/*Copyright 2014 Google Inc. All rights reserved. Licensed under the Apache License, Version 2.0 (the "License");you may not use this file except in compliance with the License.You may obtain a copy of the License at     http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, softwaredistributed under the License is distributed on an "AS IS" BASIS,WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.See the License for the specific language governing permissions andlimitations under the License.*/ /*! *\brief XSecureLock. * *XSecureLock is an X11 screen lock utility designed with the primary goal of *security. */ #include <X11/X.h>           // for Window, None, CopyFromParent#include <X11/Xatom.h>       // for XA_CARDINAL, XA_ATOM#include <X11/Xlib.h>        // for XEvent, XMapRaised, XSelectInput#include <X11/Xcms.h>        // for XcmsFailure#include <X11/Xutil.h>       // for XLookupString#include <X11/cursorfont.h>  // for XC_arrow#include <X11/keysym.h>      // for XK_BackSpace, XK_Tab, XK_o#include <fcntl.h>           // for fcntl, FD_CLOEXEC, F_GETFD#include <locale.h>          // for NULL, setlocale, LC_CTYPE#include <signal.h>          // for sigaction, raise, sa_handler#include <stdio.h>           // for printf, size_t, snprintf#include <stdlib.h>          // for exit, system, EXIT_FAILURE#include <string.h>          // for memset, strcmp, strncmp#include <sys/select.h>      // for select, timeval, fd_set, FD_SET#include <sys/time.h>        // for gettimeofday#include <time.h>            // for nanosleep, timespec#include <unistd.h>          // for _exit, chdir, close, execvp #ifdef HAVE_DPMS_EXT#include <X11/Xmd.h>  // for BOOL, CARD16#include <X11/extensions/dpms.h>#include <X11/extensions/dpmsconst.h>  // for DPMSModeOff, DPMSModeStandby#endif#ifdef HAVE_XCOMPOSITE_EXT#include <X11/extensions/Xcomposite.h>  // for XCompositeGetOverlayWindow #include "incompatible_compositor.xbm"  // for incompatible_compositor_bits#endif#ifdef HAVE_XSCREENSAVER_EXT#include <X11/extensions/saver.h>      // for ScreenSaverNotify, ScreenSave...#include <X11/extensions/scrnsaver.h>  // for XScreenSaverQueryExtension#endif#ifdef HAVE_XF86MISC_EXT#include <X11/extensions/xf86misc.h>  // for XF86MiscSetGrabKeysState#endif#ifdef HAVE_XFIXES_EXT#include <X11/extensions/Xfixes.h>      // for XFixesQueryExtension, XFixesS...#include <X11/extensions/shapeconst.h>  // for ShapeBounding#endif #include "auth_child.h"     // for KillAuthChildSigHandlerSafe, Want...#include "env_settings.h"   // for GetIntSetting, GetExecutableP...#include "logging.h"        // for Log, LogErrno#include "mlock_page.h"     // for MLOCK_PAGE#include "saver_child.h"    // for WatchSaverChild, KillAllSaver...#include "unmap_all.h"      // for ClearUnmapAllWindowsState#include "util.h"           // for explicit_bzero#include "version.h"        // for git_version#include "wait_pgrp.h"      // for WaitPgrp#include "wm_properties.h"  // for SetWMProperties /*! \brief How often (in times per second) to watch child processes. * * This defines the minimum frequency to call WatchChildren(). */#define WATCH_CHILDREN_HZ 10 /*! \brief Try to reinstate grabs in regular intervals. * * This will reinstate the grabs WATCH_CHILDREN_HZ times per second. This * appears to be required with some XScreenSaver hacks that cause XSecureLock to * lose MotionNotify events, but nothing else. */#undef ALWAYS_REINSTATE_GRABS /*! \brief Try to bring the grab window to foreground in regular intervals. * * Some desktop environments have transparent OverrideRedirect notifications. * These do not send a VisibilityNotify to this window, as some part still * shines through. As a workaround, this enables raising the grab window * periodically. */#undef AUTO_RAISE /*! \brief Show cursor during auth. * * If enabled, a mouse cursor is shown whenever the auth_window is mapped. * * Note that proper use of this also would require a way to forward click * events to the auth helper, which doesn't exist yet. */#undef SHOW_CURSOR_DURING_AUTH /*! \brief Exhaustive list of all mouse related X11 events. * * These will be selected for grab. It is important that this contains all * pointer event types, to not let any through to other applications. */#define ALL_POINTER_EVENTS                                                   \  (ButtonPressMask | ButtonReleaseMask | EnterWindowMask | LeaveWindowMask | \   PointerMotionMask | Button1MotionMask | Button2MotionMask |               \   Button3MotionMask | Button4MotionMask | Button5MotionMask |               \   ButtonMotionMask) //! Private (possibly containing information about the user's password) data.