Red Hat Bugzilla – Bug 151918
xscreensaver won't allow root to unlock screen
Last modified: 2007-11-30 17:07:17 EST
From Bugzilla Helper: User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041215 Firefox/1.0 Red Hat/1.0-12.EL4 Description of problem: If a user locks the screen, entering the root password into xscreensaver fails to unlock the screen. Version-Release number of selected component (if applicable): xscreensaver-4.18 How reproducible: Always Steps to Reproduce: 1.log in as any user 2.run xscreensaver/xlock 3.try to unlock the screen with the root password Actual Results: The root account is denied unlocking the screen from entering his password on the screen. Expected Results: Root should be able to unlock the screen from the screen. Additional info: I have found that if I obtain the source rpm and recompile minus the xscreensaver-4.06-rh.patch patch and install the program with setuid root: -r-sr-xr-x root The root can then enter root's password at the screen and unlock it.
Hi Kathy, we don't currently support unlocking the screen as root using this mechanism. This is a very big security hole because any user could write a program that mimics the appearance of xscreensaver's lock dialog and record the root password when an admin comes by and unlocks the screen. You can terminate a user's session at any time by pressing ctrl-alt-backspace. You can unlock a user's session at any time by pressing ctrl-alt-f1, logging in as root, an killing their copy of xscreensaver. Hope that helps.