security: mate-screensaver unlocks by itself

[edisno]

Expected behaviour

The screen stays locked even when I leave the computer running alone for a week or two.

Actual behaviour

Recently (for some months?) I have noticed after coming back to a computer after a week or two, that the screen is not locked as it was when I left it, causing certain security implications.

It happens on several computers, at different physical sites, all running the same distro. They are all on 24/7 and act as servers.

Might be related to (from 2018): https://github.com/mate-desktop/mate-screensaver/issues/155

Another thing I have thought of is the OOM killer, since the servers are sometimes overloaded.

Steps to reproduce the behaviour

Lock the screen and leave.

MATE general version

mate-about: MATE Desktop Environment 1.26.0

Package version

ii mate-screensaver 1.26.0-0ubuntu1 amd64 MATE screen saver and locker

Linux Distribution

Distributor ID: Ubuntu Description: Ubuntu 21.10 Release: 21.10 Codename: impish

[lukefromdc]

Is mate-screensaver still running when this happens or has it crashed? If it is still running you should see it in mate-system-monitor's "processes" tab. If you switch VT's and runkillall mate-screensaver from console the desktop will be unlocked when you return to it as the mate-screensaver window no longer exists. Since you have to log in with your password/passphrase to do this that's not a security issue but a crash sure as fsck is.

[lukefromdc]

Also note that as reported elsewhere, MATE does not support Cgroups (yet) so the OOM killer should take out the entire X session, returning the user to the login screen. If Cgroups support is later added we will indeed need to ensure that the screensaver cannot be killed by the out of memory process killer ahead of the overall session

[raveit65]

Is systemd-oomd used?

[davidhedlund]

• https://github.com/mate-desktop/mate-screensaver/issues/282

[zhuyaliang]

@edisno Does the issue still exist