News for hackers. Stuff that matters.
Re:Kids find a security flaw in Linux Mint by mashing keys by josephg on Wednesday January 20, 2021 @04:42AM (#25844441)
Can anyone explain why a crash in xscreensaver results in the computer being unlocked?

It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

Re:Kids find a security flaw in Linux Mint by mashing keys by segfaultbuserr on Wednesday January 20, 2021 @04:53AM (#25844501)
KDE has a failsafe mechanism. If the screen locker has crashed, it shows a black screen of death with a huge error message.

> The screen locker is broken and unlocking is not possible anymore. In order to unlock, switch to a virtual terminal (e.g. Ctrl+Alt+F2), log in and execute the command: "loginctl unlock session c2". Afterwards switch back to the running session.

I think it's a reasonable design.

Re:Kids find a security flaw in Linux Mint by mashing keys by bionade24 on Wednesday January 20, 2021 @04:56AM (#25844522)
No, it's not failsafe. I know a person where only one screen of two got locked, the second one remained operational.
Re:Kids find a security flaw in Linux Mint by mashing keys by segfaultbuserr on Wednesday January 20, 2021 @04:58AM (#25844529)
Okay, let's call it an "incomplete failsafe". I don't want to discuss the correct terminology, but the idea itself.
Re:Kids find a security flaw in Linux Mint by mashing keys by josefx on Wednesday January 20, 2021 @05:01AM (#25844558)
That might be a kde limitation in general. The amount of "fun" I had dealing with two screens on kde is outright endless. Not sure they even test that kind of configuration, 640x480 pixels should be enough for everyone.
Re:Kids find a security flaw in Linux Mint by mashing keys by mikeyjk on Wednesday January 20, 2021 @05:28AM (#25844724)
I'm using 3 monitors on KDE with Debian currently and it's been fine for me.

All screens lock together etc.

Re:Kids find a security flaw in Linux Mint by mashing keys by bionade24 on Wednesday January 20, 2021 @01:53PM (#25850352)
Now imagine they're powered by a docking station, you go into suspend, put the laptop out of the docking station, wake it up and - tadaa! This bug dissappeared but still occurs slightly diffrent for other people. Three monitors itself aren't more edgecase than 2. How long are you using this setup?

Besides screenlockers, having 2 screens with diffrent resolutions is way worse in KDE than in GNOME. (On X11)

Re:Kids find a security flaw in Linux Mint by mashing keys by BoorishBears on Wednesday January 20, 2021 @09:03AM (#25846533)
I'm sure they're referring to the failsafe.
Re:Kids find a security flaw in Linux Mint by mashing keys by tremon on Wednesday January 20, 2021 @05:11AM (#25844609)
I don't believe the X system had/has a separate protocol for screen locking, or if it does, that any of the programs implement it. So xscreensaver is just another X client that happens to draw itself full-screen on top of all other apps and grab all user input.

From the point of view of the display manager, a screensaver/screenlocker crashing is just a simple app crash. There's nothing in the protocol to suggest that this is a security failure.

Re:Kids find a security flaw in Linux Mint by mashing keys by josephg on Wednesday January 20, 2021 @05:22AM (#25844678)
You don't need special X support for having a lightweight process monitor.

I'm imagining 2 processes:

1. Process monitor shows a fullscreen black window. Launches xscreensaver --lock or something as a child process

2. Xscreensaver shows the lock screen over the top of the process monitor, with a password prompt

When the correct password is entered, xscreensaver signals to its parent process. Then both processes close gracefully.

If xscreensaver crashes without signalling, the process manager silently restarts xscreensaver.

None of that requires any changes to X. You'd just want to be sure xscreensaver is displayed on top of the process manager's black window.

Re:Kids find a security flaw in Linux Mint by mashing keys by buckminster on Wednesday January 20, 2021 @09:03AM (#25846534)
jwz wrote a document explaining why this is hard. (Note that this link may result in an unsavoury redirect if you click on it from here. You can, e.g. copy and paste it to avoid this.)

https://www.jwz.org/xscreensaver/toolkits.html

Re:Kids find a security flaw in Linux Mint by mashing keys by tremon on Wednesday January 20, 2021 @11:44AM (#25848578)
From the point of view of the display manager

Argh. That would be the window manager, of course.

Re:Kids find a security flaw in Linux Mint by mashing keys by tux on Wednesday January 20, 2021 @05:51AM (#25844876)
xscreensaver + light-locker should be okay, there is no virtual keyboard.

There is also xsecurelock [1] by Google.

[1] https://github.com/google/xsecurelock

Re:Kids find a security flaw in Linux Mint by mashing keys by josefx on Wednesday January 20, 2021 @04:53AM (#25844500)
> and re-launch it if it crashes without first signalling that the desktop has been unlocked.

Might be better to just exit the session or load a minimalistic replacement lock program (like the original xscreensaver) to avoid an infinite crash loop.

Re:Kids find a security flaw in Linux Mint by mashing keys by josephg on Wednesday January 20, 2021 @05:17AM (#25844643)
Maybe! An infinite crash loop is also usually better than a security vulnerability, so I think it would be a win even without that.

Also this bug (and probably most other bugs xscreensaver has had over the years) wouldn't result in an infinite crash loop anyway.

Re:Kids find a security flaw in Linux Mint by mashing keys by chaganated on Wednesday January 20, 2021 @08:32AM (#25846196)
I believe that's how JWZ's XScreenSaver works, but every distro decided to re-invent the wheel there for whatever reason, then blame it all on X11 when it inevitably fails.