3

I choose not to run a login manager on my systems, instead opting for a tty login and then invoking xinit manually (slightly long story, it makes my life a lot easier to have a bunch of environment tweaks that my login shell sets up and has the rest inherit), but this leaves me with a security issue if someone else comes upon my PC, because even if I've locked my X session they can switch to a tty and kill my X session, dropping back to a shell.

I can either

  1. Start running xinit; logout (which still has a race condition issue, if they get another Ctrl+C in before logout is invoked it'll give a shell)
  2. Try to disable the tty switching keys in X
  3. Wrap xinit in something to catch and ignore the signal from the Ctrl+C

Or some better solution that I've not considered.

2
  • 3
    I think if they have your computer they can do a lot more than just killing your x session. – digitxp Aug 14 '11 at 21:18
  • 1
    Sneaking in a hardware keylogger comes to mind... – user1686 Aug 14 '11 at 21:45
3
  • exec xinit will replace your shell process with xinit; it remains killable, but if it is later killed, you get dropped to the login screen.

  • setsid xinit; logout or (xinit &); logout will start xinit in background and then end the tty session immediately. This is even better – X11 cannot be ^C'ed anymore.

    (Such combinations as exec setsid xinit may work, I haven't tried.)

FWIW, some login managers do read "environment tweaks" from the standard ~/.profile; I know GDM does.

4
  • Thanks for multiple great answers! I like the fork xinit and logout option especially, I think this is what I will use. WRT login managers doing environment tweaks, my profile checks to see if we're SHLVL=1 and if we are goes off and does a whole bunch of stuff that I'm not sure will work with GDM/etc. – richo Aug 15 '11 at 2:27
  • 1
    GDM uses sh, true, but it's still fine for such things as environment variables. Checking SHLVL in ~/.profile isn't really necessary, since the file is normally read by login shells only (unlike ~/.bashrc or ~/.*rc, which apply to all shells). – user1686 Aug 15 '11 at 7:26
  • My machine is possibly incorrectly configured, as .profile is read by new terminals, and even by new sessions inside tmux. – richo Aug 16 '11 at 4:49
  • 1
    @Richo: It seems tmux creates login shells by default :( (set -g default-command bash is a workaround.) Terminals normally do not do it by default, but each terminal program has its own configuration. You were probably right in checking $SHLVL... – user1686 Aug 16 '11 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.