Debian Bug report logs - #834367
systemctl daemon-reexec (as run on systemd upgrade) causes all keystrokes to go to text console in addition to X (including passwords)

Toggle useless messages

Message #3 received at submit@bugs.debian.org (full text, mbox, reply):

From: Josh Triplett <josh@joshtriplett.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: systemctl daemon-reexec (as run on systemd upgrade) causes all keystrokes to go to text console in addition to X (including passwords)

Date: Sun, 14 Aug 2016 15:53:01 -0700

Package: systemd
Version: 231-2
Severity: critical
Tags: security

[Severity and tag due to the likely possibility of exposing user
passwords this way.  If this occurs with the version in jessie as well,
it'll require a security update.]

After running "systemctl daemon-reexec" from within an X session, all
keystrokes in the X session (including passwords) appear on the
underlying text console as well.  They show up during the shutdown
process, or any other time X stops.

Since systemd's postinst runs "systemctl daemon-reexec" on upgrades,
this would occur in any session after upgrading the systemd package.

I can reliably reproduce this, either by upgrading or downgrading the
systemd package, or by running "systemctl daemon-reexec" (as root).

This might potentially explain the mention in bug 819500 of seeing
usernames and passwords on the console, as well.  This would only happen
in a session after upgrading systemd or otherwise running "systemctl
daemon-reexec", which would explain not seeing it every time.

-- Package-specific info:

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 4.7.0-rc7-amd64 (SMP w/4 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages systemd depends on:
ii  adduser         3.115
ii  libacl1         2.2.52-3
ii  libapparmor1    2.10.95-4
ii  libaudit1       1:2.6.5-1
ii  libblkid1       2.28-6
ii  libc6           2.23-4
ii  libcap2         1:2.25-1
ii  libcap2-bin     1:2.25-1
ii  libcryptsetup4  2:1.7.0-2
ii  libgcrypt20     1.7.2-2
ii  libgpg-error0   1.24-1
ii  libidn11        1.33-1
ii  libkmod2        22-1.1
ii  liblzma5        5.1.1alpha+20120614-2.1
ii  libmount1       2.28-6
ii  libpam0g        1.1.8-3.3
ii  libseccomp2     2.3.1-2
ii  libselinux1     2.5-3
ii  libsystemd0     231-2
ii  mount           2.28-6
ii  util-linux      2.28-6

Versions of packages systemd recommends:
ii  dbus            1.10.8-1
ii  libpam-systemd  231-2

Versions of packages systemd suggests:
ii  policykit-1        0.105-16
pn  systemd-container  <none>
pn  systemd-ui         <none>

Versions of packages systemd is related to:
ii  udev  231-2

-- no debconf information

Message #8 received at 834367@bugs.debian.org (full text, mbox, reply):

From: Hilko Bengen <bengen@debian.org>

To: 834367@bugs.debian.org

Subject: This also seems to work for keystroke combinations

Date: Mon, 15 Aug 2016 14:48:15 +0200

In my case, trying to activate xscreensaver from an XFCE4 sessino by
pressing Ctrl-Alt-Delete just after running apt-get dist-upgrade
triggered a reboot of the machine which was a bit unexpected.

Cheers,
-Hilko

Message #13 received at 834367@bugs.debian.org (full text, mbox, reply):

From: Vincent Bernat <bernat@debian.org>

To: Josh Triplett <josh@joshtriplett.org>

Cc: 834367@bugs.debian.org

Subject: Re: Bug#834367: systemctl daemon-reexec (as run on systemd upgrade) causes all keystrokes to go to text console in addition to X (including passwords)

Date: Mon, 15 Aug 2016 19:58:09 +0200

[Message part 1 (text/plain, inline)]

 ❦ 15 août 2016 00:53 CEST, Josh Triplett <josh@joshtriplett.org> :

> [Severity and tag due to the likely possibility of exposing user
> passwords this way.  If this occurs with the version in jessie as well,
> it'll require a security update.]

