>Kids find a security flaw in Linux Mint by mashing keys

Forum Forums General Other Distros >Kids find a security flaw in Linux Mint by mashing keys

  • This topic has 49 replies, 11 voices, and was last updated Jun 22-7:08 pm by Xecure.
Viewing 15 posts - 16 through 30 (of 50 total)
  • Author
    Posts
  • #50953
    Anonymous
      Helpful
      Up
      0
      ::

      It was just a joke. [..] Sorry if it looked I was implying something else.

      FWIW, I read it as an insightful comment offered in the right place, at the right time.
      It’s a valid talkingpoint, in terms of both design and implementation / policy.

      #50954
      Member
      userzero
        Helpful
        Up
        0
        ::

        Hola,

        I am running the display manager slim and I would like to know if it
        is possible to get a reboot/shutdown button instead of typing ‘halt’
        as the login and the root password.

        /etc/slim.conf
        
        # Commands for halt, login, etc. on antiX
        halt_cmd            /usr/local/bin/persist-config --shutdown --command halt 
        reboot_cmd          /usr/local/bin/persist-config --shutdown --command reboot
        
        man slim
        
        SAGE AND SPECIAL USERNAMES
               When  started,  slim will show a login panel; enter the user‐
               name and password of the user you want to login as.
        
               Special usernames:
               ...
               halt   shutdown the machine
               reboot reboot the machine
               ...
        
        #50958
        Member
        Xecure
          Helpful
          Up
          0
          ::

          is possible to get a reboot/shutdown button instead of typing ‘halt’

          I also use to think that, but someone pointed out that (without me realizing) There is no mouse control on SLiM, just keyboard control! It is like that game where they ask the color order in traffic lights. We see them so often that we don’t really pay attention to the color order. With slim it is the same.
          If there is no mouse and no focus, it is impossible to click any buttons.
          Maybe the only workaround is having a way for one of the Function keys to toggle between Shutdown/Reboot options, in the same way F1 does for desktop sessions.
          That is also the reason no virtual keyboard can work on slim (no way for clicks to be registered).

          • This reply was modified 2 years, 3 months ago by Xecure.

          antiX Live system enthusiast.
          General Live Boot Parameters for antiX.

          #50961
          Anonymous
            Helpful
            Up
            0
            ::

            No, it is not possible. SLiM lacks the ability to “make a button”. (same with slimski)

            It’s a really simplistic program. Its “flow” is essentially the following:

            read the “backgound” image
            “make a rectangle” sized to fullscreen dimensions of the runtime display
            fill the rectangle with backgroundcolor (and/or imagefile) pixels
            -=-
            read the “panel” image
            “make a rectangle” sized to dimensions of the panel image
            draw message text (at specified x,y coordinates) onto panel rectangle
            colorblend merge the pixels of the panel rectangle (at specified x,y coordinates) into the background rectangle
            -=-
            display the now-composited fullscreen rectangle
            and loop, awaiting keypress events

            Each time you (for instance) press F1… back to step 1
            and, on this pass, inject an extra step (draw updated sessiontype messagetext onto “background” rectangle prior to merging the pixels of the panel rectangle)

            #50965
            Anonymous
              Helpful
              Up
              0
              ::

              having a way for one of the Function keys to toggle between Shutdown/Reboot options

              Maybe not evident in my earlier “too many words” posts, slimski adds support for an optionally configured F5 keybind. When adding this, I had no inkling how it might be put to use. To serve as demo in the ~b1, the slimski.conf assigns “yad –color”

              The slimski docs also mention, specific to the ability to launch a windowed program via login screen keybind, plusses n minuses of enabling mouse cursor visibility, as well as a recommendation to choose a (keybinded, if windowed) program which can be launched in “fullscreen” mode.

