[Bug 2148637] Re: update-notifier: GTK notification bypasses lockscreen

[Zayd]

Note: GNOME Shell does not log lockscreen state transitions to journal 
by default. While we cannot provide direct logs of the lockscreen being 
bypassed, the absence of ANY authentication records (password, keyring, 
biometric) combined with the GTK program malfunction provides strong 
circumstantial evidence.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to update-notifier in Ubuntu.
https://bugs.launchpad.net/bugs/2148637

Title:
  update-notifier: GTK notification bypasses lockscreen

Status in update-notifier package in Ubuntu:
  New

Bug description:
  ## Problem

  When the system is locked, check-new-release-gtk (launched by update-
  notifier-release.service) attempts to display a GTK window, causing
  GNOME Shell lockscreen to be incorrectly reset. Screen unlocks without
  password.

  ## Steps to Reproduce

  1. Login to Ubuntu desktop
  2. Lock screen with Super+L
  3. Wait for update-notifier-release.service to trigger
  4. Lockscreen is bypassed

  ## Expected Behavior

  Program should detect lockscreen and delay notification

  ## Actual Behavior

  Lockscreen shield state is reset, screen unlocks automatically

  ## Logs

  Apr 17 06:00:44 update-notifier: gtk_widget_get_scale_factor: assertion 'GTK_IS_WIDGET (widget)' failed
  Apr 17 06:02:27 systemd: Starting update-notifier-release.service
  Apr 17 06:02:48 check-new-release-gtk: timeout reached, exiting
  Apr 17 06:02:48 systemd: Finished update-notifier-release.service

  ## Security Impact

  Local attacker can bypass lockscreen via physical access

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/update-notifier/+bug/2148637/+subscriptions