GNU logs - #57071, boring messages

Message sent to bug-guix@HIDDEN:

Subject: bug#57071: Xscreensaver not working since latest patch
Resent-From: Rick Huijzer <ikbenrickhuyzer@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Tue, 09 Aug 2022 10:28:02 +0000
Resent-Message-ID: <handler.57071.B.166004088024979 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: 57071 <at> debbugs.gnu.org
MIME-Version: 1.0
From: Rick Huijzer <ikbenrickhuyzer@HIDDEN>
Date: Tue, 9 Aug 2022 10:04:17 +0200
Message-ID: <CAGXOz9a6Kq5e69cwsHwDcDVvk1+_FMZPQN9A7kGs5F3iqbTApg@HIDDEN>
Content-Type: multipart/alternative; boundary="000000000000a9d40205e5ca615f"
Received-SPF: pass client-ip=2a00:1450:4864:20::629;
 envelope-from=ikbenrickhuyzer@HIDDEN; helo=mail-ej1-x629.google.com
X-Spam_score_int: -20
X-Spam_score: -2.1
X-Spam_bar: --
X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001,
 HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001,
 SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no
X-Spam_action: no action
X-Spam-Score: -1.3 (-)
X-Mailman-Approved-At: Tue, 09 Aug 2022 06:27:56 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.3 (--)

--000000000000a9d40205e5ca615f
Content-Type: text/plain; charset="UTF-8"

Hi,

The latest xscreensaver patch <https://issues.guix.gnu.org/56597> rendered
xscreensaver unusable on my systems. When I try to unlock my screen I am
greeted with the message 'xscreensaver: don't login as root', even though I
don't invoke it as root.


$xscreensaver-command -lock
Aug  9 08:45:22 localhost shepherd[1]: [slim] xscreensaver-gfx: 08:45:22:
1: running as root: not launching hacks.
Aug  9 09:10:29 localhost shepherd[1]: [slim] xscreensaver-command: locking
Aug  9 09:10:32 localhost shepherd[1]: [slim] xscreensaver-gfx: 09:10:32:
0: running as root: not launching hacks.

When I remove the
(screen-locker-service xscreensaver)
I run into all kinds of set-uid problems.

I will happily provide more information if needed.

-- 
Met vriendelijke groet,

Rick Huijzer

--000000000000a9d40205e5ca615f
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi,=C2=A0<div><br></div><div>The latest <a href=3D"https:/=
/issues.guix.gnu.org/56597" target=3D"_blank">xscreensaver patch</a>=C2=A0r=
endered xscreensaver unusable on my systems. When I try to unlock my screen=
 I am greeted with the message &#39;xscreensaver: don&#39;t login as root&#=
39;, even though I don&#39;t invoke it as root.=C2=A0</div><div><br></div><=
div><br></div><div>$xscreensaver-command -lock<br></div><div>Aug =C2=A09 08=
:45:22 localhost shepherd[1]: [slim] xscreensaver-gfx: 08:45:22: 1: running=
 as root: not launching hacks.<br>Aug =C2=A09 09:10:29 localhost shepherd[1=
]: [slim] xscreensaver-command: locking<br><div>Aug =C2=A09 09:10:32 localh=
ost shepherd[1]: [slim] xscreensaver-gfx: 09:10:32: 0: running as root: not=
 launching hacks.<br></div><div><br></div><div>When I remove the=C2=A0</div=
><div>(screen-locker-service xscreensaver)<br></div><div>I run into all kin=
ds of set-uid problems.=C2=A0</div><div><br></div><div>I will happily=C2=A0=
provide more information if needed.</div><div><br></div>-- <br><div dir=3D"=
ltr" data-smartmail=3D"gmail_signature"><div dir=3D"ltr"><div><div dir=3D"l=
tr">Met vriendelijke groet,<div><br></div><div>Rick Huijzer</div><div><br><=
/div></div></div></div></div></div></div>

--000000000000a9d40205e5ca615f--

Message sent:

Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-Mailer: MIME-tools 5.505 (Entity 5.505)
Content-Type: text/plain; charset=utf-8
X-Loop: help-debbugs@HIDDEN
From: help-debbugs@HIDDEN (GNU bug Tracking System)
To: Rick Huijzer <ikbenrickhuyzer@HIDDEN>
Subject: bug#57071: Acknowledgement (Xscreensaver not working since latest
 patch)
Message-ID: <handler.57071.B.166004088024979.ack <at> debbugs.gnu.org>
References: <CAGXOz9a6Kq5e69cwsHwDcDVvk1+_FMZPQN9A7kGs5F3iqbTApg@HIDDEN>
X-Gnu-PR-Message: ack 57071
X-Gnu-PR-Package: guix
Reply-To: 57071 <at> debbugs.gnu.org
Date: Tue, 09 Aug 2022 10:28:03 +0000

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-guix@HIDDEN

If you wish to submit further information on this problem, please
send it to 57071 <at> debbugs.gnu.org.

Please do not send mail to help-debbugs@HIDDEN unless you wish
to report a problem with the Bug-tracking system.

--=20
57071: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=3D57071
GNU Bug Tracking System
Contact help-debbugs@HIDDEN with problems

Message sent to bug-guix@HIDDEN:

Subject: bug#57071: Xscreensaver not working since latest patch
Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Tue, 09 Aug 2022 21:32:02 +0000
Resent-Message-ID: <handler.57071.B57071.16600806699626 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Rick Huijzer <ikbenrickhuyzer@HIDDEN>
Cc: r0man <roman@HIDDEN>, 57071 <at> debbugs.gnu.org
From: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
References: <CAGXOz9a6Kq5e69cwsHwDcDVvk1+_FMZPQN9A7kGs5F3iqbTApg@HIDDEN>
Date: Tue, 09 Aug 2022 23:30:58 +0200
In-Reply-To: <CAGXOz9a6Kq5e69cwsHwDcDVvk1+_FMZPQN9A7kGs5F3iqbTApg@HIDDEN>
 (Rick Huijzer's message of "Tue, 9 Aug 2022 10:04:17 +0200")
Message-ID: <87zggd14vh.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

Hi Rick,

Rick Huijzer <ikbenrickhuyzer@HIDDEN> skribis:

> The latest xscreensaver patch <https://issues.guix.gnu.org/56597> rendered
> xscreensaver unusable on my systems. When I try to unlock my screen I am
> greeted with the message 'xscreensaver: don't login as root', even though=
 I
> don't invoke it as root.
>
>
> $xscreensaver-command -lock
> Aug  9 08:45:22 localhost shepherd[1]: [slim] xscreensaver-gfx: 08:45:22:
> 1: running as root: not launching hacks.
> Aug  9 09:10:29 localhost shepherd[1]: [slim] xscreensaver-command: locki=
ng
> Aug  9 09:10:32 localhost shepherd[1]: [slim] xscreensaver-gfx: 09:10:32:
> 0: running as root: not launching hacks.
>
> When I remove the
> (screen-locker-service xscreensaver)
> I run into all kinds of set-uid problems.

Sorry about that, I built it during review but did not actually run it.

One effect of =E2=80=98screen-locker-service=E2=80=99 is to make the progra=
m setuid-root
so that it can authenticate users.  It would seem that something changed
in xscreensaver in that area; quoth =E2=80=98driver/subprocs.c=E2=80=99:

--8<---------------cut here---------------start------------->8---
      if (getuid() =3D=3D (uid_t) 0 || geteuid() =3D=3D (uid_t) 0)
        /* Prior to XScreenSaver 6, if running as root, we would change the
           effective uid to the user "nobody" or "daemon" or "noaccess",
           but even that was just encouraging bad behavior.  Don't log in
           as root. */
        {
          fprintf (stderr, "%s: %d: running as root: not launching hacks.\n=
",
                   blurb(), ssi->number);
          screenhack_obituary (ssi, "", "XScreenSaver: Don't log in as root=
.");
          goto DONE;
        }
--8<---------------cut here---------------end--------------->8---

OTOH the =E2=80=98disavow_privileges=E2=80=99 function is supposed to drop =
root
privileges early on.

So I=E2=80=99m not sure how it=E2=80=99s supposed to be run.  R0man, ideas?

