[Bug 1838358] Re: Ibus causes gnome-shell to freeze when password fields are selected in Firefox

Tue Aug 6 01:36:13 UTC 2019

Hi Lukasz,

We are in luck, after some very helpful debugging done by the customer, I have
been able to reliably reproduce this issue myself.

Firstly, this issue only affects users of Ubuntu inside a VMware Horizon VDI, 
and only occurs after you install the VMware Horizon Agent for Linux. 

The issue can be replicated reliably in the customer environment, and several 
hundred users have been affected.

I downloaded and installed the Horizon Agent 
VMware-horizonagent-linux-x86_64-7.9.0-13916467.tar.gz in my test 18.04 VM.

Download location [1] (Requires registration)
Installation Instructions [2]

I now see gnome-shell and firefox act strange, with a large delay in input to 
the password field and having the box clearing randomly.

The customer also sees this behaviour. If the customer enables NVIDIA GRID
graphics acceleration, then gnome-shell freezes instead of having the large 
input delay. Disabling graphics acceleration shows the behaviour I can 
reproduce, of seeing large input delay and intermittent gnome-shell lockups.

I did some digging, and it seems the Horizon agent replaces some gnome-shell
libraries with its own.

# openssl sha256 ./usr/lib/gnome-shell/libgnome-shell.so
bd86f21646db0be70139fa75879c6e56dd28b849bfc4a8ed4fae390c8baddddc
# openssl sha256 ./home/ubuntu/VMware-horizonagent-linux-x86_64-7.9.0-13916467/sso/ubuntu/1804/libgnome-shell.so
bd86f21646db0be70139fa75879c6e56dd28b849bfc4a8ed4fae390c8baddddc

# openssl sha256 ./usr/lib/vmware/viewagent/sso/backup/libgnome-shell.orig.so
381698f0554e53512c3627afd170dcd1567fa833d9a0e19fb36c0054296ead00
# openssl sha256 ./home/ubuntu/VMware-horizonagent-linux-x86_64-7.9.0-13916467/sso/ubuntu/1804/libgnome-shell.orig.so
381698f0554e53512c3627afd170dcd1567fa833d9a0e19fb36c0054296ead00

VMware Horizon has a feature called "True SSO" [3] which seems to enable users
to authenticate once to the VMware Identity Manager, and then use a SSO token
afterwards to log into supported websites.

>From what I can see, VMware have built their own custom gnome-shell libraries
and modified their library to implement the True SSO feature, which probably
uses interactions between gnome-shell and ibus to detect password input fields
and automate password entry.

When I revert the custom gnome-shell library to the one Canonical provides in
the Ubuntu 18.04 main archive, the issue is fixed, and I can enter text in
password fields normally.

>From our side, Canonical cannot support these custom gnome-shell libraries,
since we do not have source code for them and we don't know whats in them or
how they are built.

What we can do is work around them, and the proposed change to ibus does
exactly that. With those environment variables in place, input is "discarded"
by ibus and passed directly into the application, and likely skips the 
"True SSO" functionality which is breaking Firefox.

A case has now been opened with VMware so they can fix their custom gnome-shell
libraries, but for now, the ibus workaround is a agreeable solution for this
customer, mostly since they do not use the "True SSO" functionality.

I can now replicate the problem, and customer is also on board to test the
-proposed package in their environment.

I can now verify myself that the test package in my ppa works around the problem
successfully.

Lukasz, I hope that answers some of your questions.

Matthew

[1] https://my.vmware.com/group/vmware/evalcenter?p=horizon-7#tab_download
[2] https://docs.vmware.com/en/VMware-Horizon-7/7.1/com.vmware.horizon-view.linuxdesktops.doc/GUID-F06FF1A7-BDEF-4269-B2AB-C62819D4FCCD.html
[3] https://blogs.vmware.com/euc/2016/03/true-sso-single-sign-on-view-identity-manager-authenticate.html

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1838358

Title:
  Ibus causes gnome-shell to freeze when password fields are selected in
  Firefox

Status in ibus package in Ubuntu:
  Fix Released
Status in ibus source package in Bionic:
  In Progress

Bug description:
  [Impact]

  The following has been seen in a VMware Horizon VDI. I cannot reproduce this
  issue myself.

