point in the history
Some themes may use KDE components which will automatically load KDE's
crash handler.

If the greeter were to then somehow crash, that would leave a crash
handler allowing other actions, albeit as the locked down SDDM user.

Only SDDM users using the breeze theme from plasma-workspace are
affected. Safest and simplest fix is to handle this inside SDDM
disabling kcrash via an environment variable for all future themes that
may use these libraries.

CVE-2015-0856
  • Loading branch information
davidedmundson committed Oct 14, 2015
1 parent c637727 commit 4cfed6b
Showing 1 changed file with 4 additions and 0 deletions.
4 changes: 4 additions & 0 deletions src/daemon/Greeter.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,10 @@ namespace SDDM {
env.insert(QStringLiteral("XDG_VTNR"), QString::number(m_display->terminalId()));
env.insert(QStringLiteral("XDG_SESSION_CLASS"), QStringLiteral("greeter"));
env.insert(QStringLiteral("XDG_SESSION_TYPE"), m_display->sessionType());

//some themes may use KDE components and that will automatically load KDE's crash handler which we don't want
//counterintuitively setting this env disables that handler
env.insert(QStringLiteral("KDE_DEBUG"), QStringLiteral("1"));
m_auth->insertEnvironment(env);

// log message
Expand Down

0 comments on commit 4cfed6b

Please sign in to comment.