https://bugs.kde.org/show_bug.cgi?id=525879
--- Comment #1 from Lutz-Christian Quander <[email protected]> --- The description can't be edited after filing, so the corrections go as a comment: Corrections and cross-references after filing. EXISTING REPORTS I MISSED Bug 501030 (CONFIRMED, 2025-03-03, MR !5292 unmerged) already established that content is written to ~/.local/share/klipper/data/ with history options disabled. My §2 and §3 corroborate it on Plasma 6.7.5 -- they are not new. Bug 518176 (RESOLVED DOWNSTREAM, 2026-03-26) reported that history cannot be disabled by any discoverable method. NOT COVERED BY EITHER - §1 blob count against the history limit, measured on two machines that have no klipperrc at all - §5 store permissions allow OTHER LOCAL ACCOUNTS to read it on Ubuntu-family defaults; 501030 discusses same-user process access - §6 blob filenames are unsalted SHA1 of the content ON THE DOWNSTREAM CLOSURE OF 518176 §1, §2, §4 and §6 are Klipper's own retention logic and storage design. No distribution can fix them. §5 is the only finding where packaging is a factor, and ssh/gnupg force 0700/0600 regardless of umask precisely because inheriting it is wrong for sensitive data. ON THE WORKAROUND Deleting the store is insufficient: plasmashell holds it open, so unlinking removes the name and leaves the data readable via /proc/<pid>/fd. Measured on Plasma 6.7.5: 106 KB database + 408 KB WAL still reachable after deletion, until the shell restarted. VACUUM + PRAGMA wal_checkpoint(TRUNCATE) on the live file is the better remedy. This matches the /proc observation already made in 501030. 3. Optionally — comment on 501030 This is where the leverage is, since it's CONFIRMED with a patch waiting: Three additional observations on Plasma 6.7.5, corroborating this report with measurements not yet covered here. Filed separately as bug 525879. 1. Retention exceeds the history limit. On a machine with no klipperrc at all (Fedora 44, Plasma 6.7.5), ~/.local/share/klipper/data held 39 blobs. The popup does not offer 39 entries; the surplus is unreachable through any UI. 2. Permissions permit other local accounts, not only same-user processes. On stock Kubuntu 24.04.5 (umask 0002, home 751), every path component grants o+x and history2.lst is 664. Arch and Fedora escape this only create homes at 700 -- Klipper's own directory is 755 with the store at 644 on all three, so the containment is the home directory's doing Klipper's. 3. Blob filenames are unsalted SHA1 of the content: printf '%s' "CLIPTEST-MARKER-93741" | sha1sum matches the stored filename exactly. A leftover filename therefore permits confirming a guessed value, and brute-forcing low-entropy cont after the blob itself is removed. -- You are receiving this mail because: You are watching all bug changes.
