Package: gnome-search-tool Version: 2.30.0-2 Severity: minor The "Help" in Places->Search for Files... starts by mentioning that the search is implemented using UNIX commands find, grep and locate. A large number of users are not familiar with these tools and thus can not figure out the important implication: your search term history is visible to all other users of the system through the process list!
To draw attention to this problem I quickly hacked together a program that logs what other people are searching for using inotify: Tue Jun 28 13:38:48 2011 lindi started a search (10726) for /home/lindi/ ( -iname *.py -o -iname .py ) ! -type p -exec grep -i -I -c secret stuff {} ; -print Tue Jun 28 13:39:01 2011 search (11853) is reading -i -I -c secret stuff /home/lindi/debian/debian-xpra/parti-all-0.0.7.21+20110601r67/debian/tmp/usr/lib/python2.5/site-packages/wimpiggy/test.py Tue Jun 28 13:39:03 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11993) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:04 2011 search (11995) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/xen-utils-4.0/usr/lib/xen-4.0/lib/python/xen/xm/getlabel.py Tue Jun 28 13:39:05 2011 search (12198) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/build/install-utils_amd64/usr/lib/xen-4.0/lib/python/xen/xm/main.py Tue Jun 28 13:39:05 2011 search (12208) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/build/install-utils_amd64/usr/lib/xen-4.0/lib/python/xen/xend/XendDomainInfo.py Tue Jun 28 13:39:05 2011 search (12208) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/build/install-utils_amd64/usr/lib/xen-4.0/lib/python/xen/xend/XendDomainInfo.py Tue Jun 28 13:39:09 2011 search (12600) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/build/build-utils_amd64/tools/python/build/lib.linux-x86_64-2.5/xen/xm/setenforce.py Tue Jun 28 13:39:09 2011 search (12600) is reading -i -I -c secret stuff /home/lindi/debian/debian-xen/xen-4.0.1/debian/build/build-utils_amd64/tools/python/build/lib.linux-x86_64-2.5/xen/xm/setenforce.py Tue Jun 28 13:38:48 2011 lindi's search (10726) completed in 21 seconds
import asyncore, pyinotify, psutil, time class HandleEvents(pyinotify.ProcessEvent): def __init__(self): self.running_searches = {} def process_IN_ACCESS(self, event): live_pids = psutil.get_pid_list() for pid in live_pids: if pid in self.running_searches: self.running_searches[pid]["end_time"] = time.time() continue try: proc = psutil.Process(pid) if len(proc.cmdline) > 0: if proc.cmdline[0] == 'find': self.running_searches[pid] = {} self.running_searches[pid]["start_time"] = time.time() self.running_searches[pid]["end_time"] = self.running_searches[pid]["start_time"] self.running_searches[pid]["proc"] = proc print("%s %s started a search (%d) for %s" % (time.asctime(time.localtime(self.running_searches[pid]["start_time"])), proc.username, pid, " ".join(proc.cmdline[1:]))) elif proc.cmdline[0] == 'grep': print("%s search (%d) is reading %s" % (time.asctime(), pid, " ".join(proc.cmdline[1:]))) except psutil.error.NoSuchProcess: continue for pid in list(self.running_searches): if pid not in live_pids: s = self.running_searches[pid] print("%s %s's search (%d) completed in %d seconds" % (time.asctime(time.localtime(s["start_time"])), s["proc"].username, pid, s["end_time"] - s["start_time"])) del self.running_searches[pid] if __name__ == "__main__": wm = pyinotify.WatchManager() notifier = pyinotify.AsyncNotifier(wm, HandleEvents()) wdd = wm.add_watch('/lib', pyinotify.IN_ACCESS, rec=True) asyncore.loop()
-- System Information: Debian Release: 6.0.1 APT prefers stable APT policy: (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores) Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Versions of packages gnome-search-tool depends on: ii gconf2 2.28.1-6 GNOME configuration database syste ii gnome-utils-common 2.30.0-2 data files for the GNOME utilities ii libatk1.0-0 1.30.0-1 The ATK accessibility toolkit ii libc6 2.11.2-10 Embedded GNU C Library: Shared lib ii libcairo2 1.8.10-6 The Cairo 2D vector graphics libra ii libfontconfig1 2.8.0-2.1 generic font configuration library ii libfreetype6 2.4.2-2.1 FreeType 2 font engine, shared lib ii libgconf2-4 2.28.1-6 GNOME configuration database syste ii libglib2.0-0 2.24.2-1 The GLib library of C routines ii libgtk2.0-0 2.20.1-2 The GTK+ graphical user interface ii libice6 2:1.0.6-2 X11 Inter-Client Exchange library ii libpango1.0-0 1.28.3-1+squeeze2 Layout and rendering of internatio ii libsm6 2:1.1.1-1 X11 Session Management library ii zlib1g 1:1.2.3.4.dfsg-3 compression library - runtime gnome-search-tool recommends no packages. Versions of packages gnome-search-tool suggests: ii yelp 2.30.1+webkit-1 Help browser for GNOME -- no debconf information