Thanks,
Ludo=E2=80=99.

Message sent to bug-guix@HIDDEN:

Subject: bug#57071: Xscreensaver not working since latest patch
Resent-From: Roman Scherer <roman.scherer@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Wed, 10 Aug 2022 07:15:01 +0000
Resent-Message-ID: <handler.57071.B57071.166011569321561 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
To: Ludovic =?UTF-8?Q?Court=C3=A8s?= <ludo@HIDDEN>
Cc: 57071 <at> debbugs.gnu.org, Rick Huijzer <ikbenrickhuyzer@HIDDEN>
References: <CAGXOz9a6Kq5e69cwsHwDcDVvk1+_FMZPQN9A7kGs5F3iqbTApg@HIDDEN>
 <87zggd14vh.fsf@HIDDEN>
User-agent: mu4e 1.8.7; emacs 28.1
From: Roman Scherer <roman.scherer@HIDDEN>
Date: Wed, 10 Aug 2022 06:37:47 +0000
In-reply-to: <87zggd14vh.fsf@HIDDEN>
Message-ID: <87bksstvs0.fsf@HIDDEN>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha256; protocol="application/pgp-signature"
Precedence: list
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable


Hi Ludo and Rick,

sorry for the trouble. I'm running xscreensaver on a foreign distro and
did not notice this. Probably because somehow my screen wasn't locked,
but still showing random screensavers.

However, now that I tried the `xscreensaver-command -lock` command I see
a dialog with a "Password initialization failed" message.

The xscreensave logs also show this:

xscreensaver-auth: 06:45:55: OOM: /proc/99677/oom_score_adj: Permission den=
ied
xscreensaver-auth: 06:45:55:   To prevent the kernel from randomly unlocking
xscreensaver-auth: 06:45:55:   your screen via the out-of-memory killer,
xscreensaver-auth: 06:45:55:   "xscreensaver-auth" must be setuid root.
xscreensaver-auth: 06:46:06: PAM: warning: /etc/pam.d/xscreensaver does not=
 exist.
xscreensaver-auth: 06:46:06: PAM: password authentication is unlikely to wo=
rk.
xscreensaver-auth: 06:46:15: PAM: warning: /etc/pam.d/xscreensaver does not=
 exist.
xscreensaver-auth: 06:46:15: PAM: password authentication is unlikely to wo=
rk.

When the dialog popped up, I had to switch to a terminal and kill
xscreensaver to be able to access my desktop again.

Should we revert it, until we figured out what's necesarry to get this
working again?

r0man

Ludovic Court=C3=A8s <ludo@HIDDEN> writes:

> Hi Rick,
>
> Rick Huijzer <ikbenrickhuyzer@HIDDEN> skribis:
>
>> The latest xscreensaver patch <https://issues.guix.gnu.org/56597> render=
ed
>> xscreensaver unusable on my systems. When I try to unlock my screen I am
>> greeted with the message 'xscreensaver: don't login as root', even thoug=
h I
>> don't invoke it as root.
>>
>>
>> $xscreensaver-command -lock
>> Aug  9 08:45:22 localhost shepherd[1]: [slim] xscreensaver-gfx: 08:45:22:
>> 1: running as root: not launching hacks.
>> Aug  9 09:10:29 localhost shepherd[1]: [slim] xscreensaver-command: lock=
ing
>> Aug  9 09:10:32 localhost shepherd[1]: [slim] xscreensaver-gfx: 09:10:32:
>> 0: running as root: not launching hacks.
>>
>> When I remove the
>> (screen-locker-service xscreensaver)
>> I run into all kinds of set-uid problems.
>
> Sorry about that, I built it during review but did not actually run it.
>
> One effect of =E2=80=98screen-locker-service=E2=80=99 is to make the prog=
ram setuid-root
> so that it can authenticate users.  It would seem that something changed
> in xscreensaver in that area; quoth =E2=80=98driver/subprocs.c=E2=80=99:
>
>       if (getuid() =3D=3D (uid_t) 0 || geteuid() =3D=3D (uid_t) 0)
>         /* Prior to XScreenSaver 6, if running as root, we would change t=
he
>            effective uid to the user "nobody" or "daemon" or "noaccess",
>            but even that was just encouraging bad behavior.  Don't log in
>            as root. */
>         {
>           fprintf (stderr, "%s: %d: running as root: not launching hacks.=
\n",
>                    blurb(), ssi->number);
>           screenhack_obituary (ssi, "", "XScreenSaver: Don't log in as ro=
ot.");
>           goto DONE;
>         }
>
> OTOH the =E2=80=98disavow_privileges=E2=80=99 function is supposed to dro=
p root
> privileges early on.
>
> So I=E2=80=99m not sure how it=E2=80=99s supposed to be run.  R0man, idea=
s?
>
> Thanks,
> Ludo=E2=80=99.