  When a user interacts with any password field in Firefox, gnome-shell
  and Firefox both freeze and the system becomes unusable. If you ssh
  into the system and terminate Firefox, gnome-shell unfreezes.

  This only happens when the environment variable GTK_IM_MODULE is set to "ibus". If you unset the variable, or change it to
  GTK_IM_MODULE=gtk-im-context-simple and then start Firefox, everything works as intended.

  This has been seen before with gnome-shell 3.28.4-0ubuntu18.04.1, ibus
  1.5.17-3ubuntu4 and Firefox versions starting with 68.0+build3-0ubuntu0.18.04.1

  Note: Chrome[ium] and other applications do not trigger it, and it cannot be
  reproduced in other desktop environments.

  This seems to be an interaction issue between ibus and gnome-shell.

  [Test Case]

  Launch firefox from within a gnome-session, making sure the
  GTK_IM_MODULE is set to "ibus". Note, this is the default value.

  $ env GTK_IM_MODULE="ibus" firefox

  Navigate to any website which has a password field. Wikipedia or
  Reddit will do.

  Click a password field and attempt to enter text. Firefox and gnome-
  shell both lock up and stay frozen for an extended period of time.

  Now, try it with the fix by enabling:

  $ env IBUS_DISCARD_PASSWORD=1 firefox

  When you enter text into a password field, ibus should directly pass through
  the text and the problem will be solved.

  We can also ask it to always apply for a specific application with:

  $ export IBUS_DISCARD_PASSWORD_APPS="firefox"
  $ firefox

  Again, when you enter text into a password input field, the problem will be
  solved.

  Test package is available here:

  https://launchpad.net/~mruffell/+archive/ubuntu/sf235370-test

  Please test with the revised version,
  1.5.17-3ubuntu4+sf235370v20190731b1.

  [Regression Potential]

  This change has a low risk of regression, because the default behaviour is
  unchanged. To be able to use the password input field discard functionality, a user has to explicitly set an environment variable for the specific process, or set a regex that matches a process name.

  This means the fix is not enabled by default on any machines, and will
  only be utilised by those suffering problems and go and manually set
  environment variables or have their system administrator enable the
  environment variables permanently.

  This commit is present in upstream ibus from version ibus-1.5.19
  onward, and is currently present in cosmic, disco and eoan.

  If a regression occurs, users can ensure that the environment
  variables are unset and continue working.

  [Other info]

  * This patch is functionally the same as ibus-xx-f19-password.patch,
  but just hides the features behind environment variables.

  * When ibus is built with the patch ibus-xx-f19-password.patch which
  was dropped in ibus-1.5.17-2, the problem is solved.

  Instead of using ibus-xx-f19-password.patch, we will instead fix it with
  upstream commit f328fd67f479faa46ca87bf3c85eed7080ec5ec0:

  https://github.com/ibus/ibus/commit/f328fd67f479faa46ca87bf3c85eed7080ec5ec0

  Subject: client/gtk2: Add IBUS_DISCARD_PASSWORD for firefox and chrome
  Author: fujiwarat <takao.fujiwara1 at gmail.com>

  This implements the password discard functionality found in
  ibus-xx-f19-password.patch and places it behind two environment variables,
  IBUS_DISCARD_PASSWORD and IBUS_DISCARD_PASSWORD_APPS.

  IBUS_DISCARD_PASSWORD is for a single process, and IBUS_DISCARD_PASSWORD_APPS
  lets you set a regex of process names to filter and enable the fix for.

  If IBUS_DISCARD_PASSWORD is set or IBUS_DISCARD_PASSWORD_APPS is set
  with the process name which input is being placed into password
  fields, ibus will pass through the input to the application without
  any processing.

  * This only affect Bionic

  - Upstream first introduction:
  $ git describe --contains  f328fd67f479faa46ca87bf3c85eed7080ec5ec0
  1.5.19~7

  - Ubuntu ibus current version found in the archive:
  $ rmadison ibus
   ==> ibus | 1.5.17-3ubuntu4   | bionic         
   ibus | 1.5.19-1ubuntu1   | cosmic         
   ibus | 1.5.19-1ubuntu2   | disco          
   ibus | 1.5.19-4ubuntu2   | eoan

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ibus/+bug/1838358/+subscriptions