There is a warning in the Archlinux List of security applications. It says that of all possible screen-lockers, only four block tty access: sflock, physlock, Cinnamon Screensaver, MATE Screensaver and GNOME Screensaver.
The XScreenSaver FAQ, meanwhile, lists four backdoors by which someone can gain access to your system when your screen is locked:
- Ctrl-Alt-Backspace (kill X server, perhaps raise text console)
- Ctrl-Alt-F1 (F2, ..., etc)(open a virtual console)
- Alt-SysRq-F (randomly kill a long-running process)
- Ctrl-Alt-KP_Multiply (kill any X11 app that holds a lock)
The Xscreensaver FAQ gives ways to disable the backdoors.
But are there others? And do those screen-lockers that Archlinux implies are actually block all those backdoors listed in the xscreensaver faq, and whatever other ones there might be?
And if you block all the backdoors in the way suggested in the xscreensaver faq, will your system then be secure enough for you to leave it after locking the screen, suspending the system and closing the lid?
A word from xscreensaver author Jamie Zawinski:
Shouldn't xscreensaver disable Ctrl-Alt-Backspace while the screen is locked?
Yes, it should. Unfortunately, that's not possible with current versions of XFree86 or XOrg. It's as if the developers of X11 and the Linux kernel want to make it as hard as possible for you to lock your screen.
There's little that I can do to make the screen locker secure so long as the kernel and X11 developers are actively working against security. The strength of the lock on your front door doesn't matter much so long as someone else in the house insists on leaving a key under the welcome mat.
In an ideal world, there would be a single X11 request named something like XGrabMagicKeys() that would, analagously to XGrabKeyboard(), disable all of these magic keystrokes until the grab was released or the program exited. It should be an X11 call, not an ioctl(), and especially not a root-only ioctl(). Needless to say, no such interface exists.