#755943 nautilus: 'gksu nautilus' changes the whole desktop to a different user in special cases

Package:
nautilus
Source:
nautilus
Description:
file manager and graphical shell for GNOME
Submitter:
Christian Meyer
Date:
2014-07-24 19:15:06 UTC
Severity:
important
#755943#5
Date:
2014-07-24 19:12:23 UTC
From:
To:
Hello there,

I found a remarkable bug with nautilus (and letting it manage the desktop) in
version 3.4.2 (stable).

1. Log in as a user (e.g. abc) that doesn't 'have file manager handle the
desktop' (gnome-tweak-tool).
2. Now 'gksu nautilus' in a terminal window as a different user (e.g. xyz) that
has the mentioned option enabled.

You now see abc's desktop vanishing and xyz's desktop appear with all its files
and directories(beside opening the intended nautilus window). Everything you do
on the desktop is under xyz's name.

3. Close the intended nautilus window. You now may abort the waiting (not
finished) gksu command and / or close the terminal window.

Xyz's desktop keeps visible and functional. Everything you do within it is in
xyz's name.

Somehow it's a cool feature being 'logged in as two users' in the same UI. :)
But since this obviousy is not intended it mostly is a security bug. :(

Christian Meyer