              Beyond F1,F5,F11 (chosen, spaced apart, hoping to avoid fatfingered mis-clicks)
              …today I’ll now add a few lines of code + conf options supporting additional Fkey keybinds.
              (each with an instrinsic/default blank assignment)

              In SLiM
              F11=screenshot
              screenshot_cmd
              the option varname was a misnomer, right?
              It belied the fact that F11 could be bound to “whatever” commandstring.
              @userzero, you already can ~~ you’re free to (adopt lazy fairie system policy and) assign the halt commandstring to F11

              #51046
              Member
              Xecure
                Helpful
                Up
                0
                ::

                Maybe not evident in my earlier “too many words” posts, slimski adds support for an optionally configured F5 keybind. When adding this, I had no inkling how it might be put to use. To serve as demo in the ~b1, the slimski.conf assigns “yad –color”

                That is great! Maybe desktop-session-exit could be launched, or a yad window with Reboot/poweroff/suspend options that can be selected using the keyboard.

                Let us know when we can test this out.

                antiX Live system enthusiast.
                General Live Boot Parameters for antiX.

                #51081
                Anonymous
                  Helpful
                  Up
                  0
                  ::

                  > let us know

                  oh. When I posted the followup, I edited post #50952 to add a link to the gitlab project repo instead of creating a new post.

                  Across days, do repeatedly check the repo for incrementally versioned debfiles.

                  Recently added/changed, but not yet updated to gitlab (probably will, tonight):

                  — ALL of the 2thru12 Fkeys are now bind-able. Probably no one will want/need ten custom commands, this change just adds flexibility in choosing key(s)

                  — added additional config options for each of the ‘special username’ actions. Via config, sysadmin can toggle each enabled/disabled independently

                  — related to the above, across 15yrs a disparity between varname and commandname has existed in SLiM specific to ‘halt’. (halt_cmd, vs shutdown_msg). I’ve now normalized the varnames (now changed to systemhalt_msg and systemhalt_cmd)

                  Not absent from ~b1, but a “smart” feature I’ve neglected to mention so far:

                  If default_user is populated, SLiM would prefill F1:default_sessiontype
                  Period. That’s it.

                  slimski additionally
                  * checks to ensure that the default_user namestring (still, currently) matches the login name of a valid (exists, and is not “expired”) account.

                  * before pre-filling F1, checks the existence of a ~/.config/slimski.lastused file, checks the validity (sessiontype still/currently available) of the lastused sessiontype therein and pre-populates. Otherwise, slimski will fallback to pre-filling with the default_sessiontype.

                  * Regardles whether a default_user has been configured, each time Enter is pressed to submit a username, slimski recalculates // performs the flow described above, and strives to prefill the user’s lastused sessiontype. Although SLiM seemed to do the same (seen following logout, upon returning to login screen), that was the result of re-displaying the previously buffered details (its ‘remembrance of lastused’ did not persist across boots, and did not consider multiple users).

                  #51092
                  Anonymous
                    Helpful
                    Up
                    0
                    ::

                    might wind up with a duplicate (or a trapped in ‘pending’) copy of this.
                    When I clicked the submit button, I discovered that I had been forcibly, unexpectedly, logged out.
                    (due to a webserver restart? a periodic maintenance cron task?)
                    ________________________

                    Maybe desktop-session-exit could be launched, or

                    Probably elsewhere (not this topic) IIRC someone mentioned
                    “a user could just break out, escape, by using chvt or ctrl+Alt+Fxx …”
                    The quoted bit mentioning desktop-session-exit reminded me to return to discussing this.
                    Please test: Is such an escape, in fact, possible?

                    Also, please do test attempting desktop-session-exit from keybind.
                    If the login manager has been launched via initscript, in daemonemode (which is the case in antiX, IIRC) can we expect a clean exit, or a clean (and successful) shutdown? I am skeptical, am guessing that, no, we cannot.

                    As a thought excercise, I had considered:
                    At time of login screen display, no window manager has loaded yet (so, the ctrl+Alt+Fxx keybinds are undefined). Even if they had, somehow (malware?) been defined… slimski — and same with SLiM — would just “trap//swallow//ignore” any key events involving (Mod1,etc)modifier keys.
                    -=-
                    Sure, if the ‘console’ (sic) special username action is enabled, jimmy can command chvt. “What happens next” in response to issuance of the command, well that’s the realm of the operating system policy, beyond the scope of a loginmanager.

