The change there seems buggy to me, warnings are useful to us for
debugging and usually don't contain private info (or are not more likely
to contain info that errors logs).

One local example (xenial)

$ journalctl -b --priority=warning | grep -i
org.freedesktop.Notifications

mars 15 16:10:03 ubuntudbg org.freedesktop.Notifications[3074]: **
(notify-osd:3450): WARNING **: stack_close_notification_handler():
notification id == 0, likely wrong

$ journalctl -b --priority=err | grep -i org.freedesktop.Notifications
$

Those sort of warning usually don't contain any sensitive info and are
very valuable in figuring issues


The bug there to me is that gdm is logging standard "stdout/info" messages and 
those are ending up in the systemd journal being considered as warnings. Those 
logs shouldn't be there in the first place or should be in a lower level, 
that's either a bug in the way gdm/gtk are logging output or in journald.

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apport in Ubuntu.
https://bugs.launchpad.net/bugs/1738581

Title:
  apport is leaking environment variables  (including passwords!) to
  public bug reports

Status in apport package in Ubuntu:
  Fix Released

Bug description:
  See the bug report 
https://bugs.launchpad.net/ubuntu/+source/evolution/+bug/1738564
  created with ubuntu-bug.

  Apport includes the file JournalErrors.txt
  This file includes e.g. the following line.
  Dez 16 19:11:31 hostname /usr/lib/gdm3/gdm-x-session[9679]: 
dbus-update-activation-environment: setting 
MPD_HOST=xxxx...@xxxx.xxxxxxxxxxx.org

  
  Normally it would be not problem that gdm-x-session write this to the 
journal, because the journal is not intended to be published on the internet. 

  Setting confidential informations via environment is maybe not the
  best idea, but a legal procedure and for `mpc` the only way to set
  this information.

  IMHO the apport utility is here the problem, because it includes the
  file with risky information to a public visible bug report.

  
  Note: I manually delete the attachment in the mentioned bug report. But how 
can I sure that a web crawlser hasn't read/preserved that attachment?

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1738581/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to     : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to