https://bugzilla.redhat.com/show_bug.cgi?id=1263208
Kamil Páral <kparal(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kparal(a)redhat.com
--- Comment #10 from Kamil Páral <kparal(a)redhat.com> ---
I've been able to reproduce this problem reliably with F23 TC1 installed and
fully updated from stable repos. If you log out, it takes 20 seconds until you
can log in again. During that time, your password is not rejected, but gdm just
flashes and returns you back to login screen.
I attach a demonstration video and a full log.
Furthermore, I've been able to several times reproduce a security issue that I
can log in without knowing user's password. During the initial 20 seconds, the
user tried to input his correct password and even some incorrect passwords
several times and then possibly left the computer. I could then log in by
simply clicking on his/her username - no password prompt was shown and I was
logged in. However, I haven't found a reproducible steps for this and I haven't
managed to record this in a video. I'm not sure if it is or is not related to
this bug.
For the blocker bug nomination:
This might be a conditional violation of
" A system installed with a release-blocking desktop must boot to a log in
screen where it is possible to log in to a working desktop using a user account
created during installation or a 'first boot' utility. "
https://fedoraproject.org/wiki/Fedora_23_Alpha_Release_Criteria#Expected_...
(however, this is not after boot but after log out, and holds for 20 seconds)
or this
"Shutting down, logging out and rebooting must work using standard console
commands and the mechanisms offered (if any) by all release-blocking desktops.
"
https://fedoraproject.org/wiki/Fedora_23_Beta_Release_Criteria#Shutdown.2...
(log out does not work properly, because user can't re-log in for another 20
seconds)
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug
https://bugzilla.redhat.com/token.cgi?t=zE1RGP5Zzn&a=cc_unsubscribe