diff --git a/kdm/ChangeLog b/kdm/ChangeLog index 0189ab24ae..96ae18fbd8 100644 --- a/kdm/ChangeLog +++ b/kdm/ChangeLog @@ -1,540 +1,544 @@ This change log contains only changes relevant to the KDM configuration, startup and packaging. Bug fixes are not listed, and feature changes only if they affect the configuration. +2006-10-12 Oswald Buddenhagen + + * Removed control FiFos. Use the control sockets or kdmctl instead. + 2005-08-21 Oswald Buddenhagen * Added timed login. Option AutoLoginDelay. * Added persistent auto-login. Option AutoLoginAgain. 2005-02-01 Oswald Buddenhagen * Made the word splitter more sh-like. Affects HaltCmd, RebootCmd, Setup, Startup, Reset, Session and Xrdb. * Replaced option Xservers with StaticServers, ReserveServers, ServerCmd, ServerArgsLocal, ServerArgsRemote, ServerVT and ServerTTY. 2005-01-31 Oswald Buddenhagen * Added console mode that is suitable for systems with VTs (Linux). Option ConsoleTTYs. The @tty spec in Xservers is irrelevant on those systems now. 2005-01-23 Oswald Buddenhagen * Added Grub support to boot options. Option UseLilo replaced with BootManager { None, Grub, Lilo }. Removed options LiloCmd and LiloMap. 2005-01-09 Oswald Buddenhagen * Merged sessreg into kdm. Option UseSessReg. 2004-08-14 Oswald Buddenhagen * Replaced dysfunct InteractiveSd with working ScheduledSd { Never, Optional, Always } 2004-07-28 Oswald Buddenhagen * Added control sockets. Control FiFos are now obsolete. Added control socket command line client 'kdmctl'. * The Setup program is now run even for automatic logins. Setup, Startup and Reset have the arg "auto" for automatic logins. 2004-07-23 Oswald Buddenhagen * Dynamic VT allocation added; option ServerVTs; no need to specify vtX in Xservers any more. 2004-07-10 Oswald Buddenhagen * GreeterPosX, GreeterPosY and GreeterPosFixed replaced with single GreeterPos which is a pair of relative coordinates 2004-07-01 Oswald Buddenhagen * The greeter can now run a "session preloader"; option Preloader 2004-04-15 Oswald Buddenhagen * Merge from XDM: - IPv6 support - LISTEN keyword in Xaccess - Changes to Enable and Port in [Xdmcp] now take effect when HUPed - Support for EGD/PRNGD; options PrngdPort and PrngdSocket 2004-04-14 Oswald Buddenhagen * -debug now groks additional bits for stracing and valgrinding helper processes and disabling syslog usage. 2004-04-09 Oswald Buddenhagen * NoPassUsers now accepts an asterisk ("*") meaning all users 2004-04-08 Oswald Buddenhagen * Changes to FifoDir and FifoGroup now take effect on the global command FiFo when HUPed. 2004-03-16 Oswald Buddenhagen * Changed AllowClose default to true; only the default kdmrc disables it for local display now. 2004-03-11 Chris Cheney * Sanitized UserPath and SystemPath defaults. 2004-03-07 Oswald Buddenhagen * Add user name autocompletion to greeter; option UserCompletion. As a side effect, "None" is gone from ShowUsers and UserList appeared; ShowUsers & SortUsers affect both the user list and the completion list. 2004-02-28 Oswald Buddenhagen * The default Xsession no longer tries to merge kdm's PATH into the one set up by the shell startup scripts. Instead, kde.desktop contains a full pathname and startkde fixes up PATH if necessary. * The default Xsession will emulate the startup behaviour of more shells, in particular bash, zsh and csh/tcsh. * Setting up the session log is now done by kdm, not the Session script; option ClientLogFile. 2004-01-25 Oswald Buddenhagen * Add support for specifying groups in SelectedUsers, HiddenUsers and NoPassUsers. Prefix group names with a @. 2003-12-17 Oswald Buddenhagen * XDMCP initiated local displays are now treated as remote displays (on localhost) by the config reader. 2003-11-09 Oswald Buddenhagen * Sanitized display restart behaviour; option StartInterval is gone. 2003-11-04 Oswald Buddenhagen * Conversation plugins can be configured now; option PluginOptions. * The "Restart X Server"/"Close Connection" action can be configured away; option AllowClose. * The "Console Login" action can be configured away without touching Xservers; option AllowConsole. 2003-10-27 Oswald Buddenhagen * KDM now complies with the input model of PAM. The greeter has an interface for conversation plugins, so alternative authentication mechanisms can be handled; options PluginsLogin & PluginsShutdown. * Password-less and automatic logins now use a separate PAM service (${KDM_PAM_SERVICE}-np). 2003-10-17 Oswald Buddenhagen * Add --with-kdm-xconsole configure switch. No need to patch Makefile.am to enable the built-in xconsole anymore. 2003-09-23 Oswald Buddenhagen * Session types are now defined with .desktop files; consequently the SessionTypes option is gone and we got SessionsDirs instead. * The default Xsession now hard-wires the session types - "default" to startkde - "custom" to ~/.xsession * The previous session type choice is now saved in a different file (~/.dmrc) in a different format (ini-file); the SessSaveFile option is gone. Optionally KDM can be configured to store all .dmrc files in a common directory (option DmrcDir); this can be useful for AFS based installations. * The location of the administratively set user faces is now specified by the FaceDir option and the pictures have a .face.icon extension (or .face for "natural" images, possibly photos). The spec for the above changes is shared with GDM, so packagers should choose common directories. * The kdmsts file moved to /var/lib/kdm by default; option DataDir. * Nuked the AutoLoginSession option; i don't think it was useful at all and it can be emulated anyway. 2003-09-03 Oswald Buddenhagen * Add option RandomDevice to override the OS specific default entropy source. 2003-08-26 Oswald Buddenhagen * Add random seed to forged "previous" session type calculation; option ForgingSeed. 2003-07-15 Malte Starostik * ColorScheme is now interpreted as the base name of the .kcsrc file, not the contents of its Name field. 