Hello fellow hackers, the question has been floating around for quite some time on the internet, but I think it is a good place to answer it in the manual of our screen locker. Is slock really secure and if not, how can I harden it so that nobody can access my machine?
There are two ways one can possibly circumvent a locked X screen (not including security holes in the Kernel) 1) switch to a different VT that is logged in. Then there, proceed to kill slock and switch back the now unlocked VT. 2) kill the X server with Ctrl+Alt+Backspace (if enabled). If no login manager is used, this yields an open shell. All work within the X session is usually lost, but the attacker still has access to the user data. Sysrq can be used to kill all running processes, but this also logs out the user and thus is no problem. I did not add it here because if somebody wants to "pwn" the user he can just unplug the computer or take out the battery to destroy all the work. You can disable VT switching and Ctrl+Alt+Backspace (this also overrides the local Xkb settings and is thus foolproof) for sure by setting two options in xorg.conf. See the patch for details on the instructions. Cheers FRIGN -- FRIGN <[email protected]>
>From 2e363c4dfc98153f8067df27673dda9047ab9227 Mon Sep 17 00:00:00 2001 From: FRIGN <[email protected]> Date: Wed, 28 Sep 2016 20:20:51 +0200 Subject: [PATCH] Remove faulty example and add a section on security considerations The given example does not work and the usage is so obvious that an example probably is not necessary here anyway. The section on security considerations sheds some light on the problems that we can't solve within slock but which the user has to solve in his X configuration. --- slock.1 | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/slock.1 b/slock.1 index 2b2b7c8..6c1e8bd 100644 --- a/slock.1 +++ b/slock.1 @@ -17,10 +17,18 @@ is executed after the screen has been locked. .It Fl v Print version information to stdout and exit. .El -.Sh EXAMPLES -$ -.Nm -/usr/sbin/s2ram +.Sh SECURITY CONSIDERATIONS +To make sure a locked screen can not be bypassed by switching VTs +or killing the X server with Ctrl+Alt+Backspace, it is recommended +to disable both in +.Xr xorg.conf 5 +for maximum security: +.Bd -literal -offset left +Section "ServerFlags" + Option "DontVTSwitch" "True" + Option "DontZap" "True" +EndSection +.Ed .Sh CUSTOMIZATION .Nm can be customized by creating a custom config.h from config.def.h and -- 2.7.3