                    The crossover, why I am reminded here:
                    The copied-from-antiX launchstring assigned to console_cmd, it seems to be unworkable, er, broken, or at least can be described as “non-ideal”.

                    * the longwinded commandstring arguments are not being correctly received (e.g. background color)

                    * the geometry commandstring arguments are moot, SLiM//slimski ‘console’ does expose only a hardcoded, fixed geometry, X rectangle to display the x-terminal-emulator (so, assigning an alternative rather than xterm is probably pointless)

                    * the displayed size (and yucko lack of antialiased fonts) is barely usable, and perhaps outright intolerable when displayed on a HiDPI monitor

                    …so my thoughts have been toward ignoring the availability of special username ‘console’. Instead, we can configure (and possibly advertise, via onscreen messagestring) a more fully-featured terminal emulator program.

                    #51103
                    Forum Admin
                    anticapitalista
                      Helpful
                      Up
                      0
                      ::

                      I downloaded the slimski deb to use on antiX-21-alpha1 and, although it installs without errors, it gives a segmentation fault error after instalation and reboot.

                      Philosophers have interpreted the world in many ways; the point is to change it.

                      antiX with runit - leaner and meaner.

                      #51118
                      Anonymous
                        Helpful
                        Up
                        0
                        ::

                        > antiX-21-alpha

                        At the moment, I am only able to build-n-test on antiX19.

                        .
                        > …that is also the reason no virtual keyboard can work on slim (no way for clicks to be registered).

                        How/why would a virtual keyboard be put to use in a login screen context?
                        To facilitate input via a pointystick (accesibility input device)?
                        A tablet device (and the kids robbed your keyboard batteries to use ’em in a Wii remote)?

                        “My username (or my password) contains characters not present on this machine’s physical keyboard”
                        is probably a weak/nil “reason” https://unix.stackexchange.com/questions/157426/what-is-the-regex-to-validate-linux-users

                        #51162
                        Member
                        Xecure
                          Helpful
                          Up
                          0
                          ::

                          How/why would a virtual keyboard be put to use in a login screen context?

                          On the tablet I use for reading, which runs antiX 19, I only have one micro-USB port, and I must connect the keyboard before boot for it to work (something wrong with USB plug-and-play, which I haven’t figured out yet). For some time, when using antiX 17, I used lightdm as “login manager”, as it allowed onboard virtual keyboard, but then returned to slim after installing antiX 19, as I have it set now with only one account. The problem is when an error occurs and I am logged-out, I am forced to reboot, as I cannot log-in without a keyboard (and connecting it doesn’t work until I reboot).
                          Anyway, this is just my case. I am OK with only one user account and auto-login on my reading tablet.

                          Back to slimski, I built it for bullseye (64 bits) but, after installing, I get the same Segmentationfault error anticapitalista reported. I tried to figure this out, but this is impossible for me, so I gave up.
                          I will go back to an antiX 19 VM and start testing it there.

                          antiX Live system enthusiast.
                          General Live Boot Parameters for antiX.

                          #51167
                          Member
                          Xecure
                            Helpful
                            Up
                            0
                            ::

                            I get the same segmentation error on VBox. with antiX 19 x64 bits. What logs do I need to share?

                            How I installed:
                            0. Downloaded the .deb package from gitlab link and sudo apt installed it.
                            1. Selected slimski as the default login manager when the terminal window asked, instead of slim.
                            2. Rebooted and found the segmentation error.

                            antiX Live system enthusiast.
                            General Live Boot Parameters for antiX.

                            #51175
                            Member
                            Xecure
                              Helpful
                              Up
                              0
                              ::

                              OK. Found a way to start slimski in buster and bullseye, so I can test it.
                              You need to start the slimski service.
                              sudo service slimski start

                              I later tried to set it to defaults options (sudo update-rc.d slimski defaults), but the service still doesn’t activate at boot-time.

                              What logs can I provide?

                              antiX Live system enthusiast.
                              General Live Boot Parameters for antiX.