2003-05-11 Oswald Buddenhagen * GUIStyle & ColorScheme now accept an empty string, meaning "built-in default". Made defaults empty, consequently. 2002-12-01 Oswald Buddenhagen * Integrated chooser into greeter; external 'chooser' executable and the Chooser option are gone. * The chooser can be started locally (without an XDMCP query); options LoginMode and ChooserHosts. * Added built-in xconsole to greeter; options ShowLog and LogSource. This code is not built by default; uncomment the first three lines in kfrontend/Makefile.am to enable it. * The DaemonMode option is gone. The command line switches -daemon and -nodaemon still exist, but are mostly unnecessary, as KDM can decide what to do based on the parent process ID. * The AutoLogin option and the -autolog/-noautolog switches are gone. * The AutoLogin1st option is gone. * The position of the -debug and -logfile command line options is irrelevant again. The -xrm option is back, but is ignored by the KDE frontend. 2002-08-28 Oswald Buddenhagen * Made it possible to specify the color scheme for the greeter; option ColorScheme 2002-08-10 Oswald Buddenhagen * Renamed kdmdesktop to krootimage, moved it back into the KDM source tree, and changed its command line * krootimage will be automatically invoked by the greeter by default; option UseBackground * Chucked out the [Desktop0] section from kdmrc. Instead, the location of the config file containing such a section is specified with the BackgroundRc option. * User images can now be optionally fetched from the users's home directories; option FaceSource * The default of the KeyFile option is now empty again * GreeterScreen now groks -2, meaning upper-right screen 2002-08-06 Oswald Buddenhagen * Automatically don't daemonize if started by init. 2002-03-19 Oswald Buddenhagen * The default Xsession will emulate the startup behaviour of sh/ksh by sourcing /etc/profile and ~/.profile. 2002-03-10 Oswald Buddenhagen * Added InteractiveSd option. This is not really implemented yet, so enabling it just makes KDM deny the existence of the shutdown condition/timing options. * The Setup script is now executed synchronously. Long-lasting commands should be put in the background explicitly. 2002-02-28 George Staikos * GreeterScreen now groks -1, meaning upper-left screen. 2002-01-14 Oswald Buddenhagen * Added option NumLock {On,Off,Keep} to preset the NumLock modifier state for the greeter 2001-12-11 Oswald Buddenhagen * Added AntiAliasing option to disable antialiasing in the greeter 2001-11-30 Oswald Buddenhagen * Added GreeterScreen option to put the greeter on a particular screen in multi-headed setups. * Changed the default of Language from "C" to "en_US" 2001-11-22 Oswald Buddenhagen * The defaults of the options Xservers, Session, Setup, Startup, Reset and PidFile are now back to the saner XDM defaults, so KDM works even without config files. * Changed option ShowUsers: All -> NotHidden * Renamed the option Users to SelectedUsers and NoUsers to HiddenUsers. * The GUIStyle option now groks all installed widget styles. Note that Motif+ and KDE are now called MotifPlus resp. Default. 2001-11-02 Oswald Buddenhagen * Added conditional/scheduled shutdown modes; options DefaultSdMode and AllowSdForceNow; moved AllowShutdown from [X--Greeter] to [X--Core]. * Added reserve display support; extension to Xservers. * Added command FiFo support (see README); options FifoDir, FifoGroup, [ShutDown]/AllowFifo, and [ShutDown]/AllowFifoNow. FiFo location and capabilities are exported in $XDM_MANAGED. 2001-10-04 Oswald Buddenhagen * Xauth files are now created in AuthDir, not AuthDir/authdir. Changed AuthDir default to /var/run/xauth. 2001-07-12 Oswald Buddenhagen * Renamed the option Xwilling to Willing * The RandomFile option is not recognized on Linux and OpenBSD any longer, as they have better entropy sources 2001-07-10 Oswald Buddenhagen * Added the tool 'genkdmconf'. It's supposed to create a suitable configuration for KDM during 'make install' by merging new defaults with a previous XDM/KDM config (if any is found). 2001-07-03 Oswald Buddenhagen * Added counterpart to the MinShowUID option: MaxShowUID 2001-06-23 Oswald Buddenhagen * Xauth files are now created in AuthDir/authfiles, not AuthDir/authdir/authfiles 2001-06-16 Oswald Buddenhagen * Optionally put the cursor right in the "Password" field when a user is preselected in the "Login" field; option FocusPasswd 2001-06-15 Oswald Buddenhagen * Replaced the ShutdownButton + ShutdownNeedsRoot option pair with the AllowShutdown {None,Root,All} option 2001-06-10 Oswald Buddenhagen * The source directory structure changed entirely * The argument to the -debug command line option is now a bit field; the DebugLevel resource is gone * The ErrorLogFile resource is gone * The greeter module libKdmGreet.so has been converted to an executable named kdm_greet; the external config parser is now named kdm_config. The resource GreeterLib and the command line option -getcfg (and -cfg2get) are gone, as the locations of the config parser and greeter are derived from the location of the kdm executable * The config files are all located in ${kde_confdir}/kdm now; the defaults for Setup & Session were adapted to this. * The keys in kdmrc were reorganized: - [KDM]/ShutdownButton -> [X--Greeter]/(ShutdownButton & ShutdownNeedsRoot) - [KDM]/Shutdown -> [Shutdown]/HaltCmd - [KDM]/Restart -> [Shutdown]/RebootCmd - [KDM]/LogoArea -> [X-*-Greeter]/ {None,Logo,Clock} - remaining keys from [KDM] -> [X-*-Greeter]/ - [Lilo]/Lilo -> [Shutdown]/UseLilo - [Lilo]/LiloCommand -> [Shutdown]/LiloCmd - [Lilo]/LiloMap -> [Shutdown]/ - [Locale]/Language -> [X-*-Greeter]/ (Country key dropped) * KDM will no longer use kdm-config; most of its resources were absorbed into kdmrc: - Servers -> [General]/Xservers - RequestPort -> [Xdmcp]/(Port & Enable) - DaemonMode -> [General]/ - PidFile -> [General]/ - LockPidFile -> [General]/ - AuthDir -> [General]/ - AutoRescan -> [General]/ - RemoveDomainname -> [Xdmcp]/ - KeyFile -> [Xdmcp]/ - AccessFile -> [Xdmcp]/Xaccess/ - ExportList -> [General]/ - RandomFile -> [General]/ - ChoiceTimeout -> [Xdmcp]/ - SourceAddress -> [Xdmcp]/ - Willing -> [Xdmcp]/Xwilling - AutoLogin -> [General]/ - GrabServer -> [X--Greeter]/ - GrabTimeout -> [X--Greeter]/ - AuthComplain -> [X--Greeter]/ - AuthName -> [X--Core]/AuthNames - NoPassUsers -> [X--Core]/ & [X--Core]/NoPassEnable - AutoUser -> [X--Core]/(AutoLoginUser & AutoLoginEnable) - AutoPass -> [X--Core]/AutoLoginPass - AutoString -> [X--Core]/AutoLoginSession - remaining server & session resources -> [X--Core]/ * In GreetString the HOSTNAME substitution was replaced with the %%, %d, %h, %n, %s, %r & %m expandos * EchoMode does not understand "NoStars" any more. Use "NoEcho". * Defaults changed: AuthDir to /var/lib/kdm, KeyFile to $kdm_confdir/kdmkeys, Xservers to $kdm_confdir/Xservers, Xaccess to $kdm_confdir/Xaccess, Startup to $kdm_confdir/Xstartup, Reset to $kdm_confdir/Xreset, removed kde2 from SessionTypes * The previous user is now saved in $kdm_confdir/kdmsts, not kdmrc * Added option SessSaveFile, defaulting to .wmrc * Command line option changes: - -server, -udpPort, -resources, -session and -xrm are gone - -error is aliased to -logfile - -debug and -error/-logfile must be specified first - options are now accepted with both one and two leading dashes * The default Xsession will now - source ~/.xprofile if present - try harder to determine what executable $1 corresponds to - interpret "default" as ~/.xsession 2001-03-19 Oswald Buddenhagen * %DMNAME% and %DMPATH% are expanded in string resources; changed the defaults for PidFile and ConfigFile accordingly - the latter resulting in KDM now using kdm-config, NOT xdm-config * Use external config parser to merge platform-specific (that is, KDE-like) configuration data into the XDM resources; command line options -getcfg (default %DMPATH%_getcfg) and -cfg2get (no default, meaning kdm_getcfg will use $kde_confdir/kdmrc). * Changed "kde" to "kde2" in the default SessionTypes * Stolen idea for console mode handling from dtlogin; options ConsoleMode and AllowConsoleMode are gone; extension to Xservers 2001-01-19 Oswald Buddenhagen * Added resources AllowRootLogin and AllowNullPasswd 2001-01-15 Oswald Buddenhagen * Renamed UserIDLow option to MinShowUID * The LogoArea option now accepts the value "None" 2001-01-13 Oswald Buddenhagen * The GUIStyle option now works again and groks all of Qt's built-in widget styles and the "KDE" style 2001-01-11 Oswald Buddenhagen * Added placing of the greeter at fixed coordinates; options GreeterPosFixed, GreeterPosX, and GreeterPosY. * Added "default" to the default SessionTypes 2000-01-06 Oswald Buddenhagen * Added option AllowConsoleMode 2000-12-09 Oswald Buddenhagen * Added auto-login; options AutoLoginEnable, AutoLoginUser & AutoLogin1st; resources AutoUser, AutoPass, AutoString & AutoLogin1st * Added password-less login; options NoPassEnable & NoPassUsers; resource NoPassUsers * Added auto-re-login on XServer crash; resource & option AutoReLogin The kdmrc options and xdm-config resources are "ORed", i.e., if either is enabled, the function is enabled. The command line options -autolog/-noautolog and the resource AutoLogin can be used to disable auto-login and password-less login at once. * Added displaying the previously logged in user in the "Login" field; option ShowPrevious. The previous user is saved in kdmrc, section [Previous]. 2000-12-07 Oswald Buddenhagen * New XDM port from XFree86 4.0.1 - new resources SourceAddress & Willing - /authdir/authfiles is now automatically appended to AuthDir * Default for PidFile and Setup changed back to empty * Displays restarting too fast are disabled; resource StartInterval * Option UserView, and NoUsers dependency on Users being empty replaced with explicit option ShowUsers {All,Selected,None} * Made the greeter dynamically loadable (libKdmGreet.so) * Moved chooser and greeter to separate directories, same for unused stuff (misc/) * Added half-baked support for command FiFos; resources FifoCreate, FifoGroup, FifoMode. Replaced on 2001-11-02 2000-10-10 Steffen Hansen * Made kdmdesktop read the [Desktop0] section from kdmrc instead of kdmdesktoprc. 2000-09-07 Waldo Bastian * Make password echo mode configurable; option EchoMode {OneStar,ThreeStars,NoEcho} 2000-08-07 Christopher Molnar * The minimal user ID to show in the user view can be specified now; option UserIDLow. 2000-06-04 Espen Sand * The logo area can now display either a clock or a pixmap; option LogoArea {KdmClock,KdmLogo} 1999-12-12 Jaromir Dolecek * Use OS-specific defaults for Shutdown & Restart * Make PidFile, UserPath & SystemPath defaults on NetBSD match FreeBSD 1999-11-17 Harald Hoyer * Made kchooser 1999-11-15 Matthias Hoelzer-Kluepfel * kdmdesktop replaced with ../kdesktop/kdmdesktop. Uses new config file (kdmdesktoprc) with new options (all in section [Desktop0]): 1999-07-01 Steffen Hansen * Xaccess now accepts NOBROADCAST 1999-06-07 Matthias Hoelzer-Kluepfel * Added next boot OS selection via LiLo; options [Lilo] Lilo, LiloCommand & LiloMap * Added button to switch to console mode; option [KDM] ConsoleMode 1999-03-01 Stephan Kulow * Option GUIStyle temporarily removed 1998-10-08 Thomas Tanghus * [KDMDESKTOP] option changes: - BackgroundPictureTile, BackgroundPictureCenter, FancyBackground -> BackgroundPictureMode {None,Tile,Center,Scale, TopLeft,TopRight,BottomLeft,BottomRight,Fancy} - add BackGroundColorMode {Plain,Horizontal,Vertical} - BackgroundColor -> BackGroundColor1, BackGroundColor2 1998-09-20 Hans Petter Bieker * Change defaults: - Setup: "" -> XDMDIR/Xsetup - PidFile: "" -> FreeBSD: /var/run/kdm.pid, others: XDMDIR/kdm-pid - Session: "XBINDIR/xterm -ls" -> XDMDIR/Xsession - UserPath & SystemPath: no /usr/ucb for Linux & FreeBSD 1998-09-11 Hans Petter Bieker * Replace hard-coded paths with XBINDIR/XDMDIR in various defaults 1998-09-06 Hans Petter Bieker * Default Xsession now searches $1 