Hi!

The bug is probably the same as reporte on OpenSUSE-bugs: http://lists.opensuse.org/archive/opensuse-bugs/2014-02/msg02515.html

User A is sudo user
User B is a normal user

A is logged in. B want to user the PC in a secure and confidential manner, A lends the PC to B. B logs in, do stuff recorded in encrypted home, logs out, give back the PC to A thinking all his activity in home dir is encrypted and safe.

But the home directory of the normal system user B that has just logged out is still readable by the sudo user A, who can read everything including still valid session cookies etc.

Hence encrypts is a bit useless for shared computers.

Thank you.

jerome@jerome.cc

severity 756450 important
--

Looking at https://www.debian.org/Bugs/Developer#severities they define critical
(and grave) as ``*introduces* a security hole'', so I agree with you of the importance
of this bug, but I see this as an inherent security flaw that needs to get addressed,
rather then a critical bug that has appeared.

This definition becomes important when considering that debian automatically drops
packages from testing that have critical, grave, or serious marked against them and
has already dropped ecryptfs from testing because of this bug.

As this (will) effects a lot of people, including myself who can no longer access their
files, and I see no response to this bug, I have dropped the severity to important,
both because in terms of description, it best fits the bug, given that this doesn't effect
how the package worked before; and because it gives it the highest severity without
tripping out the automation routines.

@Package Maintainers, feel free to give and exercise a different view as you see fit, I
hope I haven't overstepped the mark.