Hi Seth, thanks for your mail. I'm agreed that this is the way the system permissions work. But, did you see the comment I added to the bug report?
Further investigation shows that file ownership is also ignored If I change the ownership and permissions of the file, then they are ignored by the Brightness & Lock app eve@steve-laptop:~$ ls -l ~/.config/dconf/user -rw-r--r-- 1 steve eve 15965 Apr 28 10:37 /home/eve/.config/dconf/user ==> Alter lock settings using "Brightness & Lock" app eve@steve-laptop:~$ ls -l ~/.config/dconf/user -rw-rw-r-- 1 eve eve 15965 Apr 28 11:13 /home/eve/.config/dconf/user Eve is no longer the file owner, but is in the group (and she is not in the sudo group), so I don't believe that any process she is running should be able to change the file permissions and ownership. So I am guessing that the screen locking process is either not run by the user, or it is running with elevated privileges, which enable it to overwrite the file with a different privilege set. I understand that the setup that I am looking to configure may not be in the design spec - and there may be better ways to achieve it, but I don't think that it is that uncommon (for example, on my work (Windows 10) laptop, the screen locking settings are all configured by Group IT and are locked, so mere mortals cannot change them. However, I am not convinced that the existing behaviour is desirable - because the screen locking process appears not to check the file permissions and ownership, and uses it's elevated privilege status to overwrite them. All the best, Steve PS. FWIW Eve is thankfully not interested in Unix system hacking. Social engineering on her parents seems a better way to get increased access to funny cat videos :-) Steve Gooberman-Hill Skype: steve.gooberman.hill On 1 May 2018 at 03:35, Seth Arnold <1767...@bugs.launchpad.net> wrote: > This is the way Unix discretionary access controls work. So long as the > files are in Eve's home directory, and she retains ownership of her home > directory, she will be able to rename the ~/.config/ directory and > continue on as she wishes. > > Furthermore, the screen locking is handled by a process that runs as her > user account in her user session. She could simply attach a debugger to > it and lock it solid. Or she could write a little program to keep the > X11 session 'active' and thus keep the screen from locking. Or she could > click on a menu entry every time she walks away from the computer to > keep the screen from locking. Or she could write her own screen locking > program that would act as she wishes. > > You could try using the shadow 'lock account' tools; note that this is > trivial to bypass if she can sit at the computer during bootup, unless > you also take steps to lock the hard drive, lock the bios, and lock the > grub configuration. But it cannot help you enforce screen locking when > you wish. Not much short of forcibly killing her processes or rebooting > the machine will help. > > Thanks > > -- > You received this bug notification because you are subscribed to the bug > report. > https://bugs.launchpad.net/bugs/1767618 > > Title: > system Brightness & Lock app ignores file permissions > > Status in gnome-screensaver package in Ubuntu: > Won't Fix > > Bug description: > The "Brightness & Lock" app in "System Settings" is ignoring file > permissions. > > As a sudoo group user, I wish to restrict another user's ability to > change their user settings (particularly the screen lock settings), so > they can't switch the lock off > > (I want to restrict my daughter's access to the laptop, so I control > the password to her account - but she has worked out that she can turn > the screen lock off) > > Using sudo privileges I can change the file permissions on her > dconf/user settings > > steve@steve-laptop:/home/eve$ sudo chmod ug-w ~eve/.config/dconf/user > steve@steve-laptop:/home/eve$ sudo ls -l ~eve/.config/dconf/user > -r--r--r-- 1 eve eve 15965 Apr 28 10:34 /home/eve/.config/dconf/user > > If I then switch to her account, and use the system settings > "Brighness & Lock" app to switch the lock off. I then check the file > permissions on her dconf/user account, and find > > eve@steve-laptop:/home/eve$ sudo ls -l ~eve/.config/dconf/user > -rw-rw-r-- 1 eve eve 15965 Apr 28 10:37 /home/eve/.config/dconf/user > > I don't believe that any user should have permission to overwrite this > file if it has read-only permissions > > ProblemType: Bug > DistroRelease: Ubuntu 16.04 > Package: gnome-screensaver 3.6.1-7ubuntu4 > ProcVersionSignature: Ubuntu 4.4.0-119.143-generic 4.4.114 > Uname: Linux 4.4.0-119-generic x86_64 > ApportVersion: 2.20.1-0ubuntu2.15 > Architecture: amd64 > CurrentDesktop: Unity > Date: Sat Apr 28 10:49:12 2018 > GnomeSessionIdleInhibited: No > GnomeSessionInhibitors: None > GsettingsGnomeSession: > org.gnome.desktop.session session-name 'ubuntu' > org.gnome.desktop.session idle-delay uint32 0 > SourcePackage: gnome-screensaver > UpgradeStatus: Upgraded to xenial on 2016-10-18 (556 days ago) > > To manage notifications about this bug go to: > https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1767618/+ > subscriptions > -- You received this bug notification because you are a member of Ubuntu Desktop Bugs, which is subscribed to gnome-screensaver in Ubuntu. https://bugs.launchpad.net/bugs/1767618 Title: system Brightness & Lock app ignores file permissions To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1767618/+subscriptions -- desktop-bugs mailing list desktop-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