in PATH and execs it 1998-03-26 Stephan Kulow * Nuke -kdedir cmdline option and Kdedir resource 1997-09-09 Steffen Hansen * Change defaults: - AuthDir: XDMDIR/authDir -> XDMDIR/authdir 1997-09-04 kdecvs * Change defaults: - AuthDir: XDMDIR -> XDMDIR/authDir diff --git a/kdm/backend/client.c b/kdm/backend/client.c index 4e54c9d864..240b883de1 100644 --- a/kdm/backend/client.c +++ b/kdm/backend/client.c @@ -1,1732 +1,1716 @@ /* Copyright 1988, 1998 The Open Group Copyright 2000-2004 Oswald Buddenhagen Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the copyright holder. */ /* * xdm - display manager daemon * Author: Keith Packard, MIT X Consortium * * user verification and session initiation. */ #include "dm.h" #include "dm_auth.h" #include "dm_error.h" #include #include #include #ifdef SECURE_RPC # include # include extern int key_setnet( struct key_netstarg *arg ); #endif #ifdef K5AUTH # include #endif #ifdef HAVE_SETUSERCONTEXT # include #endif #ifdef USE_PAM # ifdef HAVE_PAM_PAM_APPL_H # include # else # include # endif #elif defined(_AIX) /* USE_PAM */ # include # include extern int loginrestrictions( const char *Name, const int Mode, const char *Tty, char **Msg ); extern int loginfailed( const char *User, const char *Host, const char *Tty ); extern int loginsuccess( const char *User, const char *Host, const char *Tty, char **Msg ); #else /* USE_PAM || _AIX */ # ifdef USESHADOW # include # endif # ifdef KERBEROS # include # include # ifdef AFS # include # endif # endif /* for nologin */ # include # include /* for expiration */ # include #endif /* USE_PAM || _AIX */ /* * Session data, mostly what struct verify_info was for */ char *curuser; char *curpass; char *curtype; char *newpass; char **userEnviron; char **systemEnviron; static int curuid; static int curgid; int cursource; char *dmrcuser; char *curdmrc; char *newdmrc; static struct passwd *p; #ifdef HAVE_SETUSERCONTEXT # ifdef HAVE_LOGIN_GETCLASS login_cap_t *lc; # else struct login_cap *lc; # endif #endif #ifdef USE_PAM static pam_handle_t *pamh; #elif defined(_AIX) static char tty[16], hostname[100]; #else # ifdef USESHADOW static struct spwd *sp; # endif # ifdef KERBEROS static char krbtkfile[MAXPATHLEN]; # endif #endif #define V_RET_AUTH \ do { \ PrepErrorGreet (); \ GSendInt (V_AUTH); \ return 0; \ } while(0) #define V_RET_FAIL(m) \ do { \ PrepErrorGreet (); \ GSendInt (V_MSG_ERR); \ GSendStr (m); \ GSendInt (V_FAIL); \ return 0; \ } while(0) #ifdef USE_PAM # ifndef PAM_MESSAGE_CONST typedef struct pam_message pam_message_type; typedef void *pam_gi_type; # else typedef const struct pam_message pam_message_type; typedef const void *pam_gi_type; # endif struct pam_data { GConvFunc gconv; int usecur; int abort; }; static int PAM_conv( int num_msg, pam_message_type **msg, struct pam_response **resp, void *appdata_ptr ) { int count; struct pam_response *reply; struct pam_data *pd = (struct pam_data *)appdata_ptr; if (!(reply = Calloc( num_msg, sizeof(*reply) ))) return PAM_CONV_ERR; ReInitErrorLog(); Debug( "PAM_conv\n" ); for (count = 0; count < num_msg; count++) switch (msg[count]->msg_style) { case PAM_TEXT_INFO: Debug( " PAM_TEXT_INFO: %s\n", msg[count]->msg ); PrepErrorGreet(); GSendInt( V_MSG_INFO ); GSendStr( msg[count]->msg ); continue; case PAM_ERROR_MSG: Debug( " PAM_ERROR_MSG: %s\n", msg[count]->msg ); PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( msg[count]->msg ); continue; default: /* could do better error handling here, but see below ... */ if (pd->usecur) { switch (msg[count]->msg_style) { /* case PAM_PROMPT_ECHO_ON: cannot happen */ case PAM_PROMPT_ECHO_OFF: Debug( " PAM_PROMPT_ECHO_OFF (usecur): %s\n", msg[count]->msg ); if (!curpass) pd->gconv( GCONV_PASS, 0 ); StrDup( &reply[count].resp, curpass ); break; default: LogError( "Unknown PAM message style <%d>\n", msg[count]->msg_style ); goto conv_err; } } else { switch (msg[count]->msg_style) { case PAM_PROMPT_ECHO_ON: Debug( " PAM_PROMPT_ECHO_ON: %s\n", msg[count]->msg ); reply[count].resp = pd->gconv( GCONV_NORMAL, msg[count]->msg ); break; case PAM_PROMPT_ECHO_OFF: Debug( " PAM_PROMPT_ECHO_OFF: %s\n", msg[count]->msg ); reply[count].resp = pd->gconv( GCONV_HIDDEN, msg[count]->msg ); break; #ifdef PAM_BINARY_PROMPT case PAM_BINARY_PROMPT: Debug( " PAM_BINARY_PROMPT\n" ); reply[count].resp = pd->gconv( GCONV_BINARY, msg[count]->msg ); break; #endif default: LogError( "Unknown PAM message style <%d>\n", msg[count]->msg_style ); goto conv_err; } } if (!reply[count].resp) { Debug( " PAM_conv aborted\n" ); pd->abort = TRUE; goto conv_err; } reply[count].resp_retcode = PAM_SUCCESS; /* unused in linux-pam */ } Debug( " PAM_conv success\n" ); *resp = reply; return PAM_SUCCESS; conv_err: for (; count >= 0; count--) if (reply[count].resp) switch (msg[count]->msg_style) { case PAM_PROMPT_ECHO_ON: case PAM_PROMPT_ECHO_OFF: /* could wipe ... */ #ifdef PAM_BINARY_PROMPT case PAM_BINARY_PROMPT: /* ... that too ... */ #endif free( reply[count].resp ); break; } free( reply ); return PAM_CONV_ERR; } static int PAM_conv_null( int num_msg, pam_message_type **msg, struct pam_response **resp, void *appdata_ptr ATTR_UNUSED ) { int count; struct pam_response *reply; if (!