I think this is fairly recent. I stumbled upon your bug report while
searching why Alt + "left arrow" switched to another VT. It started to
happen to me today. Therefore, I think this only happens with 231-2 but
not with 231-1 (assuming this is the same cause).
-- 
Make it clear before you make it faster.
            - The Elements of Programming Style (Kernighan & Plauger)

[signature.asc (application/pgp-signature, inline)]

Message #18 received at 834367@bugs.debian.org (full text, mbox, reply):

From: Josh Triplett <josh@joshtriplett.org>

To: Vincent Bernat <bernat@debian.org>

Cc: 834367@bugs.debian.org

Subject: Re: Bug#834367: systemctl daemon-reexec (as run on systemd upgrade) causes all keystrokes to go to text console in addition to X (including passwords)

Date: Mon, 15 Aug 2016 12:47:21 -0700

On Mon, Aug 15, 2016 at 07:58:09PM +0200, Vincent Bernat wrote:
>  ❦ 15 août 2016 00:53 CEST, Josh Triplett <josh@joshtriplett.org> :
> 
> > [Severity and tag due to the likely possibility of exposing user
> > passwords this way.  If this occurs with the version in jessie as well,
> > it'll require a security update.]
> 
> I think this is fairly recent. I stumbled upon your bug report while
> searching why Alt + "left arrow" switched to another VT. It started to
> happen to me today. Therefore, I think this only happens with 231-2 but
> not with 231-1 (assuming this is the same cause).

I could reproduce it with both 231-1 and 231-2.  I suspect you started
seeing it when you upgraded from 231-1 to 231-2, causing a
daemon-reexec, and then Alt-Left went to the text console in addition to
X, causing it to change VTs.

I had a similar experience: hitting Ctrl-Alt-Del rebooted directly
rather than opening a GNOME dialog, because it went to the console.

- Josh Triplett

Message #23 received at 834367@bugs.debian.org (full text, mbox, reply):

From: Felipe Sateler <fsateler@debian.org>

To: Josh Triplett <josh@joshtriplett.org>, 834367@bugs.debian.org

Cc: Vincent Bernat <bernat@debian.org>

Subject: Re: Bug#834367: systemctl daemon-reexec (as run on systemd upgrade) causes all keystrokes to go to text console in addition to X (including passwords)

Date: Tue, 16 Aug 2016 10:44:59 -0300

On 15 August 2016 at 16:47, Josh Triplett <josh@joshtriplett.org> wrote:
> On Mon, Aug 15, 2016 at 07:58:09PM +0200, Vincent Bernat wrote:
>>  ❦ 15 août 2016 00:53 CEST, Josh Triplett <josh@joshtriplett.org> :
>>
>> > [Severity and tag due to the likely possibility of exposing user
>> > passwords this way.  If this occurs with the version in jessie as well,
>> > it'll require a security update.]
>>
>> I think this is fairly recent. I stumbled upon your bug report while
>> searching why Alt + "left arrow" switched to another VT. It started to
>> happen to me today. Therefore, I think this only happens with 231-2 but
>> not with 231-1 (assuming this is the same cause).
>
> I could reproduce it with both 231-1 and 231-2.  I suspect you started
> seeing it when you upgraded from 231-1 to 231-2, causing a
> daemon-reexec, and then Alt-Left went to the text console in addition to
> X, causing it to change VTs.
>
> I had a similar experience: hitting Ctrl-Alt-Del rebooted directly
> rather than opening a GNOME dialog, because it went to the console.

This may be related to upstream issue
https://github.com/systemd/systemd/issues/3842.

The linked commit there seems very relevant:
"pid1: reconnect to the console before being re-executed" [1]. Could
someone try to reproduce this with this patch reverted?

[1] https://github.com/systemd/systemd/commit/affd7ed1a923b0df8479cff1bd9eafb625fdaa66


-- 

Saludos,
Felipe Sateler

Message #32 received at 834367@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: Felipe Sateler <fsateler@debian.org>, 834367@bugs.debian.org

Cc: Josh Triplett <josh@joshtriplett.org>, Vincent Bernat <bernat@debian.org>

Subject: Re: Bug#834367: systemctl daemon-reexec (as run on systemd upgrade) causes all keystrokes to go to text console in addition to X (including passwords)

Date: Tue, 16 Aug 2016 21:15:41 +0200

Control: tag -1 pending

Felipe Sateler [2016-08-16 10:44 -0300]:
> This may be related to upstream issue
> https://github.com/systemd/systemd/issues/3842.
> 
> The linked commit there seems very relevant:
> "pid1: reconnect to the console before being re-executed" [1]. Could
> someone try to reproduce this with this patch reverted?

I did, and that indeed fixes it. Thanks for digging this out! Revert
pushed to packaging git. I suppose we should upload this ASAP?

