Brain dump on guest session progress

Desktop
#1

I have been working on guest account support in GDM but due to the difficulty of this this work has been shelved for now to focus on other tasks (mostly GNOME Software).

The solution I was working towards was to manage account creation in AccountsService (the previous support in LightDM had the LightDM daemon doing this). This makes the accounts easier to identify as guest accounts and means the guest account can be enable / disabled by storing a flag in AccountsService (this previously required a config file in LightDM).

We still have the issue that the display manager failing to clean up guest accounts correctly leaves them lying around. They are easier to identify once AccountsService is involved as they are flagged as guest accounts. It was discussed previously that systemd could be used for temporary accounts, but this seemed to me to be more difficult than using AccountsService.

What work exists today:

  • A patch to AccountsService in the wip/rancell/guest-accounts branch (git.freedesktop.org). This adds new D-Bus methods CreateGuest and DeleteGuest. This patch works.
  • A patch to GDM in the wip/rancell/guest branch. This allows a GDM greeter to log into a guest account by adding the D-Bus API for the greeter and passing it through the GDM layers to the core. I havenā€™t been able to get this branch to work, and I think part of the issue may be the Polkit checks in AccountsService donā€™t let GDM create the accounts (even though it is root).
  • A patch to GNOME Shell that shows a guest option on the greeter. This is a bit hacky and would need some cleaning up / restructuring to be suitable upstream.

The main difficulties I have encountered are:

  • The many layers of GDM make it very hard to work out the appropriate way to pass through the requests.
  • GNOME Shell uses the GDM interface which is very complex and not well abstracted. This means there are a number of places when it needs to be modified to interact with the guest support.
  • GNOME Shell is very tied to the AccountsService objects for showing users. My patch hacked up a compatible JS object but Shell should probably support both ā€œrealā€ users and virtual ones.
10 Likes
Guest sessions in 18.04 LTS - are they needed?
Ubuntu Security Podcast EP 48 Feedback
#2

Thatā€™s a sad message, @robert.ancell, even if I of course respect the decision to push the guest session into the background when prioritizing. Many thanks for the efforts you made.

But LightDM is still available and used by most (all?) flavors, and the guest session can be used. I just confirmed that it can be used also on an updated standard Ubuntu bionic after having switched to LightDM. So those who want to use the guest session feature can still do so.

Then there is the big but: On post 16.04 versions the guest session is not confined by AppArmor, so the original security model is broken. For some use cases this is something you can live with, while itā€™s currently considered impossible in other cases to use the guest session feature on higher versions than 16.04.

Balint Reczey has filed a bug report with a request to adapt the AppArmor profile to systemd. Not anybody can fix that bug. I suppose it needs someone with deep knowledge of the system.

So, now when we maybe wonā€™t see a guest session feature in GDM for the foreseeable future, is there possibly a chance that some developer can be assigned the task to fix the AppArmor profile for LightDM?

4 Likes
#3

We donā€™t have the required experience in the desktop team to fix the AppArmor issues but I do believe there was someone in the foundations team who was going to look into it for the GDM support. I think it was low on their priority list though.

1 Like
#4

Iā€™m sorry to hear about this TBH. I work for a NPF in London and we used to use Ubuntu for our pool computers and laptops for educational uses; wiki editathons, online courses, projects, volunteers, etc.
It was easy to set up and cheap to install on donated netbooks and laptops, etc. And would connect to our wifi securely without users having to enter a long password each time.
Weā€™ll probably have to look at another operating system to cover for these projects, as most of the course runners and staff arenā€™t tech savvy and rely on our small inhouse IT team (me) for ideas on the best way to run these courses.
I hope a guest access of some sort in the future, but for the time being, weā€™ll move back over to Windows 7 as it still has a workable guest session.

#5

Yes, I would be quite sad to see Guest account fade into the background ā€¦ Every public kiosk I ran into in NZ had Ubuntu with Guest session enabled. I use it in all of my class rooms - 120 desktops.

I understand removing it from server - keep it as part of the desktop please - even if its one of the derivatives ā€¦ like Lubuntu.

ā€œIf you want Guest on the Desktop use Lubuntuā€ ā€” I could live with this optionā€¦

dp

1 Like
#6

@sidrodrigues: Canā€™t help suspecting that there is a misunderstanding here (which may well be the result of insufficient information).

Ubuntuā€™s guest session feature is still working as specified in Ubuntu 16.04, which is still available for download and will be supported until 2021.

The current issues with the guest session is present only at later Ubuntu versions. Hence itā€™s unclear to me how it would be better for you to replace Ubuntu with Windows 7, which is an old OS (from 2009) and whose support will end in 1.5 years.

4 Likes
#7

We have student accounts set up in our classrooms (3 classrooms, ~50 machines) where we use guest logins with Ubuntu 16.04. Further, we set up model accounts where we can customize the student experience when they login so as to streamline their path to the programs and resources they use in our labs. The best feature of this is that when the students logout their persistent settings are wiped so the next student doesnā€™t have ready access to their online resources. I certainly understand that this is a limited application but given the wide deployment of machines in public spaces this is a useful feature. Possibly it could be added at some later date in the form of a sysadmin add on?