                              #51370
                              Anonymous
                                Helpful
                                Up
                                0
                                ::

                                skidoo wrote

                                Each time you (for instance) press F1… back to step 1
                                and, on this pass, inject an extra step (draw updated sessiontype messagetext onto “background” rectangle prior to merging the pixels of the panel rectangle)

                                The above is incorrect. The “panel” is drawn as a floated, undecorated, window.

                                What I’m typing now is applicable to both SLiM and slimski.
                                If mousecursor is set enabled, the panel input fields can only detect//accept input while the cursor coordinates are within the bounds of the panel rectangle. Within that rectangle the input “fields” are simulated by repeatedly drawing, and repositioning, a blinky text cursor. The panel rectangle does not contain any discreet, interactive, widgets (buttons, textboxes)…

                                …and if the cursor is moved outside the panel rectangle, user will be unable to type until it is again hovered over the panel rectangle. The scenario is essentially that of “sloppy mouse focus” (a configurable option of some window managers).

                                That is also the reason no virtual keyboard can work on slim (no way for clicks to be registered).

                                Right. SLiM and (curently) slimski only track MotionNotify events, not click events.

                                http://t-sato.in.coocan.jp/xvkbd/
                                With SLiM, I don’t know how you could autolaunch xvkbd
                                but
                                yes, this could be do-able with slimski.

                                a few sticking points:

                                If the mouse cursor is moved outside of the bounds of the xvkbd window and you accidentally click, the xvkbd window will become “lost”, hidden behind the fullscreen slimski background window. No window manager running, and I would need to “crack the books” to find out how to code an Alt+Tab stacking order command and then (and???) bind that command to mousebutton3, or ??? (This point applies to ANY windowed program we might launch during display of the “login screen”.)

                                Also, bear in mind that any launched programs would be running AsRoot. Would be… unless a post-install script added to the packaging creates a new, dedicated, group/user account having limited permissions. (Dedicated, as in, “guaranteed to exist and available for use” as a dropped-permissions user account specified for the launched child process) edit: Other approaches are possible ~~ for instance, the program could “drop permissions//capabilities” when launching external commands. Could, as in, is not yet in place (neither for the configurable F11 command seen in SLiM, nor for the configurable Fkey keybinds added in the beta version of slimski).

                                I will go back to an antiX 19 VM and start testing it there.

                                When I upload a ~b2 version, I’ll post a followup.

                                virtual keyboard

                                If the functionality of xvkbd seems suitable, you might want to want to figure out in advance what customizations (geometry, etc.) you prefer. Storing them to a resource file will avoid specifying a looooooooooong commandstring line in the slimski.conf file.

                                I’ll add a new conf option, tentatively named “popfirst_cmd” along with a new -k (easily changed, if you can suggest a better mnemonic name) commandline option. The behavior will be: if popfirst_cmd is non-blank, and slimski has been invoked with the -k option, immediately after displaying the login panel, launch the specified popfirst_cmd. With proper geometry assigned (based on knowing the panel x,y coords specified in your themefile) the virtual kb will not obscure the panel. Other applications which might be assigned as “pop first” would, instead, probably be centered to intentionally hide the panel until the user reads/closes ’em (or “better yet” IMO, would be launched fullscreen).

                                #51400
                                Member
                                Xecure
                                  Helpful
                                  Up
                                  0
                                  ::

                                  When I upload a ~b2 version, I’ll post a followup.

                                  virtual keyboard

                                  Don’t worry about this small case. Slimski (and slim) just needs to do its job, and be a login manager. Already providing a translatable theme is more than enough, and you even added extra options for keybinding/keycommands.
                                  Once the init configuration works properly, it will already be way better than original slim.
                                  BTW, would slimski need a hook to copy the Xsession file/session-names to the sessiontype variable in slimski.conf after each apt install so that the options are updated?

                                  antiX Live system enthusiast.
                                  General Live Boot Parameters for antiX.

                                Viewing 15 posts - 16 through 30 (of 50 total)
                                • You must be logged in to reply to this topic.