XMir receives input from other VTs

This bug has been reported on the Ubuntu Package testing tracker.

A list of all reports related to this bug can be found here:
http://packages.qa.ubuntu.com/qatracker/reports/bugs/1192843

seems high priority for 13.10

This issue has security implications. See http://mjg59.dreamwidth.org/27327.html

Status changed to 'Confirmed' because the bug affects multiple users.

It's worth noting that the Mir component - providing the infrastructure that XMir needs to do this right - is Fix Committed. XMir still needs changes to use that infrastructure before this bug is fixed.

This bug was fixed in the package mir - 0.0.10+13.10.20130827.1-0ubuntu1

---------------
mir (0.0.10+13.10.20130827.1-0ubuntu1) saucy; urgency=low

  [ Alan Griffiths ]
  * ipc: add a protocol version to the wire protocol so that we can bump
    it in future.
  * graphics::nested: Handling of output configuration changes.
  * graphics.nested: Hookup NestedDisplay to display change
    notifications.

  [ Daniel van Vugt ]
  * Introducing mir_demo_client_progressbar. It's pretty boring;
    designed to simulate key repeat scrolling in a terminal, as an aid
    for tracking down bug 1216472. . (LP: #1216472)

  [ Eleni Maria Stea ]
  * changed the GBMBufferAllocator constructor and class to use the
    gbm_device instead of the GBMPlatform to remove the dependency from
    the mg::Platform interface - this way we can use the
    GBMBufferAllocator with the NativeGBMPlatform (nested mir).

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 1025
 -- Ubuntu daily release <email address hidden> Tue, 27 Aug 2013 18:04:47 +0000

lp:~robert-ancell/mir/drop-focus-on-vt-switch is a work in progress branch that unfocuses sessions when VT switching away from them

Adding usc as affected package; this requires support from the system compositor, although that will probably come via rebuilding against new Mir libraries.

Fixed in lp:~robert-ancell/mir/pause-status + lp:~robert-ancell/unity-system-compositor/app-lifecycle.

Fix committed into lp:mir at revision None, scheduled for release in mir, milestone 0.0.11

Fix committed into lp:unity-system-compositor at revision 76, scheduled for release in unity-system-compositor, milestone Unknown

This bug was fixed in the package unity-system-compositor - 0.0.1+13.10.20130924.1-0ubuntu1

---------------
unity-system-compositor (0.0.1+13.10.20130924.1-0ubuntu1) saucy; urgency=low

  [ Robert Ancell ]
  * Get root permissions to attach lightdm and u-s-c logs. Also attach
    the .old logs. (LP: #1221506)
  * Prompt to restart after installing unity-system-compositor. (LP:
    #1221209)
  * Set lifecycle state for clients when setting the active session.
    (LP: #1192843)
  * Implement regex blacklist for supported OpenGL drivers (copied from
    Compiz blacklist). (LP: #1226713)

  [ Ubuntu daily release ]
  * Automatic snapshot from revision 77
 -- Ubuntu daily release <email address hidden> Tue, 24 Sep 2013 06:03:44 +0000

This bug was fixed in the package mir - 0.0.11+13.10.20130924.1-0ubuntu1

---------------
mir (0.0.11+13.10.20130924.1-0ubuntu1) saucy; urgency=low

  [ kg ]
  * bump version for ABI break (LP: #1229212)

  [ Robert Ancell ]
  * Allow an application to override the options being populated.
  * Pass the program options to parse_options().
  * Add missing include for std::cerr.
  * Report when paused and resumed via configuration. (LP: #1192843)
  * Add missing directory separator when searching for a config file to
    parse.

  [ Kevin Gunn ]
  * change test timeouts and fix fence.

  [ Alexandros Frantzis ]
  * examples: Only check key information for key events This fixes a
    memory error reported by valgrind for examples that use eglapp.
  * shell: Apply the base configuration on a hardware change only if no
    per-session configuration is active.
  * graphics: consolidated fixed for nested code and examples on android
    stack.

  [ Eleni Maria Stea ]
  * graphics: Pull in Eleni's changes to get the DRM fd to init GBM from
    the host Mir instance.

  [ Didier Roche ]
  * remove (unused in the ppa as we have libmirserver3) hack to force
    depending and building against the exact same version.

  [ Robert Carr ]
  * Add DPMS configuration API. (LP: #1193222)
  * Deduplicate mtd::NullDisplayConfig and
    mtd::NullDisplayConfiguration.
  * Fix multiple internal client surfaces on android. (LP: #1228144)
  * change test timeouts and fix fence.
  * Add DPMS API and GBM/android impls.

  [ Kevin DuBois ]
  * platform, graphics: support nested (mir-on-mir) rendering on the
    Android platform.

  [ Michael Terry ]
  * Change how Mir chooses socket locations to make it simpler for a
    nested-Mir world, by using MIR_SOCKET as the host socket if no other
    host socket is provided and passing MIR_SOCKET on to any children.
    Also, change --nested-mode to --host-socket for clarity and add --
    standalone to force standalone mode.

  [ Daniel d'Andrada ]
  * android-input housekeeping - Updated README - Removed some dead
    code.

  [ Daniel van Vugt ]
  * Add DPMS configuration API. (LP: #1193222)
  * Add a "flags" field to MirBufferPackage so that clients can find out
    if the buffer they've been given is scanout-capable. This is
    normally something a client should never need to know. However there
    are two specialized cases where it's required to fix bugs in the
    intel and radeon X drivers:   LP: #1218735, LP: #1218815 The intel
    fix (already landed) contains a hack which will be updated after
    this branch lands. (LP: #1218815, #1218735)
  * GBM: Ensure that we don't create scanout buffers if bypass is
    explicitly disabled from the environment. (LP: #1227133) . (LP:
    #1227133)

  [ Alan Griffiths ]
  * graphics: Pull in Eleni's changes to get the DRM fd to init GBM from
    the host Mir instance.
  * input: Separate the code for dispatching input from that reading it.
  * graphics: Hook up nested surfaces events to input.
  * input: Connect nested input relay to input dispatch.
  * graphics: Simplify NativeAndroidPlatform out of existence.
  * tests: Fixes to get the tests "passing" on android/arm stack. (LP...

cleaning up "fixed released" status

>>14
Are you certain that the changes specified in >>5 have actually happened?