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQFTBAEBCAA9FiEE0iajOdjfRIFd3gygPdpSUn0qwZkFAmLzWt8fHHJvbWFuLnNj
aGVyZXJAYnVybmluZ3N3ZWxsLmNvbQAKCRA92lJSfSrBmaSOB/9u9HaRe7vhzC6K
KYg64KiAb6+kr1f2HD5Xmxe9q7ZTGJwgwkzAe/PvcYbhKHnDIxYOUwVthNvuDIPC
hyPnFepXstTGRvfwCIofm5EGWgosnRGQdbOIXHolPieX2uvTUw6ak16mwcgIH/3Y
l3BGLsR5qJjIvGfOATgUbSGRHV+/qzo5bnADUb65LDUH19BNQ/TYAQp4zy+NK1RN
xM3yD7qP7mYdkG21iv+6IbkGoujY9Y80IYOpdSISgmibPuQvnQxR9oh3/7aaEGuY
RtDvq/7CQF1aekfD2nxFpulYliE2j4f6Wa0N32EGuNk3xuO+LoeMgYQkCP8ioeEC
F79jnFLw
=u4Rj
-----END PGP SIGNATURE-----
--=-=-=--

Message sent to bug-guix@HIDDEN:

X-Loop: help-debbugs@HIDDEN
Subject: bug#57071: Xscreensaver not working since latest patch
Resent-From: Rick Huijzer <ikbenrickhuyzer@HIDDEN>
Original-Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
Resent-CC: bug-guix@HIDDEN
Resent-Date: Wed, 10 Aug 2022 12:31:03 +0000
Resent-Message-ID: <handler.57071.B57071.166013464330959 <at> debbugs.gnu.org>
Resent-Sender: help-debbugs@HIDDEN
X-GNU-PR-Message: followup 57071
X-GNU-PR-Package: guix
X-GNU-PR-Keywords: 
To: Roman Scherer <roman.scherer@HIDDEN>, ludo@HIDDEN, 57071 <at> debbugs.gnu.org
Received: via spool by 57071-submit <at> debbugs.gnu.org id=B57071.166013464330959
          (code B ref 57071); Wed, 10 Aug 2022 12:31:03 +0000
Received: (at 57071) by debbugs.gnu.org; 10 Aug 2022 12:30:43 +0000
Received: from localhost ([127.0.0.1]:46759 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1oLkrC-00083C-VP
	for submit <at> debbugs.gnu.org; Wed, 10 Aug 2022 08:30:43 -0400
Received: from mail-ej1-f47.google.com ([209.85.218.47]:33648)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ikbenrickhuyzer@HIDDEN>) id 1oLkIU-0006mq-AZ
 for 57071 <at> debbugs.gnu.org; Wed, 10 Aug 2022 07:54:52 -0400
Received: by mail-ej1-f47.google.com with SMTP id uj29so27372179ejc.0
 for <57071 <at> debbugs.gnu.org>; Wed, 10 Aug 2022 04:54:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=to:subject:message-id:date:from:in-reply-to:references:mime-version
 :from:to:cc; bh=hDZCOTv2BfznM9ThgpdVZ+yd+pDuUW4cUZlEa0ErZSk=;
 b=qYB6EJzRaBnFLulCwOGOhQIiX3XGl0uyoDyRxRQUsSNodYdvVJ3Albty7JZgFJMz28
 94wZhcRF7DiyyAzJv3MmSs0gqPokS8exaHQCf1jEMx8Wyhs/p5jY4hWoPgfEMR8bou2V
