Lock screen appears late after wakeup from suspend

[omgold]

Expected behaviour

When the power manager / screensaver is configured to lock the desktop when suspending the system, the display should come up from system with the lock screen or screensaver already covering the desktop.

Actual behaviour

After wakeup from suspend it takes a few seconds, with the desktop shown, before the lock screen appears.

Note: it doesn't happen when screensaver them is set to blank

Steps to reproduce the behaviour

• set lock-suspend in power manager config to true
• set lock-enabled in screensaver config to true
• set screensaver theme to something other than blank screen
• suspend system (while normal desktop is shown, not screensaver or lock screen)
• wake up system (best with monitor not having gone to standby meanwhile)

MATE general version

1.18.0

Package version

mate-power-manager 1.18.1
mate-screensaver 1.18.2

Linux Distribution

Arch

[grisu48]

I can confirm the issue, I'm having the same problem with the same packages

• community/mate-power-manager 1.18.1-1 (mate-extra)
• community/mate-screensaver 1.18.2-1 (mate-extra)

[MingcongBai]

Another confirmation, AOSC OS: MATE Screensaver 1.18.2.

[bwat47]

I can confirm this here (mate 1.20)

Note: In my case I do have screensaver set to blank

[rjaduthie]

I believe I have the same issue, or one that is closely related: when putting the desktop to Hibernate, when it wakes up the desktop is visible and responsive for a good few seconds before the lock-screen takes over and a password is requested. It is enough of a delay to allow emails to be opened and skim read, so it is a big security concern.

I am using CentOS 7.5, with Mate 1.16.2, mate-power-manager 1.16.2, mate-screensaver 1.16.1.

I also have the screensaver set to 'blank screen'.

[cu]

I see the same issue on Ubuntu MATE 18.04.

[lukefromdc]

I saw an interesting discussion on these sort of issues concerning of all things Wayland. Apparently, on X screensavers have to operate by drawing over all other windows and intercepting all keypresses etc. Thus, if anything causes that window to appear late, close when it should not, not grab the keyboard, etc, the result is a security hole in the screensaver. The hope when that story was written was that Wayland would fix that, no idea if that ever panned out or not. Anyway, this may be one reason these kinds of issues keep cropping up with screensavers.

Given that, I recommend at least logging out on any Linux system (really any system) if it must be left unattended in an untrusted environment. My encrypted systems get shut all the way down in that case due to the inability of Linux encryption to protect against the "cold boot attack" to recover keys from RAM.

[bwat47]

I've used some X screenlockers that don't seem to have this issue (or at least have it far less frequently). Namely, gnome-shell's lock screen and light-locker.

I'm not super knowledgeable on how this works behind the scenes, but afaik those ones utilize vt switching to avoid having to do the hacky 'draw over everything' approach.

[bwat47]

I've found that configuring my system to delay a few seconds before suspending (via systemd) seems to workaround this issue, giving mate-screensaver time to lock the screen before it goes into suspend:

create the file /usr/lib/systemd/system-sleep/sleep.sh

with the contents:

#!/bin/sh
case $1 in
  pre)
    /bin/sleep 2
  ;;
esac

and make the file executable (chmod 755 sleep.sh)

Now, when I close my laptop lid and re-open it, the lock screen appears without showing the contents of my desktop first

[hottwaj]

I'm experiencing this in Linuxmint 19.1 and in all previous versions of MATE that I've used :(

But, I still love MATE :)

[phocean]

Some guys already gave a lot of thoughts about all this:

https://github.com/google/xsecurelock

I often do the effort to ditch completely mate-screensaver and replace it with xsecurelock, and it works much better. And the project is actively maintained.

As a security professional, this kind of issue does matter a lot to me.

This substitution is very hacky, though. It would be much better if it was integrated by the distribution or upstream.

If no one in the project is able to work on the mate-screensaver's code, why not using xsecurelock?

[avbdr]

this issue been resolved (at least for systemd case) in https://git.xfce.org/apps/xfce4-screensaver/commit/?id=9e53bb2866f186b8f0c31198f4e8337040b2ad7c

Will be good to push the same fix for m-s.

[raveit65]

I can confirm this issue with mate-screensaver-1.22.1 running on my MSI FX700 notebook with fedora 30.
Old Notebook use only a ssd with SATA-300.
With my main box and 4 nvme drives/raid0/linux-software-raid i can't reproduce the issue.
So i guess it depends on system disk speed whether you see the locked desktop for a short moment.

[monsta]

Should be fixed now by #202

[oz123]

I've found that configuring my system to delay a few seconds before suspending (via systemd) seems to workaround this issue, giving mate-screensaver time to lock the screen before it goes into suspend:

create the file /usr/lib/systemd/system-sleep/sleep.sh

with the contents:

#!/bin/sh
case $1 in
  pre)
    /bin/sleep 2
  ;;
esac

and make the file executable (chmod 755 sleep.sh)

Now, when I close my laptop lid and re-open it, the lock screen appears without showing the contents of my desktop first

This indeed works well for suspending when closing the laptop lid. However, in ubuntu mate 18.04 there is a suspend button in the tray applet which does not work with this work around.