linux security - Mar 1997 - Re: X-Windows security hole?

Roman Garcia wrote:
>
> Hi,
> Maybe I found a hole in the security on Linux running X-Windows.
> Supose that you logged as root. If you locks the screen (at least
> using openwindows+virtual desktop and xlock), anybody can press
> <Ctrl><Alt><Backspace>, that kills the xserver, giving
the root
> prompt in the console. You can disable this in the XF86Config file,
> but anybody can press <Ctrl><Alt><Fn> and then
<Ctrl><C> killing the
> xserver and giving the root prompt.
> How can disable <Ctrl><Alt>F_n>? Are there other ways to get
root
> prompt?  How much secure is xlock?
> Thanks in advance. Roman Garcia.
There was talk about allowing a config option to disable console
switching on the XFree list. I don''t rember wether that was added or
not, and what the option would be.

There are several ways to prevent the "root" access you describe.
You could use "xdm". That way nobody has to login on a VC to start
X. If you don''t have enough memory to allow running xdm all the time,
you can type
	exec startx
instead of the normal "startx". This should log you out as soon as
the X server quits.

					Roger.

: Roman Garcia wrote:
:
: > How can disable <Ctrl><Alt>F_n>? Are there other ways to
get root
: > prompt?  How much secure is xlock?
:
: > Thanks in advance. Roman Garcia.
:

Read the paragraphs about the VTSysReq and VTInit keywords in the man
page for XF86Config, it just talks about this problem and how to solve
it.

[mod: This is the reply I was waiting for :-) Lots of people mailed
that there are several different tricks to get rid of the shell
beneath the X server. That is the same as what "exec startx" does.
This was already in the original.
Furthermore, many remarked that "hostile" access to a console off
course means that you should prevent people from booting single user
by putting passwords on lilo and the BIOS. -- REW]

--
Jorge Gonz=E1lez Villalonga <Jorge.Gonzalez@iit.upco.es>
Instituto de Investigaci=F3n Tecnol=F3gica - UPCo --- Madrid (SPAIN)
http://www.iit.upco.es/~jorgegv/
Phone: +34 15 41 96 41 --- Fax: +34 15 42 31 76