RE: [TCLUG:5406] others can lock my X session

[schewe@tcfreenet.org]

On 18 Apr, Ben Luey wrote:
> 
>> xhost -
>> xhost -localhost
> 
> Doesn't work. When I ro xhost -localhost it says localhost has been
> removed, but when I run xhost is lists localhost as on the list, and
> remote users can connect. 

Run xinit with -auth and a key.  Look at the documentation on this.  
Here's a handy script that I use at work, note the magic cookie stuff.  
#!/bin/sh

#
# Define standard roots
#
#PUBDIR=/usr/local
#for i in 6 5 4; do
#    if [ -d $PUBDIR/X11R$i ]; then
#	XHOME=$PUBDIR/X11R$i
#	break
#    fi
#done
PUBDIR=
XHOME=/usr/openwin
#XHOME=/usr/local/X11/current

XFONTS=$XHOME/lib/X11/fonts
XKEYSYMDB=/net/users/jschewe/lib/XKeysymDB
XAPPLRESDIR=/net/users/jschewe/app-defaults
#
# Make sure X exists
#
if [ ! -d $XHOME ]; then
	echo "Error: XHOME is set to $XHOME"
	echo "       This directory does not seem to exist!"
	exit
fi

#
# Define "static" defaults for the Xserver (and clients)
#
fontdirs=`/bin/ls $XFONTS`
XDEFAULTFONTPATH=`for i in ${fontdirs}; do /usr/ucb/echo -n ${i},; done;`
unset fontdirs
#XDEFAULTFONTPATH=$XFONTS/misc/,$XFONTS/Speedo/,$XFONTS/75dpi/,$XFONTS/100dpi/,$XFONTS/xtex/,$XFONTS/chinese/,$XFONTS/85dpi/
XDEFAULTRGBPATH=$XHOME/lib/X11/rgb
XDEFAULTTWMINIT=$XHOME/lib/X11/twm/system.twmrc
XDEFAULTFSINIT=$XHOME/lib/X11/fs/config

#
# Add OpenWindows to our environment
#
if [ -d "${OPENWINHOME:=$OPENHOME}" ]; then
	PATH=$OPENWINHOME/bin:$PATH
	MANPATH=$OPENWINHOME/man:$MANPATH
	LD_LIBRARY_PATH=$OPENWINHOME/lib:$LD_LIBRARY_PATH
fi

#
# Add X Windows to our environment
#
PATH=$XHOME/bin:$PATH
MANPATH=$XHOME/man:$MANPATH
LD_LIBRARY_PATH=$XHOME/lib:$LD_LIBRARY_PATH

# set USER if not set
# what fsckhead at Sun decided that /usr/bin/id didn't need to follow the
# standard?
if [ x"$USER" = x ]; then
    USER=`/usr/xpg4/bin/id -un`
fi
# CONSTYPE will be .bw2 .cg3 or .gx
CONSTYPE=.`$XHOME/bin/constype`
HOSTNAME=`/usr/bin/hostname`
TTMP=${HOME}/.X11-log
REMTMP=YES
XINIT=

#
# User's personal .xinitrc?
#
if [ -f $HOME/.xinitrc ]; then
	XINIT=$HOME/.xinitrc
fi

#
# Error handler
#
err () {
	echo "Usage: x11 [ -Ffkd ] [ -x file ]"
	echo "	-f : use fast keyboard repeat rate"
	echo "	-F : use SUPER-fast keyboard repeat rate"
	echo "	-k : Keep the error log file $TTMP on exit"
	echo "   -d : Make deep (24-bit) the default ('defdepth 24')"
	echo "	-x : Use named xinit script instead of default"
	exit 1
}
#
# Parse command line options
#

DEEP=0

while getopts Ffx:kd arg
do
	case $arg in
		f) SPEED="-ar2 15 -ar1 200";;
		F) SPEED="-ar2 1 -ar1 100";;
		x) if [ -f ${OPTARG} ]; then
			XINIT=${OPTARG}
		   else
			err ${OPTARG}
		   fi;;
		k) REMTMP=;;
		d) DEEP=1;;
		\?) err;
	esac
done

if [ $CONSTYPE = .bw2 ]; then
	XSERVER=XsunMono
else
	XSERVER=Xsun
fi

DEPTH=""
if [ "$DEEP" = 1 ]; then
    if [ -c /dev/fbs/afb0 ]; then
	DEPTH="-dev /dev/fbs/afb0 defdepth 24"
    elif [ -c /dev/fbs/ffb0 ]; then
	DEPTH="-dev /dev/fbs/ffb0 defdepth 24"
    else
	echo "no [AF]FB found; defaulting to depth 8" 1>&2
    fi
fi

export XHOME OPENWINHOME XDEFAULTFONTPATH XDEFAULTRGBPATH PATH MANPATH LD_LIBRARY_PATH XKEYSYMDB XAPPLRESDIR

#
# Authorisation key for protected sessions
#
AUTHKEY=`echo ' ' | /usr/bin/nawk '{srand();for (i=0;i<8;i++) { printf "%04x", int(rand() * 65535) +1} }'`
#AUTHKEY=`(ps -ael; netstat -an; date) | md5`
#CANONICALNAME=`hostname`.`domainname`
#CANONICALNAME=`echo $CANONICALNAME|sed 's/csl.csl/csl/g'`
#echo "add $HOSTNAME/unix:0 MIT-MAGIC-COOKIE-1 $AUTHKEY"    | xauth -q
#echo "add $CANONICALNAME:0 MIT-MAGIC-COOKIE-1 $AUTHKEY" | xauth -q
echo "add :0.0 MIT-MAGIC-COOKIE-1 $AUTHKEY" | xauth -q
echo "add $HOSTNAME/unix:0 MIT-MAGIC-COOKIE-1 $AUTHKEY"    | xauth -q
echo "add $HOSTNAME.htc.honeywell.com:0 MIT-MAGIC-COOKIE-1 $AUTHKEY" | xauth -q
echo "add $HOSTNAME:0 MIT-MAGIC-COOKIE-1 $AUTHKEY" | xauth -q
echo ${XHOME}/bin/xinit /net/users/jschewe/lib/init/xinit.sh ${XINIT} -- $XHOME/bin/$XSERVER ${SPEED} ${DEPTH} -auth ${HOME}/.Xauthority
${XHOME}/bin/xinit /net/users/jschewe/lib/init/xinit.sh ${XINIT} -- $XHOME/bin/$XSERVER ${SPEED} ${DEPTH} -auth ${HOME}/.Xauthority > $TTMP 2>&1

${XHOME}/bin/kbd_mode -a

if [ -n "$REMTMP" ]; then
	/bin/rm $TTMP
fi

-- 
Jon Schewe 
http://tcfreenet.org/~schewe
schewe@tcfreenet.org