3

For speed and convenience I do not shutdown my system when I am only gone some minutes, but do a pm-suspend! When the system "unsuspends"/resumes I would like that there is a (screen)lock (on X and all other terminals) which in addition should initiate a forced shutdown after some time has passed without login.

already indicate some way to me. And the special aspects sought in this question is that of:

  • BOTH all virtual terminals this (tty1-tty6) should be inaccessible
  • AND X should be inaccessible
  • MOREOVER I would like that after resume/wakeup there is only a brief time slot to login again and else the system should "self-destruct"

An important reason/backgroud is that I do want to limit risk to expose an unlocked LUKS partition. While upon boot the disk is protected but not when I leave my system only suspended.

1

This sleep.d script should work (replace <youruser> with a user you've got the password for. I ran it with root the first time and couldn't get back in):

#!/bin/sh

case "$1" in
    hibernate|suspend)
       ;;
    thaw|resume)
       USER=<youruser> /usr/bin/vlock -ans &
       echo $! > /var/run/vlock.pid
       /opt/bin/timeout_vlock.sh &
       ;;
    *) exit $NA
       ;;
esac

The content of /opt/bin/timeout_vlock.sh:

#!/bin/bash

TIMEOUT=10

while kill -0 $(< /var/run/vlock.pid); do
    [ $TIMEOUT -le 0 ] && break
    sleep 1
    let TIMEOUT--
done

rm /var/run/vlock.pid
[ $TIMEOUT -le 0 ] && shutdown -h now

Adjust TIMEOUT to the desired value and make sure you give it execution permission: `chmod +x /opt/bin/timeout_vlock.sh'.

The sleep.d script uses vlock to lock all ttys (even the one with X), disable sysrq and prompt for your user password to unlock. It saves vlock's pid for later use.

The timeout_vlock.sh waits for vlock to finish (which happens when you input your password). If TIMEOUT is reached, it shutdowns the system.

  • The script only works on bash, sorry about that. I will make it portable if it turns out to be useful for someone. – GnP Oct 24 '14 at 17:39
  • Wow! Thank you! Is the script working independent of the init system? – humanityANDpeace Oct 25 '14 at 9:46
  • The solution works almost perfect, yet I want to mention this. vlock (as I looked it up in the source, version 2.2.2) tries hard to disable vt switching chvt yet the pm-suspend (in the version of pm-utils 1.4.1-9fix.ubuntu12.04) when reawaking allows for about 1-2 seconds (on my system) to change to X via Alt-Crtl-F7. For security's sake one should test if pm-suspend screws up the vt-switch-prevention attampted by vlock. – humanityANDpeace Oct 25 '14 at 10:03
0

This answer is building on the answer suggested from @gnp. The difference being that to reduce the risk of vlock locking of virtual console/terminal switching being impacted by the usual pm-suspend etc hacks that tinker with the consoles.

Similar the answer of @gnp we need two files

/etc/pm/sleep.d/20_lock_with_countdown (with +x file permission)

#!/bin/sh

case "$1" in
    hibernate|suspend)

       # generate a kernel/console keymap that has no Console_1 .... Console7
       # and no Incr_Console and no Decr_Console keymappings
       dumpkeys -f |\
       tee /tmp/oldkeymap |\
       sed 's/Console_[0-9]*/VoidSymbol/g' |\
       sed 's/Incr_Console/VoidSymbol/g' |\
       sed 's/Decr_Console/VoidSymbol/g' > /tmp/keymap.with.chvtkeys.disabled

       #set the new "castrated" keymap
       loadkeys /tmp/keymap.with.chvtkeys.disabled
       ;;
    thaw|resume)
       USER=<username> /usr/bin/vlock -ans &
       echo $! > /var/run/vlock.pid
       /opt/bin/timeout_vlock.sh &
       ;;
    *) exit $NA
       ;;
esac

and then a script for the countdown unlock /opt/bin/timeout_vlock.sh:

#!/bin/bash

TIMEOUT=<timeout>

while kill -0 $(< /var/run/vlock.pid); do
    [ $TIMEOUT -le 0 ] && break
    sleep 1
    let TIMEOUT--
done

rm /var/run/vlock.pid
# restore keymap with previous "chvt enabled" keys enabled
loadkeys /tmp/oldkeymap
[ $TIMEOUT -le 0 ] && shutdown -h now

As in the other answer the field <timeout> and <username> should be adjusted in the scripts.

Last but not least it is possible to switch the last line of /opt/bin/timeout_vlock.sh

< [ $TIMEOUT -le 0 ] && shutdown -h now
----
> [ $TIMEOUT -le 0 ] &&  echo u > /proc/sysrq-trigger `
> [ $TIMEOUT -le 0 ] &&  echo o > /proc/sysrq-trigger

`

to avoid another short interaction window of malicious oportunity, as not always is shutdown -h now the fastest way to poweroff your PC

  • 1
    I belive it should be echo o > /proc/sysrq-trigger. Also, that is not a very safe way of shutting down... You should at least echo u > /proc/sysrq-trigger first to protect uncommited data. I would add e, i and s just to be sure. It doesn't add much delay to the shutdown process. – GnP Oct 27 '14 at 14:12
  • @gnp thank you for pointing to that mistake, so I could correct it. – humanityANDpeace Oct 27 '14 at 18:08
  • You're welcome. Does it work correctly? I just remembered that vlock -s disables sysrq rendering this shutdown approach impractical... – GnP Oct 28 '14 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.