(reply = Calloc( num_msg, sizeof(*reply) ))) return PAM_CONV_ERR; ReInitErrorLog(); Debug( "PAM_conv_null\n" ); for (count = 0; count < num_msg; count++) { switch (msg[count]->msg_style) { case PAM_TEXT_INFO: Debug( " PAM_TEXT_INFO: %s\n", msg[count]->msg ); continue; case PAM_ERROR_MSG: LogError( "PAM error message: %s\n", msg[count]->msg ); continue; default: /* unknown */ Debug( " PAM_<%d>\n", msg[count]->msg_style ); free( reply ); return PAM_CONV_ERR; } reply[count].resp_retcode = PAM_SUCCESS; /* unused in linux-pam */ } Debug( " PAM_conv_null success\n" ); *resp = reply; return PAM_SUCCESS; } # ifdef PAM_FAIL_DELAY static void fail_delay( int retval ATTR_UNUSED, unsigned usec_delay ATTR_UNUSED, void *appdata_ptr ATTR_UNUSED ) {} # endif static int doPAMAuth( const char *psrv, struct pam_data *pdata ) { pam_gi_type pitem; struct pam_conv pconv; int pretc; pdata->abort = FALSE; pconv.conv = PAM_conv; pconv.appdata_ptr = (void *)pdata; Debug( " PAM service %s\n", psrv ); if ((pretc = pam_start( psrv, curuser, &pconv, &pamh )) != PAM_SUCCESS) goto pam_bail2; if ((pretc = pam_set_item( pamh, PAM_TTY, td->name )) != PAM_SUCCESS) { pam_bail: pam_end( pamh, pretc ); pamh = 0; pam_bail2: ReInitErrorLog(); LogError( "PAM error: %s\n", pam_strerror( 0, pretc ) ); V_RET_FAIL( 0 ); } if ((td->displayType & d_location) == dForeign) { char *cp = strchr( td->name, ':' ); *cp = 0; pretc = pam_set_item( pamh, PAM_RHOST, td->name ); *cp = ':'; if (pretc != PAM_SUCCESS) goto pam_bail; } # ifdef PAM_FAIL_DELAY pam_set_item( pamh, PAM_FAIL_DELAY, (void *)fail_delay ); # endif ReInitErrorLog(); Debug( " pam_authenticate() ...\n" ); pretc = pam_authenticate( pamh, td->allowNullPasswd ? 0 : PAM_DISALLOW_NULL_AUTHTOK ); ReInitErrorLog(); Debug( " pam_authenticate() returned: %s\n", pam_strerror( pamh, pretc ) ); if (pdata->abort) { pam_end( pamh, PAM_SUCCESS ); pamh = 0; return 0; } if (!curuser) { Debug( " asking PAM for user ...\n" ); pam_get_item( pamh, PAM_USER, &pitem ); ReInitErrorLog(); StrDup( &curuser, (const char *)pitem ); GSendInt( V_PUT_USER ); GSendStr( curuser ); } if (pretc != PAM_SUCCESS) { switch (pretc) { case PAM_USER_UNKNOWN: case PAM_AUTH_ERR: case PAM_MAXTRIES: /* should handle this better ... */ case PAM_AUTHINFO_UNAVAIL: /* returned for unknown users ... bogus */ pam_end( pamh, pretc ); pamh = 0; V_RET_AUTH; default: pam_end( pamh, pretc ); pamh = 0; V_RET_FAIL( 0 ); } } return 1; } #endif /* USE_PAM */ static int #if defined(USE_PAM) || defined(_AIX) AccNoPass( const char *un ) { struct passwd *pw = 0; #else AccNoPass( const char *un, struct passwd *pw ) { #endif struct group *gr; char **fp; int hg; if (!*un) return 0; if (cursource != PWSRC_MANUAL) return 1; for (hg = 0, fp = td->noPassUsers; *fp; fp++) if (**fp == '@') hg = 1; else if (!strcmp( un, *fp )) return 1; else if (!strcmp( "*", *fp )) { #if defined(USE_PAM) || defined(_AIX) if (!(pw = getpwnam( un ))) return 0; #endif if (pw->pw_uid) return 1; } #if defined(USE_PAM) || defined(_AIX) if (hg && (pw || (pw = getpwnam( un )))) { #else if (hg) { #endif for (setgrent(); (gr = getgrent()); ) for (fp = td->noPassUsers; *fp; fp++) if (**fp == '@' && !strcmp( gr->gr_name, *fp + 1 )) { if (pw->pw_gid == gr->gr_gid) { endgrent(); return 1; } for (; *gr->gr_mem; gr->gr_mem++) if (!strcmp( un, *gr->gr_mem )) { endgrent(); return 1; } } endgrent(); } return 0; } #if !defined(USE_PAM) && !defined(_AIX) && defined(HAVE_SETUSERCONTEXT) # define LC_RET0 do { login_close(lc); return 0; } while(0) #else # define LC_RET0 return 0 #endif int Verify( GConvFunc gconv, int rootok ) { #ifdef USE_PAM const char *psrv; struct pam_data pdata; int pretc, pnopass; char psrvb[64]; #elif defined(_AIX) char *msg, *curret; int i, reenter; #else struct stat st; const char *nolg; char *buf; int fd; # ifdef HAVE_GETUSERSHELL char *s; # endif # if defined(HAVE_STRUCT_PASSWD_PW_EXPIRE) || defined(USESHADOW) int tim, expir, warntime, quietlog; # endif #endif Debug( "Verify ...\n" ); #ifdef USE_PAM pnopass = FALSE; if (!strcmp( curtype, "classic" )) { if (!gconv( GCONV_USER, 0 )) return 0; if (AccNoPass( curuser )) { gconv( GCONV_PASS_ND, 0 ); if (!*curpass) { pnopass = TRUE; sprintf( psrvb, "%.31s-np", PAMService ); psrv = psrvb; } else psrv = PAMService; } else psrv = PAMService; pdata.usecur = TRUE; } else { sprintf( psrvb, "%.31s-%.31s", PAMService, curtype ); psrv = psrvb; pdata.usecur = FALSE; } pdata.gconv = gconv; if (!doPAMAuth( psrv, &pdata )) return 0; #elif defined(_AIX) if ((td->displayType & d_location) == dForeign) { char *tmpch; strncpy( hostname, td->name, sizeof(hostname) - 1 ); hostname[sizeof(hostname)-1] = '\0'; if ((tmpch = strchr( hostname, ':' ))) *tmpch = '\0'; } else hostname[0] = '\0'; /* tty names should only be 15 characters long */ # if 0 for (i = 0; i < 15 && td->name[i]; i++) { if (td->name[i] == ':' || td->name[i] == '.') tty[i] = '_'; else tty[i] = td->name[i]; } tty[i] = '\0'; # else memcpy( tty, "/dev/xdm/", 9 ); for (i = 0; i < 6 && td->name[i]; i++) { if (td->name[i] == ':' || td->name[i] == '.') tty[9 + i] = '_'; else tty[9 + i] = td->name[i]; } tty[9 + i] = '\0'; # endif if (!strcmp( curtype, "classic" )) { if (!gconv( GCONV_USER, 0 )) return 0; if (AccNoPass( curuser )) { gconv( GCONV_PASS_ND, 0 ); if (!*curpass) { Debug( "accepting despite empty password\n" ); goto done; } } else if (!gconv( GCONV_PASS, 0 )) return 0; enduserdb(); msg = NULL; if ((i = authenticate( curuser, curpass, &reenter, &msg ))) { Debug( "authenticate() failed: %s\n", msg ); if (msg) free( msg ); loginfailed( curuser, hostname, tty ); if (i == ENOENT || i == ESAD) V_RET_AUTH; else V_RET_FAIL( 0 ); } if (reenter) { LogError( "authenticate() requests more data: %s\n", msg ); free( msg ); V_RET_FAIL( 0 ); } } else if (!strcmp( curtype, "generic" )) { if (!gconv( GCONV_USER, 0 )) return 0; for (curret = 0;;) { msg = NULL; if ((i = authenticate( curuser, curret, &reenter, &msg ))) { Debug( "authenticate() failed: %s\n", msg ); if (msg) free( msg ); loginfailed( curuser, hostname, tty ); if (i == ENOENT || i == ESAD) V_RET_AUTH; else V_RET_FAIL( 0 ); } if (curret) free( curret ); if (!reenter) break; if (!(curret = gconv( GCONV_HIDDEN, msg ))) return 0; free( msg ); } } else { LogError( "Unsupported authentication type %\"s requested\n", curtype ); V_RET_FAIL( 0 ); } if (msg) { PrepErrorGreet(); GSendInt( V_MSG_INFO ); GSendStr( msg ); free( msg ); } done: #else if (strcmp( curtype, "classic" )) { LogError( "Unsupported authentication type %\"s requested\n", curtype ); V_RET_FAIL( 0 ); } if (!gconv( GCONV_USER, 0 )) return 0; if (!(p = getpwnam( curuser ))) { Debug( "getpwnam() failed.