Bug 151918 - xscreensaver won't allow root to unlock screen
Summary: xscreensaver won't allow root to unlock screen
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: xscreensaver
Version: 4.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Ray Strode [halfline]
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2005-03-23 15:39 UTC by Kathy Whyte
Modified: 2007-11-30 22:07 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-03-23 16:29:14 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Kathy Whyte 2005-03-23 15:39:13 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.5) Gecko/20041215 Firefox/1.0 Red Hat/1.0-12.EL4

Description of problem:
If a user locks the screen, entering the root password into xscreensaver fails to unlock the screen.

Version-Release number of selected component (if applicable):
xscreensaver-4.18

How reproducible:
Always

Steps to Reproduce:
1.log in as any user
2.run xscreensaver/xlock
3.try to unlock the screen with the root password
  

Actual Results:  The root account is denied unlocking the screen from entering his password on the screen.

Expected Results:  Root should be able to unlock the screen from the screen.

Additional info:

I have found that if I obtain the source rpm and recompile minus the xscreensaver-4.06-rh.patch
patch and install the program with setuid root: -r-sr-xr-x root 
The root can then enter root's password at the screen and unlock it.

Comment 1 Ray Strode [halfline] 2005-03-23 16:29:14 UTC
Hi Kathy,
we don't currently support unlocking the screen as root using this mechanism. 
This is a very big security hole because any user could write a program that
mimics the appearance of xscreensaver's lock dialog and record the root password
when an admin comes by and unlocks the screen.

You can terminate a user's session at any time by pressing ctrl-alt-backspace. 
You can unlock a user's session at any time by pressing ctrl-alt-f1, logging in
as root, an killing their copy of xscreensaver.  

Hope that helps.


Note You need to log in before you can comment on or make changes to this bug.