lp:lightdm/1.22

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

1 recipe using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #1663157: Guest session processes are not confined in 16.10 and newer releases	Undecided	New
Bug #1707187: Export autologin-session to greeter	Wishlist	Fix Committed
Bug #1718565: Timed autologin doesn't use autologin-session	Medium	Fix Committed

Link a bug report

Related blueprints

2481. By Robert Ancell on 2017-09-21

Fix timed autologins not using autologin-session when no session specified

2480. By Robert Ancell on 2017-09-21

Expose autologin-session as a hint to the greeter

Based on a patch by Roland Tapken.

2479. By Robert Ancell on 2017-05-11

* SECURITY UPDATE: Guest session not confined (LP: #1663157)
  - debian/50-disable-guest.conf:
  - debian/lightdm.install:
    - Disable guest sessions by default, this can be overridden by custom
      configuration (e.g. /etc/lightdm/lightdm.conf)
  - CVE-2017-8900

2478. By Robert Ancell on 2017-04-04

* SECURITY UPDATE: Directory traversal allowing arbitrary directory
  ownership and privilege escalation (LP: #1677924)
  - debian/guest-account.sh: Detect existing malicious guest user home dirs
    before proceeding with guest user creation
  - CVE-2017-7358

2477. By Tyler Hicks on 2017-04-04

Detect existing malicious guest user home dirs

It was discovered that a local attacker could watch for lightdm's
guest-account script to create a /tmp/guest-XXXXXX file and then quickly
create the lowercase representation of the guest user's home directory
before lightdm could. This allowed the attacker to have control of the
guest user's home directory and, subsequently, gain control of an
arbitrary directory in the filesystem which could lead to privilege
escalation.

This patch fixes the issue by detecting failures in creating a directory
for the guest user's home directory. If the file (directory, symlink,
etc.) already exists at the path, mkdir will fail and the script will
exit. This means that it is still possible for a local user to carry out
a denial of service on the guest user login feature.

2476. By Robert Ancell on 2017-03-22

Releasing 1.22.0

2475. By Robert Ancell on 2017-03-13

Allow guest sessions to talk to Mir (allowing unity8)

2474. By Launchpad Translations on behalf of lightdm-team on 2017-03-09

Launchpad automatic translations update.

2473. By Launchpad Translations on behalf of lightdm-team on 2017-03-07

Launchpad automatic translations update.

2472. By Launchpad Translations on behalf of lightdm-team on 2017-03-01

Launchpad automatic translations update.