Vulnerability Development mailing list archives

Re: Possible flaw in XFree?


From: Timothy J.Miller <cerebus () sackheads org>
Date: Sat, 29 Jun 2002 15:27:22 -0500


On Friday, June 28, 2002, at 08:20 PM, Nick Lange wrote:

 I would suggest taking this up with the developers of X and Xlock,

I wouldn't. Mr. Zanatta is misunderstanding the purpose of xlock and the design of X11. In this case, the Zap keystroke combination is *not* passed to the application holding focus (xlock) unless it is disabled in the X11 configuration. IOW, X11 gets the event first, and xlock cannot-- in the normal course of Xevent flow-- supersede it.

Secondly, xlock is not intended to prevent the system from being used by another session; it simply locks the given X session.

I would suggest that the flaw here is invoking X from the command shell, not any flaw in X11 or xlock. Instead, the user should be using XDM or any of its clones.

IIRC this (and its consequences) is all detailed in both the X11 docs and xlock docs.

-- Cerebus


Current thread: