Bug#834178: gdm3: Passwords are readable while typing

[Evangelos Skarmoutsos]

Package: gdm3
Version: 3.20.1-1
Severity: normal

Dear Maintainer,

once every 200-400 logouts, the next user can read his password while typing.

If login button is pressed using a wrong password, the next login attempt works
correctly (characters can not be read and are represented as dots).

I was expecting passwords to never be readable.



-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=el_GR.UTF-8, LC_CTYPE=el_GR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages gdm3 depends on:
ii  accountsservice                              0.6.40-3
ii  adduser                                      3.115
ii  dconf-cli                                    0.26.0-1
ii  dconf-gsettings-backend                      0.26.0-1
ii  debconf [debconf-2.0]                        1.5.59
ii  gir1.2-gdm-1.0                               3.20.1-1
ii  gnome-session [x-session-manager]            3.20.2-1
ii  gnome-session-bin                            3.20.2-1
ii  gnome-session-flashback [x-session-manager]  3.20.2-1
ii  gnome-settings-daemon                        3.20.1-2
ii  gnome-shell                                  3.20.3-1+b1
ii  gnome-terminal [x-terminal-emulator]         3.20.2-2
ii  gsettings-desktop-schemas                    3.20.0-3
ii  libaccountsservice0                          0.6.40-3
ii  libaudit1                                    1:2.6.5-1
ii  libc6                                        2.23-4
ii  libcanberra-gtk3-0                           0.30-3
ii  libcanberra0                                 0.30-3
ii  libgdk-pixbuf2.0-0                           2.34.0-1
ii  libgdm1                                      3.20.1-1
ii  libglib2.0-0                                 2.48.1-2
ii  libglib2.0-bin                               2.48.1-2
ii  libgtk-3-0                                   3.20.7-1
ii  libpam-modules                               1.1.8-3.3
ii  libpam-runtime                               1.1.8-3.3
ii  libpam-systemd                               230-7
ii  libpam0g                                     1.1.8-3.3
ii  librsvg2-common                              2.40.16-1
ii  libselinux1                                  2.5-3
ii  libsystemd0                                  230-7
ii  libwrap0                                     7.6.q-25
ii  libx11-6                                     2:1.6.3-1
ii  libxau6                                      1:1.0.8-1
ii  libxdmcp6                                    1:1.1.2-1.1
ii  lsb-base                                     9.20160629
ii  metacity [x-window-manager]                  1:3.20.2-1
ii  mutter [x-window-manager]                    3.20.3-2
ii  policykit-1                                  0.105-16
ii  ucf                                          3.0036
ii  x11-common                                   1:7.7+16
ii  x11-xserver-utils                            7.7+7

Versions of packages gdm3 recommends:
ii  at-spi2-core    2.20.2-1
ii  desktop-base    8.0.2
ii  x11-xkb-utils   7.7+3
ii  xserver-xephyr  2:1.18.4-1
ii  xserver-xorg    1:7.7+16
ii  zenity          3.20.0-1

Versions of packages gdm3 suggests:
ii  gnome-orca            3.20.2-1
ii  libpam-gnome-keyring  3.20.0-1

-- Configuration Files:
/etc/gdm3/Init/Default changed:
PATH="/usr/bin:$PATH"
OLD_IFS=$IFS
gdmwhich () {
  COMMAND="$1"
  OUTPUT=
  IFS=:
  for dir in $PATH
  do
    if test -x "$dir/$COMMAND" ; then
      if test "x$OUTPUT" = "x" ; then
        OUTPUT="$dir/$COMMAND"
      fi
    fi
  done
  IFS=$OLD_IFS
  echo "$OUTPUT"
}
sysresources=/etc/X11/Xresources
if [ -f "$sysresources" ]; then
    xrdb -merge "$sysresources"
fi
sysmodmap=/etc/X11/Xmodmap
XMODMAP=`gdmwhich xmodmap`
if [ "x$XMODMAP" != "x" ] ; then
  if [ "x$GDM_PARENT_DISPLAY" = "x" ]; then
    if [ -f $sysmodmap ]; then
      $XMODMAP $sysmodmap
    fi
  else
    ( DISPLAY=$GDM_PARENT_DISPLAY XAUTHORITY=$GDM_PARENT_XAUTHORITY $XMODMAP -pke ) | $XMODMAP -
  fi
  #
  # Switch Sun's Alt and Meta mod mappings
  #
  UNAME=`gdmwhich uname`
  PROCESSOR=`$UNAME -p`
  if [ "x$PROCESSOR" = "xsparc" ]; then
    if $XMODMAP | grep mod4 | grep Alt > /dev/null 2>/dev/null
    then
      $XMODMAP -e "clear Mod1" \
               -e "clear Mod4" \
               -e "add Mod1 = Alt_L" \
               -e "add Mod1 = Alt_R" \
               -e "add Mod4 = Meta_L" \
               -e "add Mod4 = Meta_R"
    fi
  fi
fi
SETXKBMAP=`gdmwhich setxkbmap`
if [ "x$SETXKBMAP" != "x" ] ; then
  # FIXME: is this all right?  Is this completely on crack?
  # What this does is move the xkb configuration from the GDM_PARENT_DISPLAY
  # FIXME: This should be done in code.  Or there must be an easier way ...
  if [ -n "$GDM_PARENT_DISPLAY" ]; then
    XKBSETUP=`( DISPLAY=$GDM_PARENT_DISPLAY XAUTHORITY=$GDM_PARENT_XAUTHORITY $SETXKBMAP -v )`
    if [ -n "$XKBSETUP" ]; then
      XKBKEYMAP=`echo "$XKBSETUP" | grep '^keymap' | awk '{ print $2 }'`
      XKBTYPES=`echo "$XKBSETUP" | grep '^types' | awk '{ print $2 }'`
      XKBCOMPAT=`echo "$XKBSETUP" | grep '^compat' | awk '{ print $2 }'`
      XKBSYMBOLS=`echo "$XKBSETUP" | grep '^symbols' | awk '{ print $2 }'`
      XKBGEOMETRY=`echo "$XKBSETUP" | grep '^geometry' | awk '{ print $2 }'`
      if [ -n "$XKBKEYMAP" ]; then
        $SETXKBMAP -keymap "$XKBKEYMAP"
      elif [ -n "$XKBTYPES" -a -n "$XKBCOMPAT" -a -n "$XKBSYMBOLS" -a -n "$XKBGEOMETRY" ]; then
        $SETXKBMAP -types "$XKBTYPES" -compat "$XKBCOMPAT" -symbols "$XKBSYMBOLS" -geometry "$XKBGEOMETRY"
      elif [ -n "$XKBTYPES" -a -n "$XKBCOMPAT" -a -n "$XKBSYMBOLS" ]; then
        $SETXKBMAP -types "$XKBTYPES" -compat "$XKBCOMPAT" -symbols "$XKBSYMBOLS"
      elif [ -n "$XKBSYMBOLS" ]; then
        $SETXKBMAP -symbols "$XKBSYMBOLS"
      fi
    fi
  fi
fi
if [-x /usr/bin/numlockx]; then
  /usr/bin/numlockx on
fi
exit 0


-- debconf information:
  gdm3/daemon_name: /usr/sbin/gdm3
* shared/default-x-display-manager: gdm3