9

See USB driver bug exposed as "Linux plug&pwn", or this link


Two choices [GNOME, Fedora 14]:

  1. Use the gnome-screensaver
  2. Use the "switch user" function [gnome menu -> log out -> switch user]

So the question is: which one is the safer method to lock the screen if a user leaves the pc?

Is it true that using the [2] method is safer? The way I see it, the gnome-screensaver is just a "process", it could be killed. But if you use the log out/switch user function, it's "something else". Using the "switch user" function, could there be a problem like with the gnome-screensaver? Could someone "kill a process" and presto...the lock is removed? Could the GDM [??] "login windows process" get killed and the "lock" gets owned?

Screenshot of the GDM login window process


If the [2] method is safer, then how can i put an icon on the GNOME panel, to launch the "switch user" action by 1 click?

2

Well your first link is about kernel mode arbitraty code execution there is not much you can do against that. Logging out won't help. Grsecurity and PaX could prevent this but I'm not sure. It surely protect against introducing new executable code but I can't find any evidence that it randomizes where the kernel code is located which means an exploit could use the code already in executable memory to perform arbitrary operations (a method known as return-oriented-programming). Since this overflow happens on the heap compiling the kernel with -fstack-protector-all won't help. Keeping the kernel up to date and people with pendrives away seems to be your best bet.

The second method is the result of a badly written screensaver which means logging out prevents that particular bug. Even if the attacker kills GDM he will not get in. Try killing it yourself from SSH. You get a black screen or a text-mode console. Besides AFAIK GDM runs as root (like login) so the attacker would need root privileges to kill it.

Switching users don't have this effect. When you switch user the screen is locked with the screensaver and GDM is started on the next virtual terminal. You can press [ctrl]+[alt]+[f7] to get back to the buggy screensaver.

  • 1
    omg....i checked it... using the command: "sleep 10; pkill gnome-scree" - after this, i go to "switch user"...after 10 sec if i press ctrl+alt+f1 i can see my desktop...OMFG... :( – LanceBaynes Mar 9 '11 at 7:44
  • @user4724: what did you expect to happen? – mattdm Mar 9 '11 at 13:53
  • @user4724: The screensaver is just an ordinary full screen application. I don't want to go into how insanely bad idea that is. One of the consequences is this. – stribika Mar 10 '11 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.