Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

See USB driver bug exposed as "Linux plug&pwn", or this link


Two choices [GNOME, Fedora 14]:

  1. Use the gnome-screensaver
  2. Use the "switch user" function [gnome menu -> log out -> switch user]

So the question is: which one is the safer method to lock the screen if a user leaves the pc?

Is it true that using the [2] method is safer? The way I see it, the gnome-screensaver is just a "process", it could be killed. But if you use the log out/switch user function, it's "something else". Using the "switch user" function, could there be a problem like with the gnome-screensaver? Could someone "kill a process" and presto...the lock is removed? Could the GDM [??] "login windows process" get killed and the "lock" gets owned?

Screenshot of the GDM login window process


If the [2] method is safer, then how can i put an icon on the GNOME panel, to launch the "switch user" action by 1 click?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Well your first link is about kernel mode arbitraty code execution there is not much you can do against that. Logging out won't help. Grsecurity and PaX could prevent this but I'm not sure. It surely protect against introducing new executable code but I can't find any evidence that it randomizes where the kernel code is located which means an exploit could use the code already in executable memory to perform arbitrary operations (a method known as return-oriented-programming). Since this overflow happens on the heap compiling the kernel with -fstack-protector-all won't help. Keeping the kernel up to date and people with pendrives away seems to be your best bet.

The second method is the result of a badly written screensaver which means logging out prevents that particular bug. Even if the attacker kills GDM he will not get in. Try killing it yourself from SSH. You get a black screen or a text-mode console. Besides AFAIK GDM runs as root (like login) so the attacker would need root privileges to kill it.

Switching users don't have this effect. When you switch user the screen is locked with the screensaver and GDM is started on the next virtual terminal. You can press [ctrl]+[alt]+[f7] to get back to the buggy screensaver.

share|improve this answer
    
omg....i checked it... using the command: "sleep 10; pkill gnome-scree" - after this, i go to "switch user"...after 10 sec if i press ctrl+alt+f1 i can see my desktop...OMFG... :( –  LanceBaynes Mar 9 '11 at 7:44
    
@user4724: what did you expect to happen? –  mattdm Mar 9 '11 at 13:53
    
@user4724: The screensaver is just an ordinary full screen application. I don't want to go into how insanely bad idea that is. One of the consequences is this. –  stribika Mar 10 '11 at 18:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.