Red Hat Bugzilla – Bug 151918
xscreensaver won't allow root to unlock screen
Last modified: 2007-11-30 17:07:17 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041215 Firefox/1.0 Red Hat/1.0-12.EL4
Description of problem:
If a user locks the screen, entering the root password into xscreensaver fails to unlock the screen.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.log in as any user
3.try to unlock the screen with the root password
Actual Results: The root account is denied unlocking the screen from entering his password on the screen.
Expected Results: Root should be able to unlock the screen from the screen.
I have found that if I obtain the source rpm and recompile minus the xscreensaver-4.06-rh.patch
patch and install the program with setuid root: -r-sr-xr-x root
The root can then enter root's password at the screen and unlock it.
we don't currently support unlocking the screen as root using this mechanism.
This is a very big security hole because any user could write a program that
mimics the appearance of xscreensaver's lock dialog and record the root password
when an admin comes by and unlocks the screen.
You can terminate a user's session at any time by pressing ctrl-alt-backspace.
You can unlock a user's session at any time by pressing ctrl-alt-f1, logging in
as root, an killing their copy of xscreensaver.
Hope that helps.