Bug#634259: gnome-session: stop-multiple-users dialog fails to clear screen

[Adam Borowski]

Package: gnome-session
Version: 2.30.2-3
Severity: important
Tags: security

(I'm not sure if it's gnome-session that displays this dialog; at least its
contents comes from policykit over dbus.)

When the org.freedesktop.consolekit.system.stop-multiple-users dialog is
displayed instead of shutting down, either spuriously (another bug), or, I
guess, perhaps even due to someone else actually being logged in, sometimes
the screen is not completely cleared.

If something sensitive happened to be on the screen when logging off, it
will be left for everyone to see, not protected by the screen saver (as the
session is already gone by that time).  For example, I just had a
gnome-terminal window with a private mail sent on Friday just before leaving
work -- if a co-worker happened to wander by, that stuff was not meant to be
seen.

This can be reproduced by sshing in from another machine (a legitimate
multiple login), then repeatedly trying to shut down.  After a number of
tries, one of windows will remain on the screen.  Curiously, it seems that
it's never one that was on the current desktop you were on at the time of
logoff.  Window decoration is gone but the contents are still there.


-- System Information:
Debian Release: 6.0.2
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-686 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages gnome-session depends on:
ii  gnome-panel            2.30.2-2          launcher and docking facility for 
ii  gnome-session-bin      2.30.2-3          The GNOME Session Manager - Minima
ii  gnome-session-common   2.30.2-3          Common files for the GNOME session
ii  gnome-settings-daemon  2.30.2-2+squeeze1 daemon handling the GNOME session 
ii  metacity               1:2.30.1-3        lightweight GTK+ window manager
ii  nautilus               2.30.1-2squeeze1  file manager and graphical shell f
ii  policykit-1-gnome      0.96-3            GNOME authentication agent for Pol

Versions of packages gnome-session recommends:
ii  gnome-power-manager           2.32.0-2   power management tool for the GNOM

Versions of packages gnome-session suggests:
ii  desktop-base               6.0.5squeeze1 common files for the Debian Deskto
ii  gnome-keyring              2.30.3-5      GNOME keyring services (daemon and
ii  gnome-user-guide           2.30.1-1      GNOME user's guide

-- no debconf information