[BUG]1 macbook, 2 users, Macro run inside User B account has effect of machine of User A

Questions & Suggestions
1

I have a MacBook running Sierra with 2 user accounts User A is admin User B is normal.
KM is installed on User B’s account only.

I execute a Macros that does a series of Copy Paste when logged in under User B and then switch to my User A session. User B sessions is therefore running in the background.

On User A’s session, the copy-paste that should run under User B’s session occur on User A.

What sorcery is this ?

The very same problem occurs when remotely logging on User B with Team Viewer or VNC. I logged in User B, run the macro and I see the effect of it on the running User A session on the screen.

Please help :wink:

2

No idea. You should report it to Apple as it sounds like a serious security violation.

Keyboard Maestro simply simulates the key strokes, so there is no way those keystrokes should be able to find their way in to User A’s account.

If you VNC in to User B with Team Viewer, and do copy & paste that way, does that affect User A as well?

Ahh, unless you have software that is somehow sharing the clipboard, which could possibly include Apple’s new Continuity Universal Clipboard system (https://support.apple.com/en-au/HT204681).

3

I am afraid I am dealing with a much broader issue here.

After your sent me your reply I have created a macro that basically "insert text by typing", just for debugging purposes.

Bug test.kmmacros (2.7 KB)

Pasting or Typing, I have the same issue. :fearful:

I don't know how to screencast while switching users so I have made a video filming my screen, sorry I have limited technical means to do a good job.

https://youtu.be/bA2dLjjtiUo

The same issue appears when I VNC or TeamViewer on the account. No matter what accounts is logged in in the front will show impact of the macro running in the background, including the "Action Completed" sound of the macro, which is normally not possible.

It's like Keyboard Maestro is running on a superuser level and get on top of all the logged in user in terms of level of permission.

This is very strange.

I can produce more videos if you want different scenarios.

Thanks again.

4

Keyboard Maestro does not have any superuser permissions. It runs without any elevated permissions as a normal application. There is no admin install process for Keyboard Maestro, and no admin password required to run it. You might need to enter your admin password to put it in the Applications folder, but that does not give it any extra permissions.

Keyboard Maestro simply posts the events to the keyboard event queue using the normal event queue posting mechanism.

I just tried to duplicate your macro and did not get the same results. My macro inserted the text in the source account as expected and nowhere else.

How did you switch accounts without typing a password?

Is there perhaps anything else going on on your Mac?

Did you try using TeamViewer VNC to the account and entering keys that way and do those keys go to the wrong account as well.

5

Yes I do hope this problem only occurs on my Mac.

I have done it thru both VNC and Team Viewer, logged in to the user account with KM installed, and same result.

I can switch to the other account because this is a test account I created for debugging purposes and it is not password protected.

What I will do is create a new pristine admin acount, install KM on it and run the test again.

6

I have created 2 non-admin accounts and installed KM on one of them.
I have the exact same bug.

7

Instead of the Insert Text, what happens if you use the AppleScript:

tell application "System Events"
	keystroke "a"
end tell

Does that behave the same?

8

Not quite the same problem, but still strange, I have modified the script a little bit to allow user switching.

What happens is that the "a" is not typed in the background user session but I hear the error sound on the frontmost running session after switching.

https://www.youtube.com/watch?v=JpJGJSz7lkA

At this point, I think my Sierra has a problem, although I don't really see what it is. Perhaps I should reinstall my whole system.

9

I really have no idea I’m afraid - I would have said what you describe was impossible, yet clearly it is happening. It points to a gaping hole in the security of your system, which is not something Keyboard Maestro can accomplish since it lives within the confines of your user account.

10

Hello,
I have just installed a fresh copy of High Sierra, then a brand new try-out copy of KM8 and this bug still occurs.
This was not due to my old system.
I really don’t understand what is going on.
Please help,
Thank you so much

11

If Keyboard Maestro, without any extra permissions (which it does not have), simulating keystrokes on one account, is typing keys into another account, then that is a significant security violation which you should report to Apple.

Keyboard Maestro does not run with any extra permissions, does not install any privileged helper tools (except temporarily for upgrades), so it should not be able to access any other account, or influence it’s behaviour in any way. Keyboard Maestro simply adds keys to the event queue.

Either something in your system is passing the keys through from one account to the other, or there is something very broken in the system handling of the event queue.

But there is nothing Keyboard Maestro can do differently in this regard - what you show should be impossible.

Unless you have some hardware or software installed that is intercepting and redirecting the event queue keys, I have no idea what might be going on.