Bug 151918

Summary:	xscreensaver won't allow root to unlock screen
Product:	Red Hat Enterprise Linux 4	Reporter:	Kathy Whyte <kaw>
Component:	xscreensaver	Assignee:	Ray Strode [halfline] <rstrode>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	4.0
Target Milestone:	---
Target Release:	---
Hardware:	i386
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2005-03-23 16:29:14 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Kathy Whyte 2005-03-23 15:39:13 UTC

From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041215 Firefox/1.0 Red Hat/1.0-12.EL4

Description of problem:
If a user locks the screen, entering the root password into xscreensaver fails to unlock the screen.

Version-Release number of selected component (if applicable):
xscreensaver-4.18

How reproducible:
Always

Steps to Reproduce:
1.log in as any user
2.run xscreensaver/xlock
3.try to unlock the screen with the root password
  

Actual Results:  The root account is denied unlocking the screen from entering his password on the screen.

Expected Results:  Root should be able to unlock the screen from the screen.

Additional info:

I have found that if I obtain the source rpm and recompile minus the xscreensaver-4.06-rh.patch
patch and install the program with setuid root: -r-sr-xr-x root 
The root can then enter root's password at the screen and unlock it.

Comment 1 Ray Strode [halfline] 2005-03-23 16:29:14 UTC

Hi Kathy,
we don't currently support unlocking the screen as root using this mechanism. 
This is a very big security hole because any user could write a program that
mimics the appearance of xscreensaver's lock dialog and record the root password
when an admin comes by and unlocks the screen.

You can terminate a user's session at any time by pressing ctrl-alt-backspace. 
You can unlock a user's session at any time by pressing ctrl-alt-f1, logging in
as root, an killing their copy of xscreensaver.  

Hope that helps.