 K7p8xaXjcYK5DBRHVwPOCTyKi1E1uySz1EN3kXvzkgJ3ZyMjcK0ouBuh4Y95Bl31KEkf
 8PMrRXU6XSdyDI4mgM8D32rzSO4icyY+KPWKlV2ksmdzCtiv4x8aP/zY87rc9JYMaCvm
 +yEpkd0wLKXpjKnQl3XiOQ4zy8Tdtahlit8lGj/Vbm8bleBh/zrt4VcKE6pnMSwHyIU+
 J1UQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=to:subject:message-id:date:from:in-reply-to:references:mime-version
 :x-gm-message-state:from:to:cc;
 bh=hDZCOTv2BfznM9ThgpdVZ+yd+pDuUW4cUZlEa0ErZSk=;
 b=4aVIlcAeZjcu9Z1leFqPoQz7KTmm7RPsaSqHgSpjAuEQWiTHhub2DH7Kgn9zkR++zm
 DGHUtEgxEx/m383s1rX/tnF5fBlz9Bl1OSQ3OwkdFovi7VcVOrxW4k7kPbgVRs6huYhs
 M5JTplUi57OwJEbUZGUHU8pcop1J0EV8HYM2rFkG1Q63EGw1yWO2OFCpi7L29uwhCKM1
 B0GrV9R/WZ8wPHBxh4g012SNG4Jnqm9I68Fp+cREpcTTHTPOyxRwJN1VjB+x+eqKHZO2
 keLKn2iC0HTwJH6hkGUusz39cbA3ENqszVNVnniPruvJGqJjNpXPLkGxKY7OXAJVfklz
 UWpg==
X-Gm-Message-State: ACgBeo2koIqOSVOaqdj8kwdm8pYnIDhJa67T2+5tKLmHlzHiS2DLozwM
 sEJVYFVOCBK/0N5hqHaRe9rTpZbqnkx3IW9SrKM=
X-Google-Smtp-Source: AA6agR66r6wuSqKVYHXW+R8LfE9hgk340TKvuzccjH/9K2rcauQdfePNkCf4TwLBZ3z4spESw500OxwToNzTYI4z6Ds=
X-Received: by 2002:a17:906:8461:b0:730:a43a:9981 with SMTP id
 hx1-20020a170906846100b00730a43a9981mr19735301ejc.552.1660132484334; Wed, 10
 Aug 2022 04:54:44 -0700 (PDT)
MIME-Version: 1.0
References: <CAGXOz9a6Kq5e69cwsHwDcDVvk1+_FMZPQN9A7kGs5F3iqbTApg@HIDDEN>
 <87zggd14vh.fsf@HIDDEN> <87bksstvs0.fsf@HIDDEN>
In-Reply-To: <87bksstvs0.fsf@HIDDEN>
From: Rick Huijzer <ikbenrickhuyzer@HIDDEN>
Date: Wed, 10 Aug 2022 13:54:33 +0200
Message-ID: <CAGXOz9ZS2NuT61vDZyn-hWLWDBOROOptG6tK+iaNkxzS5UFMuw@HIDDEN>
Content-Type: multipart/alternative; boundary="00000000000002486005e5e1b735"
X-Spam-Score: 0.0 (/)
X-Mailman-Approved-At: Wed, 10 Aug 2022 08:30:40 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

--00000000000002486005e5e1b735
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Roman and Ludo,

It seems that xscreensaver-auth needs to be setuid instead of the main
xscreensaver binary. The screen-locker-service in xorg.scm sets the
provided package setuid and sets the required pam configuration for the
provided package. The problem is that the pam configuration needs to be set
for xscreensaver (/etc/pam.d/xscreensaver) and setuid needs to be set for
xscreensaver-auth.