//  This data is locked to RAM using mlock() to avoid leakage to disk via swap.struct {  // The received X event.  XEvent ev;  // The decoded key press.  char buf[16];  KeySym keysym;  // The length of the data in buf.  int len;} priv;//! The name of the auth child to execute, relative to HELPER_PATH.const char *auth_executable;//! The name of the saver child to execute, relative to HELPER_PATH.const char *saver_executable;//! The command to run once screen locking is complete.char *const *notify_command = NULL;#ifdef HAVE_XCOMPOSITE_EXT//! Do not use XComposite to cover transparent notifications.int no_composite = 0;//! Create an almost-fullscreen sized "obscurer window" against bad compositors.int composite_obscurer = 0;#endif//! If set, we can start a new login session.int have_switch_user_command = 0;//! If set, we try to force grabbing by "evil" means.int force_grab = 0;//! If set, print window info about any "conflicting" windows to stderr.int debug_window_info = 0;//! If nonnegative, the time in seconds till we blank the screen explicitly.int blank_timeout = -1;//! The DPMS state to switch the screen to when blanking.const char *blank_dpms_state = "off";//! Whether to reset the saver module when auth closes.int saver_reset_on_auth_close = 0; //! The PID of a currently running notify command, or 0 if none is running.pid_t notify_command_pid = 0; //! The time when we will blank the screen.struct timeval time_to_blank; //! Whether the screen is currently blanked by us.int blanked = 0; #ifdef HAVE_DPMS_EXT//! Whether DPMS needs to be disabled when unblanking. Set when blanking.int must_disable_dpms = 0;#endif void ResetBlankScreenTimer(void) {  if (blank_timeout < 0) {    return;  }  gettimeofday(&time_to_blank, NULL);  time_to_blank.tv_sec += blank_timeout;} void InitBlankScreen(void) {  if (blank_timeout < 0) {    return;  }  blanked = 0;  ResetBlankScreenTimer();} void MaybeBlankScreen(Display *display) {  if (blank_timeout < 0 || blanked) {    return;  }  struct timeval now;  gettimeofday(&now, NULL);  if (now.tv_sec < time_to_blank.tv_sec ||      (now.tv_sec == time_to_blank.tv_sec &&       now.tv_usec < time_to_blank.tv_usec)) {    return;  }  // Blank timer expired - blank the screen.  blanked = 1;  XForceScreenSaver(display, ScreenSaverActive);  if (!strcmp(blank_dpms_state, "on")) {    // Just X11 blanking.    goto done;  }#ifdef HAVE_DPMS_EXT  // If we get here, we want to do DPMS blanking.  int dummy;  if (!DPMSQueryExtension(display, &dummy, &dummy)) {    Log("DPMS is unavailable and XSECURELOCK_BLANK_DPMS_STATE not on");    goto done;  }  CARD16 state;  BOOL onoff;  DPMSInfo(display, &state, &onoff);  if (!onoff) {    // DPMS not active by user - so we gotta force it.    must_disable_dpms = 1;    DPMSEnable(display);  }  if (!strcmp(blank_dpms_state, "standby")) {    DPMSForceLevel(display, DPMSModeStandby);  } else if (!strcmp(blank_dpms_state, "suspend")) {    DPMSForceLevel(display, DPMSModeSuspend);  } else if (!strcmp(blank_dpms_state, "off")) {    DPMSForceLevel(display, DPMSModeOff);  } else {    Log("XSECURELOCK_BLANK_DPMS_STATE not in standby/suspend/off/on");  }#else  Log("DPMS is not compiled in and XSECURELOCK_BLANK_DPMS_STATE not on");#endifdone:  // Flush the output buffer so we turn off the display now and not a few ms  // later.  XFlush(display);} void ScreenNoLongerBlanked(Display *display) {#ifdef HAVE_DPMS_EXT  if (must_disable_dpms) {    DPMSDisable(display);    must_disable_dpms = 0;    // Flush the output buffer so we turn on the display now and not a    // few ms later. Makes our and X11's idle timer more consistent.    