\n" ); V_RET_AUTH; } # ifdef __linux__ /* only Linux? */ if (p->pw_passwd[0] == '!' || p->pw_passwd[0] == '*') { Debug( "account is locked\n" ); V_RET_AUTH; } # endif # ifdef USESHADOW if ((sp = getspnam( curuser ))) p->pw_passwd = sp->sp_pwdp; else Debug( "getspnam() failed: %m. Are you root?\n" ); # endif if (!*p->pw_passwd) { if (!td->allowNullPasswd) { Debug( "denying user with empty password\n" ); V_RET_AUTH; } goto nplogin; } if (AccNoPass( curuser, p )) { nplogin: gconv( GCONV_PASS_ND, 0 ); if (!*curpass) { Debug( "accepting password-less login\n" ); goto done; } } else if (!gconv( GCONV_PASS, 0 )) return 0; # ifdef KERBEROS if (p->pw_uid) { int ret; char realm[REALM_SZ]; if (krb_get_lrealm( realm, 1 )) { LogError( "Can't get KerberosIV realm.\n" ); V_RET_FAIL( 0 ); } sprintf( krbtkfile, "%s.%.*s", TKT_ROOT, MAXPATHLEN - strlen( TKT_ROOT ) - 2, td->name ); krb_set_tkt_string( krbtkfile ); unlink( krbtkfile ); ret = krb_verify_user( curuser, "", realm, curpass, 1, "rcmd" ); if (ret == KSUCCESS) { chown( krbtkfile, p->pw_uid, p->pw_gid ); Debug( "KerberosIV verify succeeded\n" ); goto done; } else if (ret != KDC_PR_UNKNOWN && ret != SKDC_CANT) { LogError( "KerberosIV verification failure %\"s for %s\n", krb_get_err_text( ret ), curuser ); krbtkfile[0] = '\0'; V_RET_FAIL( 0 ); } Debug( "KerberosIV verify failed: %s\n", krb_get_err_text( ret ) ); } krbtkfile[0] = '\0'; # endif /* KERBEROS */ # if defined(ultrix) || defined(__ultrix__) if (authenticate_user( p, curpass, NULL ) < 0) # elif defined(HAVE_CRYPT) if (strcmp( crypt( curpass, p->pw_passwd ), p->pw_passwd )) # else if (strcmp( curpass, p->pw_passwd )) # endif { Debug( "password verify failed\n" ); V_RET_AUTH; } done: #endif /* !defined(USE_PAM) && !defined(_AIX) */ Debug( "restrict %s ...\n", curuser ); #if defined(USE_PAM) || defined(_AIX) if (!(p = getpwnam( curuser ))) { LogError( "getpwnam(%s) failed.\n", curuser ); V_RET_FAIL( 0 ); } #endif if (!p->pw_uid) { if (!rootok && !td->allowRootLogin) V_RET_FAIL( "Root logins are not allowed" ); return 1; /* don't deny root to log in */ } #ifdef USE_PAM Debug( " pam_acct_mgmt() ...\n" ); pretc = pam_acct_mgmt( pamh, 0 ); ReInitErrorLog(); Debug( " pam_acct_mgmt() returned: %s\n", pam_strerror( pamh, pretc ) ); if (pretc == PAM_NEW_AUTHTOK_REQD) { pdata.usecur = FALSE; pdata.gconv = conv_interact; /* pam will have output a message already, so no PrepErrorGreet () */ if (gconv != conv_interact || pnopass) { pam_end( pamh, PAM_SUCCESS ); pamh = 0; GSendInt( V_CHTOK_AUTH ); /* this cannot auth the wrong user, as only classic auths get here */ while (!doPAMAuth( PAMService, &pdata )) if (pdata.abort) return 0; GSendInt( V_PRE_OK ); } else GSendInt( V_CHTOK ); for (;;) { Debug( " pam_chauthtok() ...\n" ); pretc = pam_chauthtok( pamh, PAM_CHANGE_EXPIRED_AUTHTOK ); ReInitErrorLog(); Debug( " pam_chauthtok() returned: %s\n", pam_strerror( pamh, pretc ) ); if (pdata.abort) { pam_end( pamh, PAM_SUCCESS ); pamh = 0; return 0; } if (pretc == PAM_SUCCESS) break; /* effectively there is only PAM_AUTHTOK_ERR */ GSendInt( V_FAIL ); } if (curpass) free( curpass ); curpass = newpass; newpass = 0; } else if (pretc != PAM_SUCCESS) { pam_end( pamh, pretc ); pamh = 0; V_RET_AUTH; } #elif defined(_AIX) /* USE_PAM */ msg = NULL; if (loginrestrictions( curuser, ((td->displayType & d_location) == dForeign) ? S_RLOGIN : S_LOGIN, tty, &msg ) == -1) { Debug( "loginrestrictions() - %s\n", msg ? msg : "error" ); loginfailed( curuser, hostname, tty ); PrepErrorGreet(); if (msg) { GSendInt( V_MSG_ERR ); GSendStr( msg ); } GSendInt( V_AUTH ); return 0; } if (msg) free( (void *)msg ); #endif /* USE_PAM || _AIX */ #ifndef _AIX # ifdef HAVE_SETUSERCONTEXT # ifdef HAVE_LOGIN_GETCLASS lc = login_getclass( p->pw_class ); # else lc = login_getpwclass( p ); # endif if (!lc) V_RET_FAIL( 0 ); p->pw_shell = login_getcapstr( lc, "shell", p->pw_shell, p->pw_shell ); # endif # ifndef USE_PAM /* restrict_expired */ # if defined(HAVE_STRUCT_PASSWD_PW_EXPIRE) || defined(USESHADOW) # if !defined(HAVE_STRUCT_PASSWD_PW_EXPIRE) || (!defined(HAVE_SETUSERCONTEXT) && defined(USESHADOW)) if (sp) # endif { # define DEFAULT_WARN (2L * 7L) /* Two weeks */ tim = time( NULL ) / 86400L; # ifdef HAVE_SETUSERCONTEXT quietlog = login_getcapbool( lc, "hushlogin", 0 ); warntime = login_getcaptime( lc, "warnexpire", DEFAULT_WARN * 86400L, DEFAULT_WARN * 86400L ) / 86400L; # else quietlog = 0; # ifdef USESHADOW warntime = sp->sp_warn != -1 ? sp->sp_warn : DEFAULT_WARN; # else warntime = DEFAULT_WARN; # endif # endif # ifdef HAVE_STRUCT_PASSWD_PW_EXPIRE if (p->pw_expire) { expir = p->pw_expire / 86400L; # else if (sp->sp_expire != -1) { expir = sp->sp_expire; # endif if (tim > expir) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( "Your account has expired;" " please contact your system administrator" ); GSendInt( V_FAIL ); LC_RET0; } else if (tim > (expir - warntime) && !quietlog) { ASPrintf( &buf, "Warning: your account will expire in %d day(s)", expir - tim ); if (buf) { PrepErrorGreet(); GSendInt( V_MSG_INFO ); GSendStr( buf ); free( buf ); } } } # ifdef HAVE_STRUCT_PASSWD_PW_EXPIRE if (p->pw_change) { expir = p->pw_change / 86400L; # else if (!sp->sp_lstchg) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( "You are required to change your password immediately" " (root enforced)" ); /* XXX todo password change */ GSendInt( V_FAIL ); LC_RET0; } else if (sp->sp_max != -1) { expir = sp->sp_lstchg + sp->sp_max; if (sp->sp_inact != -1 && tim > expir + sp->sp_inact) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( "Your account has expired;" " please contact your system administrator" ); GSendInt( V_FAIL ); LC_RET0; } # endif if (tim > expir) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( "You are required to change your password immediately" " (password aged)" ); /* XXX todo password change */ GSendInt( V_FAIL ); LC_RET0; } else if (tim > (expir - warntime) && !quietlog) { ASPrintf( &buf, "Warning: your password will expire in %d day(s)", expir - tim ); if (buf) { PrepErrorGreet(); GSendInt( V_MSG_INFO ); GSendStr( buf ); free( buf ); } } } } # endif /* HAVE_STRUCT_PASSWD_PW_EXPIRE || USESHADOW */ /* restrict_nologin */ # ifndef _PATH_NOLOGIN # define _PATH_NOLOGIN "/etc/nologin" # endif if (( # ifdef HAVE_SETUSERCONTEXT /* Do we ignore a nologin file? */ !login_getcapbool( lc, "ignorenologin", 0 )) && (!stat( (nolg = login_getcapstr( lc, "nologin", "", NULL )), &st ) || # endif !stat( (nolg = _PATH_NOLOGIN), &st ))) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); if (st.st_size && (fd = open( nolg, O_RDONLY )) >= 0) { if ((buf = Malloc( st.st_size + 1 ))) { if (read( fd, buf, st.st_size ) == st.st_size) { buf[st.st_size] = 0; GSendStr( buf ); free( buf ); close( fd ); GSendInt( V_FAIL ); LC_RET0; } free( buf ); } close( fd ); } GSendStr( "Logins are not allowed at the moment.\nTry again later" ); GSendInt( V_FAIL ); LC_RET0; } /* restrict_time */ # if defined(HAVE_SETUSERCONTEXT) && defined(HAVE_AUTH_TIMEOK) if (!auth_timeok( lc, time( NULL ) )) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( "You are not allowed to login at the moment" ); GSendInt( V_FAIL ); LC_RET0; } # endif # ifdef HAVE_GETUSERSHELL for (;;) { if (!(s = getusershell())) { Debug( "shell not in /etc/shells\n" ); endusershell(); V_RET_FAIL( "Your login shell is not listed in /etc/shells" ); } if (!strcmp( s, p->pw_shell )) { endusershell(); break; } } # endif # endif /* !USE_PAM */ /* restrict_nohome */ # ifdef HAVE_SETUSERCONTEXT if (login_getcapbool( lc, "requirehome", 0 )) { struct stat st; if (!*p->pw_dir || stat( p->pw_dir, &st ) || st.st_uid != p->pw_uid) { PrepErrorGreet(); GSendInt( V_MSG_ERR ); GSendStr( "Home folder not available" ); GSendInt( V_FAIL ); LC_RET0; } } # endif #endif /* !_AIX */ return 1; } static const char *envvars[] = { "TZ", /* SYSV and SVR4, but never hurts */ #ifdef _AIX "AUTHSTATE", /* for kerberos */ #endif NULL }; #if defined(USE_PAM) && defined(HAVE_INITGROUPS) int num_saved_gids; gid_t saved_gids[NGROUPS]; static int saveGids( void ) { if ((num_saved_gids = getgroups( as(saved_gids), saved_gids )) < 0) { LogError( "saving groups failed: %m\n" ); return 0; } return 1; } static int restoreGids( void ) { if (setgroups( num_saved_gids, saved_gids ) < 0) { LogError( "restoring groups failed: %m\n" ); return 0; } if (setgid( p->pw_gid ) < 0) { LogError( "restoring gid failed: %m\n" ); return 0; } return 1; } #endif /* USE_PAM && HAVE_INITGROUPS */ static int resetGids( void ) { #ifdef HAVE_INITGROUPS if (setgroups( 0, &p->pw_gid /* anything */ ) < 0) { LogError( "restoring groups failed: %m\n" ); return 0; } #endif if (setgid( 0 ) < 0) { LogError( "restoring gid failed: %m\n" ); return 0; } return 1; } static int SetGid( const char *name, int gid ) { if (setgid( gid ) < 0) { LogError( "setgid(%d) (user %s) failed: %m\n", gid, name ); return 0; } #ifdef HAVE_INITGROUPS if (initgroups( name, gid ) < 0) { LogError( "initgroups for %s failed: %m\n", name ); setgid( 0 ); return 0; } #endif /* QNX4 doesn't support multi-groups, no initgroups() */ return 1; } static int SetUid( const char *name, int uid ) { if (setuid( uid ) < 0) { LogError( "setuid(%d) (user %s) failed: %m\n", uid, name ); return 0; } return 1; } static int SetUser( const char *name, int uid, int gid ) { if (SetGid( name, gid )) { if (SetUid( name, uid )) return 1; resetGids(); } return 0; } #if defined(SECURE_RPC) || defined(K5AUTH) static void NukeAuth( int len, const char *name ) { int i; for (i = 0; i < td->authNum; i++) if (td->authorizations[i]->name_length == len && !memcmp( td->authorizations[i]->name, name, len )) { memcpy( &td->authorizations[i], &td->authorizations[i+1], sizeof(td->authorizations[i]) * (--td->authNum - i) ); break; } } #endif static void mergeSessionArgs( int cansave ) { char *mfname; const char *fname; int i, needsave; mfname = 0; fname = ".dmrc"; if ((!curdmrc || newdmrc) && *dmrcDir) if (StrApp( &mfname, dmrcDir, "/", curuser, fname, (char *)0 )) fname = mfname; needsave = 0; if (!curdmrc) { curdmrc = iniLoad( fname ); if (!curdmrc) { StrDup( &curdmrc, "[Desktop]\nSession=default\n" ); needsave = 1; } } if (newdmrc) { curdmrc = iniMerge( curdmrc, newdmrc ); needsave = 1; } if (needsave && cansave) if (!iniSave( curdmrc, fname ) && errno == ENOENT && mfname) { for (i = 0; mfname[i]; i++) if (mfname[i] == '/') { mfname[i] = 0; mkdir( mfname, 0755 ); mfname[i] = '/'; } iniSave( curdmrc, mfname ); } if (mfname) free( mfname ); } static int removeAuth; #ifdef USE_PAM static int removeSession; static int removeCreds; #endif int StartClient() { const char *home, *sessargs, *desksess; char **env, *xma; char **argv, *fname, *str; #ifdef USE_PAM char ** volatile pam_env; # ifndef HAVE_PAM_GETENVLIST char **saved_env; # endif struct pam_conv pconv; int pretc; #else # ifdef _AIX char *msg; char **theenv; extern char **newenv; /* from libs.a, this is set up by setpenv */ # endif #endif #ifdef HAVE_SETUSERCONTEXT extern char **environ; #endif char *failsafeArgv[2], *lname; int i, pid, lfd; if (StrCmp( dmrcuser, curuser )) { if (curdmrc) { free( curdmrc ); curdmrc = 0; } if (dmrcuser) { free( dmrcuser ); dmrcuser = 0; } } #if defined(USE_PAM) || defined(_AIX) if (!(p = getpwnam( curuser ))) { LogError( "getpwnam(%s) failed.