DRI3000

Posted Feb 22, 2013 11:16 UTC (Fri) by lindi (subscriber, #53135)
In reply to: DRI3000 by Serge
Parent article: LCA: The X-men speak

ctrl-alt-backspace is indeed disabled by default. If I add

Section "InputClass"
Identifier "Keyboard Defaults"
MatchIsKeyboard "yes"
Option "XkbOptions" "terminate:ctrl_alt_bksp"
EndSection

to xorg.conf it manages to kill the server. However, a malicious user can run

setxkbmap -option ""

to disable this. It doesn't seem like ctrl-alt-backspace for designed for security.

DRI3000

Posted Feb 22, 2013 19:22 UTC (Fri) by Serge (guest, #84957) [Link] (3 responses)

> However, a malicious user can run: setxkbmap -option ""

That user would probably be you, and this is fine, since you should be able to change your settings. If someone else can run arbitrary commands in your session, Xorg is the least of your problems. :) Those setting will be lost as soon as you log out anyway.

> It doesn't seem like ctrl-alt-backspace for designed for security.

I guess it was not designed for security, but you can still use it for security. :) On the other hand Alt+SysRq+K was actually designed for security.

DRI3000

Posted Feb 22, 2013 19:35 UTC (Fri) by lindi (subscriber, #53135) [Link] (2 responses)

But how do you know that it is your session? That's the whole point of a secure access key. Somebody could have killed your session, logged in and started an imitation of the display manager login window.

DRI3000

Posted Feb 22, 2013 20:11 UTC (Fri) by Serge (guest, #84957) [Link] (1 responses)

> But how do you know that it is your session? That's the whole point of a secure access key.

If somebody logged in, disabled terminate sequence and started login screen emulation, you'll notice, that nothing happens when you press Ctrl-Alt-BS. :) But I agree that "Secure Access Key" (Alt+SysRq+K on Linux) is better for that, and it works both for text and X terminals. It's just some distributions disable Magic SysRq keys, while C-A-BS usually works everywhere during login screen.

DRI3000

Posted Feb 22, 2013 20:26 UTC (Fri) by lindi (subscriber, #53135) [Link]

Well, the fake login prompt can of course be programmed to react to ctrl-alt-backspace.