XFlush(display);  }#endif  blanked = 0;} void UnblankScreen(Display *display) {  if (blanked) {    XForceScreenSaver(display, ScreenSaverReset);    ScreenNoLongerBlanked(display);  }  ResetBlankScreenTimer();} static void HandleSIGTERM(int signo) {  KillAllSaverChildrenSigHandlerSafe(signo);  // Dirty, but quick.  KillAuthChildSigHandlerSafe(signo);         // More dirty.  explicit_bzero(&priv, sizeof(priv));  raise(signo);} enum WatchChildrenState {  //! Request saver child.  WATCH_CHILDREN_NORMAL,  //! Request no saver to run (DPMS!).  WATCH_CHILDREN_SAVER_DISABLED,  //! Request auth child.  WATCH_CHILDREN_FORCE_AUTH}; /*! \brief Watch the child processes, and bring them into the desired state. * * If the requested state is WATCH_CHILDREN_NORMAL and neither auth nor saver * child are running, the saver child will be spawned. * * If the requested state is WATCH_CHILDREN_SAVER_DISABLED, a possibly running * saver child will be killed. * * If the requested state is WATCH_CHILDREN_FORCE_AUTH, a possibly running saver * child will be killed, and an auth child will be spawned. * * If the auth child was already running, the stdinbuf is sent to the auth child * on standard input. * * \param state The request to perform. * \param stdinbuf Key presses to send to the auth child, if set. * \return If true, authentication was successful and the program should exit. */int WatchChildren(Display *dpy, Window auth_win, Window saver_win,                  enum WatchChildrenState state, const char *stdinbuf) {  int want_auth = WantAuthChild(state == WATCH_CHILDREN_FORCE_AUTH);  int auth_running = 0;   // Note: want_auth is true whenever we WANT to run authentication, or it is  // already running. It may have recently terminated, which we will notice  // later.  if (want_auth) {    // Actually start the auth child, or notice termination.    if (WatchAuthChild(auth_win, auth_executable,                       state == WATCH_CHILDREN_FORCE_AUTH, stdinbuf,                       &auth_running)) {      // Auth performed successfully. Terminate the other children.      WatchSaverChild(dpy, saver_win, 0, saver_executable, 0);      // Now terminate the screen lock.      return 1;    }     // If we wanted auth, but it's not running, auth just terminated. Unmap the    // auth window and poke the screensaver so that it can reset any timeouts.    if (!auth_running) {      XUnmapWindow(dpy, auth_win);      if (saver_reset_on_auth_close) {        KillAllSaverChildrenSigHandlerSafe(SIGUSR1);      }    }  }   // Show the screen saver.  WatchSaverChild(dpy, saver_win, 0, saver_executable,                  state != WATCH_CHILDREN_SAVER_DISABLED);   if (auth_running) {    // While auth is running, we never blank.    UnblankScreen(dpy);  } else {    // If no auth is running, permit blanking as per timer.    MaybeBlankScreen(dpy);  }   // Do not terminate the screen lock.  return 0;} /*! \brief Wake up the screen saver in response to a keyboard or mouse event. * * \return If true, authentication was successful, and the program should exit. */int WakeUp(Display *dpy, Window auth_win, Window saver_win,           const char *stdinbuf) {  return WatchChildren(dpy, auth_win, saver_win, WATCH_CHILDREN_FORCE_AUTH,                       stdinbuf);} /*! \brief An X11 error handler that merely logs errors to stderr. * * This is used to prevent X11 errors from terminating XSecureLock. */int JustLogErrorsHandler(Display *display, XErrorEvent *error) {  char buf[128];  XGetErrorText(display, error->error_code, buf, sizeof(buf));  buf[sizeof(buf) - 1] = 0;  Log("Got non-fatal X11 error: %s", buf);  return 0;} /*! \brief An X11 error handler that does nothing at all. * * This is used for calls where we expect errors to happen. */int SilentlyIgnoreErrorsHandler(Display *display, XErrorEvent *error) {  (void)display;  (void)error;  return 0;} /*! \brief Print a version message. */void Version(void) {  printf("XSecureLock - X11 screen lock utility designed for security.\n");  if (*git_version) {    printf("Version: %s\n", git_version);  } else {    printf("Version unknown.