Interestingly when I setuid xscreensaver-auth manually I run into the
following when unlocking:
Aug 10 13:35:02 localhost unix_chkpwd[2197]: check pass; user unknown
Aug 10 13:35:02 localhost unix_chkpwd[2197]: password check failed for user
(rhuijzer)
Aug 10 13:35:02 localhost xscreensaver-auth: pam_unix(xscreensaver:auth):
authentication failure; logname=3D uid=3D1000 euid=3D1000 tty=3D:0 ruser=3D=
 rhost=3D
 user=3Drhuijzer

But this might be fixed in time by [RFC PATCH] gnu: linux-pam: Change path
to unix_chkpwd helper <https://issues.guix.gnu.org/53468>.

I don't know how to fix this elegantly, maybe create a dedicated service
for xscreensaver instead of the standard screen-locker-service?

Thanks,

Op wo 10 aug. 2022 om 09:14 schreef Roman Scherer <
roman.scherer@HIDDEN>:

>
> Hi Ludo and Rick,
>
> sorry for the trouble. I'm running xscreensaver on a foreign distro and
> did not notice this. Probably because somehow my screen wasn't locked,
> but still showing random screensavers.
>
> However, now that I tried the `xscreensaver-command -lock` command I see
> a dialog with a "Password initialization failed" message.
>
> The xscreensave logs also show this:
>
> xscreensaver-auth: 06:45:55: OOM: /proc/99677/oom_score_adj: Permission
> denied
> xscreensaver-auth: 06:45:55:   To prevent the kernel from randomly
> unlocking
> xscreensaver-auth: 06:45:55:   your screen via the out-of-memory killer,
> xscreensaver-auth: 06:45:55:   "xscreensaver-auth" must be setuid root.
> xscreensaver-auth: 06:46:06: PAM: warning: /etc/pam.d/xscreensaver does
> not exist.
> xscreensaver-auth: 06:46:06: PAM: password authentication is unlikely to
> work.
> xscreensaver-auth: 06:46:15: PAM: warning: /etc/pam.d/xscreensaver does
> not exist.
> xscreensaver-auth: 06:46:15: PAM: password authentication is unlikely to
> work.
>
> When the dialog popped up, I had to switch to a terminal and kill
> xscreensaver to be able to access my desktop again.
>
> Should we revert it, until we figured out what's necesarry to get this
> working again?
>
> r0man
>
> Ludovic Court=C3=A8s <ludo@HIDDEN> writes:
>
> > Hi Rick,
> >
> > Rick Huijzer <ikbenrickhuyzer@HIDDEN> skribis:
> >
> >> The latest xscreensaver patch <https://issues.guix.gnu.org/56597>
> rendered
> >> xscreensaver unusable on my systems. When I try to unlock my screen I =
am
> >> greeted with the message 'xscreensaver: don't login as root', even
> though I
> >> don't invoke it as root.
> >>
> >>
> >> $xscreensaver-command -lock
> >> Aug  9 08:45:22 localhost shepherd[1]: [slim] xscreensaver-gfx:
> 08:45:22:
> >> 1: running as root: not launching hacks.
> >> Aug  9 09:10:29 localhost shepherd[1]: [slim] xscreensaver-command:
> locking
> >> Aug  9 09:10:32 localhost shepherd[1]: [slim] xscreensaver-gfx:
> 09:10:32:
> >> 0: running as root: not launching hacks.
> >>
> >> When I remove the
> >> (screen-locker-service xscreensaver)
> >> I run into all kinds of set-uid problems.
> >
> > Sorry about that, I built it during review but did not actually run it.
> >
> > One effect of =E2=80=98screen-locker-service=E2=80=99 is to make the pr=
ogram setuid-root
> > so that it can authenticate users.  It would seem that something change=
d
> > in xscreensaver in that area; quoth =E2=80=98driver/subprocs.c=E2=80=99=
:
> >
> >       if (getuid() =3D=3D (uid_t) 0 || geteuid() =3D=3D (uid_t) 0)
> >         /* Prior to XScreenSaver 6, if running as root, we would change
> the
> >            effective uid to the user "nobody" or "daemon" or "noaccess"=
,
> >            but even that was just encouraging bad behavior.  Don't log =
in
> >            as root. */
> >         {
> >           fprintf (stderr, "%s: %d: running as root: not launching
> hacks.\n",
> >                    blurb(), ssi->number);
> >           screenhack_obituary (ssi, "", "XScreenSaver: Don't log in as
> root.");
> >           goto DONE;
> >         }
> >
> > OTOH the =E2=80=98disavow_privileges=E2=80=99 function is supposed to d=
rop root
> > privileges early on.
> >
> > So I=E2=80=99m not sure how it=E2=80=99s supposed to be run.  R0man, id=
eas?
> >
> > Thanks,
> > Ludo=E2=80=99.
>