3 Likes
#8

Like @pbeeken I have clients who provide computer access to a many of their customers, which includes an owner of a major hostel in a metropolitan area. This hostel owner has hundreds of customers and their guest who pass through the lobby and has access to the public computers.

I consider it a serious security issue to the none suspecting people who may have their browser history, and other personal data inadvertently exposed to the next person. I also consider it a possible problem for malicious people who may intentionally leave something on the computer that could be a threat to other people who may access the computer after them.

This concern and exploit should be obvious. Up until recently, Ubuntu had the safest resolution against these issues.

I really hope this flaw is recognized and fixed soon.

The Guest account should be in a jail/shell that protects the computer and customerā€™s local network, and the session and all data should be wiped clean when the user logs outā€¦ just like the behavior of the guess account have always been.

ā€“ L. James

ā€“
L. D. James
ljames@apollo3.com
www.apollo3.com/~ljames

1 Like
#9

I would like to echo the remarks @ljames and @pbeeken and others have made ā€“ I help maintain a set of public computers available to the clients of a local housing shelter, and we absolutely depend on the guest session functionality in Ubuntu 16.04 LTS.

Clients use their email and social media accounts, check their bank accounts, compose resumes and other personal documents, and so forth. They need confidence that when they logout, everything is erased.

And we rely on the convenience of having all user settings restored to a default. Some clients like to reset the desktop background or change other effects, and the guest session allows us to quickly revert those simply by logging the user out when theyā€™re done.

We will be keeping an eye on #1742912 in the high hopes of seeing it resolved before the new LTS release after 18.04!

Thank you very much for this great distribution ā€“ we really hope to continue to be able to use it for our clients!

Chris.

3 Likes
#10

When setting up Kiosk type applications which have an option to let user get to desktop most people rely completely on the Guest Session. An account where the user cannot leave anything behind or access very much. The only work around is to have your kiosk application run with root privs, dynamically adding a restricted user account then deleting said account on return.

Rather than trying to hack GDM and everything else, why not create a service?

Said service would dynamically create a non-prived account which automatically logs in without password.

After new account has been idle for a settable amount of time (or logs out) service nukes the account and returns to caller of service.

Ideally service would create this non-prived account on a RAM disk so they would just have to remove the RAM disk with the user.

To me this sounds far simpler than gutting everything.

If a physical guest account must exist for some reason, itā€™s .profile can run the service for the dynamic.

#11

Ping?

Itā€™s been silent here. Has there been any progress in the last year? I see LightDMā€™s LP #742912 also hasnā€™t updated in a year. (I personally would prefer a GDM solution, but canā€™t find the bug report.)

This is an important bug since many organizations, particularly non-profits and volunteers that support vulnerable populations (elderly, poor, homeless, abused, disabled) rely on Guest Sessions to provide computer access. They are asking for a distribution which has Guest Sessions enabled by default. Is the best answer we can give still ā€œUse Ubuntu 16.04ā€?

What needs to happen to make sure that Ubuntu 20.04 has this fixed?

5 Likes
#12

Just for reference, the original GDM feature request has since been re-reported on the GNOME projectsā€™ Gitlab.

2 Likes
#15

there is a bug about confinement https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/1742912

1 Like
#16

Iā€™m just one voice, but I recently upgraded from Lubuntu 18.04 (on an old computer) to Ubuntu 20.04 (on a new computer). I sorely miss the guest session! Sometimes someone wants to use my computer, and it was the easiest thing to sign into a guest session, with me secure in the knowledge that the user couldnā€™t mess up anything, and them secure in the knowledge that all their private and confidential stuff would be erased as soon as they logged out. I hope that a solution can be found!

#17

Well, if you used guest session on Lubuntu 18.04, you did it without the original security provided by AppArmor. And if thatā€™s acceptable to your use case, you can use it on Ubuntu 20.04 as well if you install and switch to LightDM. (I recently tried it successfully on Ubuntu groovy.)

1 Like
#18

@gunnarhj ā€” Oh, no, I wasnā€™t aware of that! Thank you for pointing it out. Iā€™ll have to find a different way, some type of workaround.

#19

@paddylandau,

If your internal system is encrypted and backed up, you can let the guests use a live system booted

  1. from an external drive or
  2. using ā€˜grub-n-isoā€™, via grub and an iso file in the internal drive.

  • Whatever is created will be gone after shutdown/reboot (unless deliberately saved in a separate [external] drive).

  • The content of your internal drive will not be available (but might be overwritten if the guest cannot refrain from installing a fresh system).

2 Likes
#20

I held on to Xubuntu 16.04 as long as I could, but now I had to upgrade to version 22.04 LTS.

I find the guest-account feature very convenient for temporarily handing my laptop over to others and not surrender my private browser active sessions, bookmarks, logins, etc. etc.

In version 22.04 LTS I found out that the Firefox snap is broken under the guest-account.
See bug.

1 Like
#21

I suggest you file a bug report.
Did you try to refresh the snap?
sudo snap refresh
Then upgradeā€¦

#22

I filed the bug report that I referenced, but it was demarcated as a duplicate of a 6 year old bug in the now retired plain Ubuntu 16.04 Xenial.