Martin
-- 
Martin Pitt                        | http://www.piware.de
Ubuntu Developer (www.ubuntu.com)  | Debian Developer  (www.debian.org)

Message #43 received at 834367-close@bugs.debian.org (full text, mbox, reply):

From: Martin Pitt <mpitt@debian.org>

To: 834367-close@bugs.debian.org

Subject: Bug#834367: fixed in systemd 231-4

Date: Thu, 18 Aug 2016 05:20:05 +0000

Source: systemd
Source-Version: 231-4

We believe that the bug you reported is fixed in the latest version of
systemd, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 834367@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Pitt <mpitt@debian.org> (supplier of updated systemd package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 18 Aug 2016 07:03:13 +0200
Source: systemd
Binary: systemd systemd-sysv systemd-container systemd-journal-remote systemd-coredump libpam-systemd libnss-myhostname libnss-mymachines libnss-resolve libsystemd0 libsystemd-dev udev libudev1 libudev-dev udev-udeb libudev1-udeb
Architecture: source
Version: 231-4
Distribution: unstable
Urgency: medium
Maintainer: Debian systemd Maintainers <pkg-systemd-maintainers@lists.alioth.debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description:
 libnss-myhostname - nss module providing fallback resolution for the current hostname
 libnss-mymachines - nss module to resolve hostnames for local container instances
 libnss-resolve - nss module to resolve names via systemd-resolved
 libpam-systemd - system and service manager - PAM module
 libsystemd-dev - systemd utility library - development files
 libsystemd0 - systemd utility library
 libudev-dev - libudev development files
 libudev1   - libudev shared library
 libudev1-udeb - libudev shared library (udeb)
 systemd    - system and service manager
 systemd-container - systemd container/nspawn tools
 systemd-coredump - tools for storing and retrieving coredumps
 systemd-journal-remote - tools for sending and receiving remote journal logs
 systemd-sysv - system and service manager - SysV links
 udev       - /dev/ and hotplug management daemon
 udev-udeb  - /dev/ and hotplug management daemon (udeb)
Closes: 834367
Changes:
 systemd (231-4) unstable; urgency=medium
 .
   * Revert "pid1: reconnect to the console before being re-executed"
     This unbreaks consoles after "daemon-reexec". (Closes: #834367)
Checksums-Sha1:
 b6ac3a04410016d97150cb2791d814d2feb30cf9 4413 systemd_231-4.dsc
 ebda42424480d9817ff921d8a5dc301c2acfe30b 122396 systemd_231-4.debian.tar.xz
Checksums-Sha256:
 ce8d40209d9adcf5f8ddd4f3f1cc3d717cf7869d0ff717fa195a55b5bf52a2be 4413 systemd_231-4.dsc
 de75e3b491e2bacd8930e5d1ba701487a383ee315f40575331bbfec27c427a72 122396 systemd_231-4.debian.tar.xz
Files:
 6471f6f9fb04d676b56a4d678e554ded 4413 admin optional systemd_231-4.dsc
 0c12705870846e9299f81dc77a941265 122396 admin optional systemd_231-4.debian.tar.xz

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXtUG/AAoJENFO8V2v4RNH3aIQAK7VQvf7PzGVRFoImrkEPQcW
ruS/66uddUM7+q6SeCSJKS17yKxwS3E/wLiwX8P8IDCubFI2JnY6EE7zIaSD57F4
WKj46K+TqjTdnm0Pp/s+vVNfIaRNMJ6m2HJELj5xhZ639POplcNFMpH69R4Q8Dze
THRMTT3Q9AFXNOtwJSNqJNsd6fJs15i4PFjLOpETBuGq2DmoKgzbzFv+6rrZ6PVW
4eRRHtlb8CxGgDGHxq1atal1Jv8DlBSLG95flY0cZBewn6XVI+Ud6pRjex/fjhIM
YW7bAqgtpHoV4uBiJ5YgiFAZb7S5w2jPhzs0KILnG8tJMZHmJ108xeMbpbsCP8uy
weWfHiybrhQak+09SGH81IIS87L96NOjRbgaHT4oFyozpxSdcb/uigQzqySjppta
YZK3RUsRLpTvE0HT/x3cF1MkFznxRNHqwIQP1xLGZuKkhNoU3Zr9l2ewE2mxYfyO
yneP8+FvmRLwjtX1UBAJRnPbvAAVT4063I9N7rGfQZl262A8+0b5Iinbsd/35Ipg
IJUHU+e5d7ejIebtcHnh1RFkZ7lnXnQFrFhUbyRsrJgvnwnSrGzCvIvjvAQR7Ctw
MmdVOsX+7InrqJaIdKbzCVI+XQ+1l5MdIiuzLF/NYpaX802my7174CrY5RK5jvPN
AH+n4993YohDFrJJ2wtA
=nwRs
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.