Hacker News new | past | comments | ask | show | jobs | submit login

Can anyone explain why a crash in xscreensaver results in the computer being unlocked?

It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.




KDE has a failsafe mechanism. If the screen locker has crashed, it shows a black screen of death with a huge error message.

> The screen locker is broken and unlocking is not possible anymore. In order to unlock, switch to a virtual terminal (e.g. Ctrl+Alt+F2), log in and execute the command: "loginctl unlock session c2". Afterwards switch back to the running session.

I think it's a reasonable design.


No, it's not failsafe. I know a person where only one screen of two got locked, the second one remained operational.


Okay, let's call it an "incomplete failsafe". I don't want to discuss the correct terminology, but the idea itself.


That might be a kde limitation in general. The amount of "fun" I had dealing with two screens on kde is outright endless. Not sure they even test that kind of configuration, 640x480 pixels should be enough for everyone.


I'm using 3 monitors on KDE with Debian currently and it's been fine for me.

All screens lock together etc.


Now imagine they're powered by a docking station, you go into suspend, put the laptop out of the docking station, wake it up and - tadaa! This bug dissappeared but still occurs slightly diffrent for other people. Three monitors itself aren't more edgecase than 2. How long are you using this setup?

Besides screenlockers, having 2 screens with diffrent resolutions is way worse in KDE than in GNOME. (On X11)


I'm sure they're referring to the failsafe.


I don't believe the X system had/has a separate protocol for screen locking, or if it does, that any of the programs implement it. So xscreensaver is just another X client that happens to draw itself full-screen on top of all other apps and grab all user input.

From the point of view of the display manager, a screensaver/screenlocker crashing is just a simple app crash. There's nothing in the protocol to suggest that this is a security failure.


You don't need special X support for having a lightweight process monitor.

I'm imagining 2 processes:

1. Process monitor shows a fullscreen black window. Launches xscreensaver --lock or something as a child process

2. Xscreensaver shows the lock screen over the top of the process monitor, with a password prompt

When the correct password is entered, xscreensaver signals to its parent process. Then both processes close gracefully.

If xscreensaver crashes without signalling, the process manager silently restarts xscreensaver.

None of that requires any changes to X. You'd just want to be sure xscreensaver is displayed on top of the process manager's black window.


jwz wrote a document explaining why this is hard. (Note that this link may result in an unsavoury redirect if you click on it from here. You can, e.g. copy and paste it to avoid this.)

https://www.jwz.org/xscreensaver/toolkits.html


From the point of view of the display manager

Argh. That would be the window manager, of course.


xscreensaver + light-locker should be okay, there is no virtual keyboard.

There is also xsecurelock [1] by Google.

[1] https://github.com/google/xsecurelock


> and re-launch it if it crashes without first signalling that the desktop has been unlocked.

Might be better to just exit the session or load a minimalistic replacement lock program (like the original xscreensaver) to avoid an infinite crash loop.


Maybe! An infinite crash loop is also usually better than a security vulnerability, so I think it would be a win even without that.

Also this bug (and probably most other bugs xscreensaver has had over the years) wouldn't result in an infinite crash loop anyway.


I believe that's how JWZ's XScreenSaver works, but every distro decided to re-invent the wheel there for whatever reason, then blame it all on X11 when it inevitably fails.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: