Package: gnome-search-tool
Version: 2.30.0-2
Severity: minor
The "Help" in Places->Search for Files... starts by mentioning that
the search is implemented using UNIX commands find, grep and locate. A
large number of users are not familiar with these tools and thus can
not figure out the important implication: your search term history is
visible to all other users of the system through the process list!
To draw attention to this problem I quickly hacked together a program
that logs what other people are searching for using inotify:
Tue Jun 28 13:38:48 2011 lindi started a search (10726) for /home/lindi/ (
-iname *.py -o -iname .py ) ! -type p -exec grep -i -I -c secret stuff {} ;
-print
Tue Jun 28 13:39:01 2011 search (11853) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xpra/parti-all-0.0.7.21+20110601r67/debian/tmp/usr/lib/python2.5/site-packages/wimpiggy/test.py
Tue Jun 28 13:39:03 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:04 2011 search (11995) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/getlabel.py
Tue Jun 28 13:39:05 2011 search (12198) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/build/install-utils_amd64/usr/lib/xen-4.0/lib/python/xen/xm/main.py
Tue Jun 28 13:39:05 2011 search (12208) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/build/install-utils_amd64/usr/lib/xen-4.0/lib/python/xen/xend/XendDomainInfo.py
Tue Jun 28 13:39:05 2011 search (12208) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/build/install-utils_amd64/usr/lib/xen-4.0/lib/python/xen/xend/XendDomainInfo.py
Tue Jun 28 13:39:09 2011 search (12600) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/build/build-utils_amd64/tools/python/build/lib.linux-x86_64-2.5/xen/xm/setenforce.py
Tue Jun 28 13:39:09 2011 search (12600) is reading -i -I -c secret stuff
/home/lindi/debian/debian-xen/xen-4.0.1/debian/build/build-utils_amd64/tools/python/build/lib.linux-x86_64-2.5/xen/xm/setenforce.py
Tue Jun 28 13:38:48 2011 lindi's search (10726) completed in 21 seconds
import asyncore, pyinotify, psutil, time
class HandleEvents(pyinotify.ProcessEvent):
def __init__(self):
self.running_searches = {}
def process_IN_ACCESS(self, event):
live_pids = psutil.get_pid_list()
for pid in live_pids:
if pid in self.running_searches:
self.running_searches[pid]["end_time"] = time.time()
continue
try:
proc = psutil.Process(pid)
if len(proc.cmdline) > 0:
if proc.cmdline[0] == 'find':
self.running_searches[pid] = {}
self.running_searches[pid]["start_time"] = time.time()
self.running_searches[pid]["end_time"] = self.running_searches[pid]["start_time"]
self.running_searches[pid]["proc"] = proc
print("%s %s started a search (%d) for %s" % (time.asctime(time.localtime(self.running_searches[pid]["start_time"])),
proc.username,
pid,
" ".join(proc.cmdline[1:])))
elif proc.cmdline[0] == 'grep':
print("%s search (%d) is reading %s" % (time.asctime(),
pid,
" ".join(proc.cmdline[1:])))
except psutil.error.NoSuchProcess:
continue
for pid in list(self.running_searches):
if pid not in live_pids:
s = self.running_searches[pid]
print("%s %s's search (%d) completed in %d seconds" % (time.asctime(time.localtime(s["start_time"])),
s["proc"].username,
pid,
s["end_time"] - s["start_time"]))
del self.running_searches[pid]
if __name__ == "__main__":
wm = pyinotify.WatchManager()
notifier = pyinotify.AsyncNotifier(wm, HandleEvents())
wdd = wm.add_watch('/lib', pyinotify.IN_ACCESS, rec=True)
asyncore.loop()
-- System Information:
Debian Release: 6.0.1
APT prefers stable
APT policy: (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores)
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages gnome-search-tool depends on:
ii gconf2 2.28.1-6 GNOME configuration database syste
ii gnome-utils-common 2.30.0-2 data files for the GNOME utilities
ii libatk1.0-0 1.30.0-1 The ATK accessibility toolkit
ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib
ii libcairo2 1.8.10-6 The Cairo 2D vector graphics libra
ii libfontconfig1 2.8.0-2.1 generic font configuration library
ii libfreetype6 2.4.2-2.1 FreeType 2 font engine, shared lib
ii libgconf2-4 2.28.1-6 GNOME configuration database syste
ii libglib2.0-0 2.24.2-1 The GLib library of C routines
ii libgtk2.0-0 2.20.1-2 The GTK+ graphical user interface
ii libice6 2:1.0.6-2 X11 Inter-Client Exchange library
ii libpango1.0-0 1.28.3-1+squeeze2 Layout and rendering of internatio
ii libsm6 2:1.1.1-1 X11 Session Management library
ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime
gnome-search-tool recommends no packages.
Versions of packages gnome-search-tool suggests:
ii yelp 2.30.1+webkit-1 Help browser for GNOME
-- no debconf information
