Summary

It is very common to lend someone else a laptop for a quick email check, or having one's computer play music and be a surf station on a party.

We propose to set up an easily accessible guest account by default, which will have limited system access and no permanent hard disk storage. (Documents and Data are deleted on reboot): An existing user must authenticate the start of a guest session, so that it cannot be abused without the owner's knowledge.

Release Note

The user switching applet now provides an extra entry for starting a guest session. This creates a temporary passwordless user account with restricted privileges; it cannot access any regular user's home directory, or permanently store data. This is sufficiently safe to lend your laptop to someone else for a quick email check, or using it as a surf station for guests in your house.

Rationale

Common practice for many people is to create a "guest" user account with a trivial or empty or empty password, but this is a potential security threat.

A locked down guest session which is provided by default is both more secure and more accessible and convenient.

Use Cases

Requirements

Design

Implementation

Session setup

Ideally the new guest session infrastructure would use a script to wrap startup of X server, ConsoleKit registration, and gnome-session into a new binary, so that it becomes independent of old/new gdm, kdm, etc. However, this turned out to be too brittle due to countless bugs and race conditions in X drivers and the kernel, which gdm/kdm all managed to work around.

Thus we will extend gdm to allow spawning a new X server for the special :guest user (which is not a valid PAM user name and thus cannot collide with any real user). This will not ask for a password, but instead run the guest session setup scripts and start the new session immediately. Since the FLEXI_XNEST_USER and FLEXI_XSERVER_USER gdm commands only work for users which are already authenticated against gdm, this fulfills the authentication requirements from above.

In :guest mode, gdm will not run the standard /etc/gdm/Xsession script, but a wrapper shipped by gdm-guest-session which just execs the original gdm Xsession script. This wrapper script can then be covered by AppArmor rules.

UI changes

f-u-s-a will get a new entry "Start guest session"; possibly we will do the same for the logout dialog (note that we will not use the already crowded Ubuntu dialog, but the split upstream one). Both will just lock the screen and call a script from gdm-guest-session to start the guest session.

Test/Demo Plan

Outstanding Issues


CategorySpec

DesktopTeam/Specs/Intrepid/GuestAccount (last edited 2012-07-14 03:48:36 by ljeloudev)