\n");  }} /*! \brief Print an usage message. * * A message is shown explaining how to use XSecureLock. * * \param me The name this executable was invoked as. */void Usage(const char *me) {  Version();  printf(      "\n"      "Usage:\n"      "  env [variables...] %s [-- command to run when locked]\n"      "\n"      "Environment variables you may set for XSecureLock and its modules:\n"      "\n"#include "env_helpstr.inc"  // IWYU pragma: keep      "\n"      "Configured default auth module: " AUTH_EXECUTABLE      "\n"      "Configured default authproto module: " AUTHPROTO_EXECUTABLE      "\n"      "Configured default global saver module: " GLOBAL_SAVER_EXECUTABLE      "\n"      "Configured default per-screen saver module: " SAVER_EXECUTABLE      "\n"      "\n"      "This software is licensed under the Apache 2.0 License. Details are\n"      "available at the following location:\n"      "  " DOCS_PATH "/COPYING\n",      me,      "%s",   // For XSECURELOCK_KEY_%s_COMMAND.      "%s");  // For XSECURELOCK_KEY_%s_COMMAND's description.} /*! \brief Load default settings from environment variables. * * These settings override what was figured out at ./configure time. */void LoadDefaults() {  auth_executable =      GetExecutablePathSetting("XSECURELOCK_AUTH", AUTH_EXECUTABLE, 1);  saver_executable = GetExecutablePathSetting("XSECURELOCK_GLOBAL_SAVER",                                              GLOBAL_SAVER_EXECUTABLE, 0);#ifdef HAVE_XCOMPOSITE_EXT  no_composite = GetIntSetting("XSECURELOCK_NO_COMPOSITE", 0);  composite_obscurer = GetIntSetting("XSECURELOCK_COMPOSITE_OBSCURER", 1);#endif  have_switch_user_command =      *GetStringSetting("XSECURELOCK_SWITCH_USER_COMMAND", "");  force_grab = GetIntSetting("XSECURELOCK_FORCE_GRAB", 0);  debug_window_info = GetIntSetting("XSECURELOCK_DEBUG_WINDOW_INFO", 0);  blank_timeout = GetIntSetting("XSECURELOCK_BLANK_TIMEOUT", 600);  blank_dpms_state = GetStringSetting("XSECURELOCK_BLANK_DPMS_STATE", "off");  saver_reset_on_auth_close =      GetIntSetting("XSECURELOCK_SAVER_RESET_ON_AUTH_CLOSE", 0);} /*! \brief Parse the command line arguments, or exit in case of failure. * * This accepts saver_* or auth_* arguments, and puts them in their respective * global variable. * * This is DEPRECATED - use the XSECURELOCK_SAVER and XSECURELOCK_AUTH * environment variables instead! * * Possible errors will be printed on stderr. */void ParseArgumentsOrExit(int argc, char **argv) {  for (int i = 1; i < argc; ++i) {    if (!strncmp(argv[i], "auth_", 5)) {      Log("Setting auth child name from command line is DEPRECATED. Use "          "the XSECURELOCK_AUTH environment variable instead");      auth_executable = argv[i];      continue;    }    if (!strncmp(argv[i], "saver_", 6)) {      Log("Setting saver child name from command line is DEPRECATED. Use "          "the XSECURELOCK_SAVER environment variable instead");      saver_executable = argv[i];      continue;    }    if (!strcmp(argv[i], "--")) {      notify_command = argv + i + 1;      break;    }    if (!strcmp(argv[i], "--help")) {      Usage(argv[0]);      exit(0);    }    if (!strcmp(argv[i], "--version")) {      Version();      exit(0);    }    // If we get here, the argument is unrecognized. Exit, then.    Log("Unrecognized argument: %s", argv[i]);    Usage(argv[0]);    exit(0);  }} /*! \brief Check the settings. * * This tests whether the selected auth and saver executables are valid and * actually executable. Failure of this could lead to an un-unlockable screen, * and we sure don't want that. * * Possible errors will be printed on stderr. * * \return true if everything is OK, false otherwise. */int CheckSettings() {  // Flawfinder note: the access() calls here are not security relevant and just  // prevent accidentally running with a nonexisting saver or auth executable as  // that could make the system un-unlockable.   if (auth_executable == NULL) {    Log("Auth module has not been specified in any way");    return 0;  }  if (saver_executable == NULL) {    Log("Saver module has not been specified in any way");    return 0;  }

Lines 1–500 of 1569. Load more