--=20
Met vriendelijke groet,

Rick Huijzer

--00000000000002486005e5e1b735
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Roman and Ludo,<div><div><br></div><div>It seems that x=
screensaver-auth needs to be setuid instead of the main xscreensaver binary=
. The screen-locker-service in xorg.scm sets the provided package setuid an=
d sets the required pam configuration for the provided package. The problem=
 is that the pam configuration needs to be set for xscreensaver (/etc/pam.d=
/xscreensaver) and setuid needs to be set for xscreensaver-auth.=C2=A0</div=
><div><br></div><div>Interestingly when I setuid xscreensaver-auth manually=
 I run into the following when unlocking:</div><div>Aug 10 13:35:02 localho=
st unix_chkpwd[2197]: check pass; user unknown<br>Aug 10 13:35:02 localhost=
 unix_chkpwd[2197]: password check failed for user (rhuijzer)<br>Aug 10 13:=
35:02 localhost xscreensaver-auth: pam_unix(xscreensaver:auth): authenticat=
ion failure; logname=3D uid=3D1000 euid=3D1000 tty=3D:0 ruser=3D rhost=3D =
=C2=A0user=3Drhuijzer<br></div><div><br></div><div>But this=C2=A0might=C2=
=A0be fixed in time by <a href=3D"https://issues.guix.gnu.org/53468">[RFC P=
ATCH] gnu: linux-pam: Change path to unix_chkpwd helper</a>.=C2=A0</div><di=
v><br></div><div>I don&#39;t know how to fix this elegantly, maybe create a=
 dedicated service for xscreensaver instead of=C2=A0the standard screen-loc=
ker-service?=C2=A0</div><div><br></div><div>Thanks,</div><br><div class=3D"=
gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Op wo 10 aug. 2022 om 09=
:14 schreef Roman Scherer &lt;<a href=3D"mailto:roman.scherer@burningswell.=
com" target=3D"_blank">roman.scherer@HIDDEN</a>&gt;:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex"><br>
Hi Ludo and Rick,<br>
<br>
sorry for the trouble. I&#39;m running xscreensaver on a foreign distro and=
<br>
did not notice this. Probably because somehow my screen wasn&#39;t locked,<=
br>
but still showing random screensavers.<br>
<br>
However, now that I tried the `xscreensaver-command -lock` command I see<br=
>
a dialog with a &quot;Password initialization failed&quot; message.<br>
<br>
The xscreensave logs also show this:<br>
<br>
xscreensaver-auth: 06:45:55: OOM: /proc/99677/oom_score_adj: Permission den=
ied<br>
xscreensaver-auth: 06:45:55:=C2=A0 =C2=A0To prevent the kernel from randoml=
y unlocking<br>
xscreensaver-auth: 06:45:55:=C2=A0 =C2=A0your screen via the out-of-memory =
killer,<br>
xscreensaver-auth: 06:45:55:=C2=A0 =C2=A0&quot;xscreensaver-auth&quot; must=
 be setuid root.<br>
xscreensaver-auth: 06:46:06: PAM: warning: /etc/pam.d/xscreensaver does not=
 exist.<br>
xscreensaver-auth: 06:46:06: PAM: password authentication is unlikely to wo=
rk.<br>
xscreensaver-auth: 06:46:15: PAM: warning: /etc/pam.d/xscreensaver does not=
 exist.<br>
xscreensaver-auth: 06:46:15: PAM: password authentication is unlikely to wo=
rk.<br>
<br>
When the dialog popped up, I had to switch to a terminal and kill<br>
xscreensaver to be able to access my desktop again.<br>
<br>
Should we revert it, until we figured out what&#39;s necesarry to get this<=
br>
working again?<br>
<br>
r0man<br>
<br>
Ludovic Court=C3=A8s &lt;<a href=3D"mailto:ludo@HIDDEN" target=3D"_blank">=
ludo@HIDDEN</a>&gt; writes:<br>
<br>
&gt; Hi Rick,<br>
&gt;<br>
