Calendar and device list being active prevent Qubes lock session

unfazed · June 8, 2022, 4:32am

Hi, I am not sure if this has been reported, but having focus on different elements such as calendar or the device list prevent the session from locking.

The screen goes black but it does not ask for the session password.

fsflover · June 8, 2022, 9:51am

github.com/QubesOS/qubes-issues

Open menus prevent screen lock

opened 01:25AM - 14 May 18 UTC

closed 04:06PM - 24 Mar 22 UTC

andrewdavidwong

T: bug P: critical C: desktop-linux-xfce4 security R: not our bug

### Qubes OS version:  R3.2 ### Affected component(s): Xfce4 4.12 + XScreenSaver 5.36 --- ### Steps to reproduce the behavior:  1. Set the Xfce4 power settings to suspend (S3 sleep) when the laptop lid is closed. 2. Set XScreenSaver to lock the screen when the laptop lid is closed. 3. Set XScreenSaver to lock the screen on suspended (S3 sleep). 4. Verify that it works by closing the laptop lid, waiting for suspend, and opening the lid again. 5. XScreenSaver prompts you to enter your passphrase, as expected. Enter your passphrase to unlock the screen. 6. Now, click on the Xfce4 Applications Menu (aka "Start Menu"). 7. Leaving the menu open, close the laptop lid. 8. Wait for the laptop to suspend. 9. Open the lid again. 10. The screen is completely unlocked, and you have full access to the system without having to enter the screen locker passphrase. ### Expected behavior: The screen should lock properly regardless of which menus are open in dom0. ### Actual behavior: Having the Applications Menu open prevents the screen from locking. Similarly, having a "Launcher" menu open (a type of task bar widget for holding shortcut buttons) prevents screen locking in the same way. On my machine, this is reliably reproducible every time. ### General notes: In Qubes, one of the main purposes of the screen locker is to protect the system from physical threats. For example, a user may need to quickly shut her laptop lid when confronted by an adversary, or a thief may close the laptop while snatching it from a user in a coffee shop. In both cases, if the user had the Applications Menu or a Launcher menu open when the lid was shut, an attacker with no technical skill would be able to gain full access to the system simply by opening the lid. --- ### Related issues: #1917

betinajessen · October 19, 2022, 3:30pm

Whatever it is, it’s really buggy. I keep getting error logs for services that use it and get security violations. I can’t even find out what the app is so I can adjust the privileges are so it works. It calendar 2023 appears to be linked to an RPC of some kind.