Sensitive plasmashell notification text found in system journal

Physicist1616 · 2017-10-30 22:39:04

Do all desktop notifications go into the journal? Is this default behavior? I found one-side of some private Skype conversations as well as some Slack conversations with `journalctl`.

Oct 30 12:32:03 host plasmashell[859]:  New Notification:  "Wife" "I love you" -1 & Part of: 0

How can I stop Plasma from doing this and does upstream know it happens, or is it some aspect of how the program (rambox in this case) interacts with the desktop notification engine?

cfr · 2017-10-31 02:56:16

Physicist1616 wrote:

Do all desktop notifications go into the journal?

No. I have custom desktop notifications which do not appear in the journal.

Physicist1616 · 2017-10-31 08:56:39

cfr wrote:

No. I have custom desktop notifications which do not appear in the journal.

Just to confirm, you're on plasma as well?

seth · 2017-10-31 13:08:52

https://www.archlinux.org/packages/extr … gsettings/ ?

cfr · 2017-10-31 13:34:26

Physicist1616 wrote:

cfr wrote:
No. I have custom desktop notifications which do not appear in the journal.
Just to confirm, you're on plasma as well?

Yes. I'm using Plasma as well. I use notify-send for some custom desktop notifications. These are triggered by a script in ~/bin. I've never seen these in the journal and I checked when you asked your question that (1) nothing appeared in the journal and (2) at least one such notification had been triggered since I rebooted the machine. (I checked just in case I'd always overlooked these in the past. That didn't seem very likely, but it wouldn't have mattered to me if they were in the journal, so I double-checked to be sure.)

These do not show in the journal at all - neither the system journal nor the user one.

seth · 2017-10-31 13:40:19

Does plasma provide different notification applets?
cfr, I assume you're not secretly using dunst? ;-)

cfr · 2017-10-31 23:35:54

seth wrote:

Does plasma provide different notification applets?
cfr, I assume you're not secretly using dunst? ;-)

Er ... not that I know of. Might I be doing so inadvertently? What is it?

You mean https://wiki.archlinux.org/index.php/Dunst? In that case, definitely not. pacman does not list it as installed, which is not surprising. I'd be alarmed if it were.

Last edited by cfr (2017-10-31 23:38:57)

cfr · 2017-10-31 23:44:49

I need to correct something. I said above that they did not show in either the system or the user journal. However, this isn't correct. They do show in the user journal. However, they do not show in the system journal. Apologies for this. I was sure I'd checked both, but I must have checked the system journal twice by mistake.

Is the concern about them showing in even the user journal? Or do they show in the system journal as well?

I suspect that the notifications you're seeing in the journal are only visible to you. This might still bother you, but, if the concern is that other users may see that information, I don't think that's the case. Rather, those users will see notifications plasmashell displays for them.

The journal is split into system and user-specific files. What you can read depends on the usual file permissions etc. Looking at the permissions:

drwxr-sr-x+ 2 root systemd-journal 4.0K Hyd  22 21:55  ./
drwxr-sr-x+ 4 root systemd-journal 4.0K Hyd   1 12:47  ../
-rw-r-----+ 1 root systemd-journal  56M Tach  1 02:19  system.journal
-rw-r-----+ 1 root systemd-journal 112M Tach  1 02:38  user-1234.journal

# file: var/log/journal/0XXX/system.journal
# owner: root
# group: systemd-journal
user::rw-
group::r-x                      #effective:r--
group:adm:r--
group:wheel:r--
mask::r--
other::---

So, for a start, only users in systemd-journal can read these files. This may or may not include you and/or other users. However, ACLs are also in use here:

# file: var/log/journal/0XXX/user-1234.journal
# owner: root
# group: systemd-journal
user::rw-
user:username:r--
group::r-x      #effective:r--
group:adm:r-x   #effective:r--
group:wheel:r-x #effective:r--
mask::r--
other::---

I find it a bit odd that members of the systemd-journal should have access to the journals of users, rather than just the system logs. Nonetheless, this users aren't in this group by default. (Interestingly, you no longer need to be in this group to read the system logs, as ACLs are used to give access to members of the wheel group.) The same goes for wheel and adm, of course. By default, therefore, users have access only to their own logs and journalctl will show them neither notifications specific to you nor any other messages posted to the system or your personal journal files.

How reassuring or otherwise this is obviously depends on your particular concerns and context.

Last edited by cfr (2017-11-01 02:52:31)

seth · 2017-11-01 07:23:06

Yes, dunst is a standalone notification daemon, no it's not required on plasmashell.

Has either of you tried on the plasmashell debug settings? (see comment #4)

Logging notifications from the display daemon is rather weird, the normal approach would be that the client decides whether to log and/or notify an incident - some IRC clients cause a notifcation for every message (eg. while the mainwindow is hidden) so you'd end up recording an entire chat in your journal ...

cfr · 2017-11-01 22:23:50

seth wrote:

Yes, dunst is a standalone notification daemon, no it's not required on plasmashell.
Has either of you tried on the plasmashell debug settings? (see comment #4)
Logging notifications from the display daemon is rather weird, the normal approach would be that the client decides whether to log and/or notify an incident - some IRC clients cause a notifcation for every message (eg. while the mainwindow is hidden) so you'd end up recording an entire chat in your journal ...

KDE logs everything. It is ridiculous. The noise to signal ratio is so high the logs are useless unless you know something specific to search for. An entire chat would be drowned out in the general din.

Isn't this controlled partly by systemd via journald config?

Last edited by cfr (2017-11-01 22:29:18)

Arch Linux

#1 2017-10-30 22:39:04

Sensitive plasmashell notification text found in system journal

#2 2017-10-31 02:56:16

Re: Sensitive plasmashell notification text found in system journal

#3 2017-10-31 08:56:39

Re: Sensitive plasmashell notification text found in system journal

#4 2017-10-31 13:08:52

Re: Sensitive plasmashell notification text found in system journal

#5 2017-10-31 13:34:26

Re: Sensitive plasmashell notification text found in system journal

#6 2017-10-31 13:40:19

Re: Sensitive plasmashell notification text found in system journal

#7 2017-10-31 23:35:54

Re: Sensitive plasmashell notification text found in system journal

#8 2017-10-31 23:44:49

Re: Sensitive plasmashell notification text found in system journal

#9 2017-11-01 07:23:06

Re: Sensitive plasmashell notification text found in system journal

#10 2017-11-01 22:23:50

Re: Sensitive plasmashell notification text found in system journal

Board footer