&gt; Rick Huijzer &lt;<a href=3D"mailto:ikbenrickhuyzer@HIDDEN" target=
=3D"_blank">ikbenrickhuyzer@HIDDEN</a>&gt; skribis:<br>
&gt;<br>
&gt;&gt; The latest xscreensaver patch &lt;<a href=3D"https://issues.guix.g=
nu.org/56597" rel=3D"noreferrer" target=3D"_blank">https://issues.guix.gnu.=
org/56597</a>&gt; rendered<br>
&gt;&gt; xscreensaver unusable on my systems. When I try to unlock my scree=
n I am<br>
&gt;&gt; greeted with the message &#39;xscreensaver: don&#39;t login as roo=
t&#39;, even though I<br>
&gt;&gt; don&#39;t invoke it as root.<br>
&gt;&gt;<br>
&gt;&gt;<br>
&gt;&gt; $xscreensaver-command -lock<br>
&gt;&gt; Aug=C2=A0 9 08:45:22 localhost shepherd[1]: [slim] xscreensaver-gf=
x: 08:45:22:<br>
&gt;&gt; 1: running as root: not launching hacks.<br>
&gt;&gt; Aug=C2=A0 9 09:10:29 localhost shepherd[1]: [slim] xscreensaver-co=
mmand: locking<br>
&gt;&gt; Aug=C2=A0 9 09:10:32 localhost shepherd[1]: [slim] xscreensaver-gf=
x: 09:10:32:<br>
&gt;&gt; 0: running as root: not launching hacks.<br>
&gt;&gt;<br>
&gt;&gt; When I remove the<br>
&gt;&gt; (screen-locker-service xscreensaver)<br>
&gt;&gt; I run into all kinds of set-uid problems.<br>
&gt;<br>
&gt; Sorry about that, I built it during review but did not actually run it=
.<br>
&gt;<br>
&gt; One effect of =E2=80=98screen-locker-service=E2=80=99 is to make the p=
rogram setuid-root<br>
&gt; so that it can authenticate users.=C2=A0 It would seem that something =
changed<br>
&gt; in xscreensaver in that area; quoth =E2=80=98driver/subprocs.c=E2=80=
=99:<br>
&gt;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0if (getuid() =3D=3D (uid_t) 0 || geteuid() =
=3D=3D (uid_t) 0)<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Prior to XScreenSaver 6, if runnin=
g as root, we would change the<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 effective uid to the user &qu=
ot;nobody&quot; or &quot;daemon&quot; or &quot;noaccess&quot;,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 but even that was just encour=
aging bad behavior.=C2=A0 Don&#39;t log in<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 as root. */<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0{<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0fprintf (stderr, &quot;%s: %d:=
 running as root: not launching hacks.\n&quot;,<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 b=
lurb(), ssi-&gt;number);<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0screenhack_obituary (ssi, &quo=
t;&quot;, &quot;XScreenSaver: Don&#39;t log in as root.&quot;);<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0goto DONE;<br>
&gt;=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}<br>
&gt;<br>
&gt; OTOH the =E2=80=98disavow_privileges=E2=80=99 function is supposed to =
drop root<br>
&gt; privileges early on.<br>
&gt;<br>
&gt; So I=E2=80=99m not sure how it=E2=80=99s supposed to be run.=C2=A0 R0m=
an, ideas?<br>
&gt;<br>
&gt; Thanks,<br>
&gt; Ludo=E2=80=99.<br>
</blockquote></div></div></div><br clear=3D"all"><div><br></div>-- <br><div=
 dir=3D"ltr"><div dir=3D"ltr"><div><div dir=3D"ltr">Met vriendelijke groet,=
<div><br></div><div>Rick Huijzer</div><div><br></div></div></div></div></di=
v>

--00000000000002486005e5e1b735--

Last modified: Wed, 10 Aug 2022 12:45:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.