\n", curuser ); return 0; } #endif #ifndef USE_PAM # ifdef _AIX msg = NULL; loginsuccess( curuser, hostname, tty, &msg ); if (msg) { Debug( "loginsuccess() - %s\n", msg ); free( (void *)msg ); } # else /* _AIX */ # if defined(KERBEROS) && defined(AFS) if (krbtkfile[0] != '\0') { if (k_hasafs()) { if (k_setpag() == -1) LogError( "setpag() for %s failed\n", curuser ); if ((ret = k_afsklog( NULL, NULL )) != KSUCCESS) LogError( "AFS Warning: %s\n", krb_get_err_text( ret ) ); } } # endif /* KERBEROS && AFS */ # endif /* _AIX */ #endif /* !PAM */ curuid = p->pw_uid; curgid = p->pw_gid; env = baseEnv( curuser ); xma = 0; - if (td->ctrl.fpath && StrDup( &xma, td->ctrl.fpath )) { - if ((td->allowShutdown == SHUT_ALL || - (td->allowShutdown == SHUT_ROOT && !curuser)) && - StrApp( &xma, ",maysd", (char *)0 )) - { - if (td->allowNuke == SHUT_ALL || - (td->allowNuke == SHUT_ROOT && !curuser)) - StrApp( &xma, ",mayfn", (char *)0 ); - StrApp( &xma, td->defSdMode == SHUT_FORCENOW ? ",fn" : - td->defSdMode == SHUT_TRYNOW ? ",tn" : ",sched", - (char *)0 ); - } - if ((td->displayType & d_location) == dLocal && AnyReserveDisplays()) - StrApp( &xma, ",rsvd", (char *)0 ); - } else - StrDup( &xma, "true" ); - StrApp( &xma, ",method=", curtype, (char *)0 ); + StrApp( &xma, "method=", curtype, (char *)0 ); if (td_setup) StrApp( &xma, ",auto", (char *)0 ); if (xma) { env = setEnv( env, "XDM_MANAGED", xma ); free( xma ); } if (td->autoLock && cursource == PWSRC_AUTOLOGIN) env = setEnv( env, "DESKTOP_LOCKED", "true" ); env = setEnv( env, "PATH", curuid ? td->userPath : td->systemPath ); env = setEnv( env, "SHELL", p->pw_shell ); env = setEnv( env, "HOME", p->pw_dir ); #if !defined(USE_PAM) && !defined(_AIX) && defined(KERBEROS) if (krbtkfile[0] != '\0') env = setEnv( env, "KRBTKFILE", krbtkfile ); #endif userEnviron = inheritEnv( env, envvars ); env = systemEnv( curuser ); systemEnviron = setEnv( env, "HOME", p->pw_dir ); Debug( "user environment:\n%[|''>'\n's" "system environment:\n%[|''>'\n's" "end of environments\n", userEnviron, systemEnviron ); /* * for user-based authorization schemes, * add the user to the server's allowed "hosts" list. */ for (i = 0; i < td->authNum; i++) { #ifdef SECURE_RPC if (td->authorizations[i]->name_length == 9 && !memcmp( td->authorizations[i]->name, "SUN-DES-1", 9 )) { XHostAddress addr; char netname[MAXNETNAMELEN+1]; char domainname[MAXNETNAMELEN+1]; getdomainname( domainname, sizeof(domainname) ); user2netname( netname, curuid, domainname ); addr.family = FamilyNetname; addr.length = strlen( netname ); addr.address = netname; XAddHost( dpy, &addr ); } #endif #ifdef K5AUTH if (td->authorizations[i]->name_length == 14 && !memcmp( td->authorizations[i]->name, "MIT-KERBEROS-5", 14 )) { /* Update server's auth file with user-specific info. * Don't need to AddHost because X server will do that * automatically when it reads the cache we are about * to point it at. */ XauDisposeAuth( td->authorizations[i] ); td->authorizations[i] = Krb5GetAuthFor( 14, "MIT-KERBEROS-5", td->name ); SaveServerAuthorizations( td, td->authorizations, td->authNum ); } #endif } if (*dmrcDir) mergeSessionArgs( TRUE ); Debug( "now starting the session\n" ); #ifdef USE_PAM /* the greeter is gone by now ... */ pconv.conv = PAM_conv_null; pconv.appdata_ptr = 0; if ((pretc = pam_set_item( pamh, PAM_CONV, &pconv )) != PAM_SUCCESS) { ReInitErrorLog(); LogError( "pam_set_item() for %s failed: %s\n", curuser, pam_strerror( pamh, pretc ) ); return 0; } ReInitErrorLog(); #endif #ifdef USE_PAM # ifdef HAVE_SETUSERCONTEXT if (setusercontext( lc, p, p->pw_uid, LOGIN_SETGROUP )) { LogError( "setusercontext(groups) for %s failed: %m\n", curuser ); return 0; } # else if (!SetGid( curuser, curgid )) return 0; # endif # ifndef HAVE_PAM_GETENVLIST if (!(pam_env = initStrArr( 0 ))) { resetGids(); return 0; } saved_env = environ; environ = pam_env; # endif removeCreds = 1; /* set it first - i don't trust PAM's rollback */ pretc = pam_setcred( pamh, 0 ); ReInitErrorLog(); # ifndef HAVE_PAM_GETENVLIST pam_env = environ; environ = saved_env; # endif # ifdef HAVE_INITGROUPS /* This seems to be a strange place for it, but do it: - after the initial groups are set - after pam_setcred might have set something, even in the error case - before pam_setcred(DELETE_CRED) might need it */ if (!saveGids()) return 0; # endif if (pretc != PAM_SUCCESS) { LogError( "pam_setcred() for %s failed: %s\n", curuser, pam_strerror( pamh, pretc ) ); resetGids(); return 0; } removeSession = 1; /* set it first - same as above */ pretc = pam_open_session( pamh, 0 ); ReInitErrorLog(); if (pretc != PAM_SUCCESS) { LogError( "pam_open_session() for %s failed: %s\n", curuser, pam_strerror( pamh, pretc ) ); resetGids(); return 0; } /* we don't want sessreg and the startup/reset scripts run with user credentials. unfortunately, we can reset only the gids. */ resetGids(); # define D_LOGIN_SETGROUPS LOGIN_SETGROUPS #else /* USE_PAM */ # define D_LOGIN_SETGROUPS 0 #endif /* USE_PAM */ removeAuth = 1; chownCtrl( &td->ctrl, curuid ); endpwent(); #if !defined(USE_PAM) && defined(USESHADOW) && !defined(_AIX) endspent(); #endif ClearCloseOnFork( mstrtalk.pipe->wfd ); switch (pid = Fork()) { case 0: sessreg( td, getpid(), curuser, curuid ); if (source( systemEnviron, td->startup, td_setup )) { LogError( "Cannot execute startup script %\"s\n", td->startup ); exit( 1 ); } if (Setjmp( mstrtalk.errjmp )) exit( 1 ); GSet( &mstrtalk ); setsid(); /* Memory leaks are ok here as we exec() soon. */ #if defined(USE_PAM) || !defined(_AIX) # ifdef USE_PAM /* pass in environment variables set by libpam and modules it called */ # ifdef HAVE_PAM_GETENVLIST pam_env = pam_getenvlist( pamh ); ReInitErrorLog(); # endif if (pam_env) for (; *pam_env; pam_env++) userEnviron = putEnv( *pam_env, userEnviron ); # endif # ifdef HAVE_SETLOGIN if (setlogin( curuser ) < 0) { LogError( "setlogin for %s failed: %m\n", curuser ); exit( 1 ); } # define D_LOGIN_SETLOGIN LOGIN_SETLOGIN # else # define D_LOGIN_SETLOGIN 0 # endif # if defined(USE_PAM) && defined(HAVE_INITGROUPS) if (!restoreGids()) exit( 1 ); # endif # ifndef HAVE_SETUSERCONTEXT # ifdef USE_PAM if (!SetUid( curuser, curuid )) exit( 1 ); # else if (!SetUser( curuser, curuid, curgid )) exit( 1 ); # endif # else /* !HAVE_SETUSERCONTEXT */ /* * Destroy environment. * We need to do this before setusercontext() because that may * set or reset some environment variables. */ if (!(environ = initStrArr( 0 ))) exit( 1 ); /* * Set the user's credentials: uid, gid, groups, * environment variables, resource limits, and umask. */ if (setusercontext( lc, p, p->pw_uid, LOGIN_SETALL & ~(D_LOGIN_SETGROUPS|D_LOGIN_SETLOGIN) ) < 0) { LogError( "setusercontext for %s failed: %m\n", curuser ); exit( 1 ); } for (i = 0; environ[i]; i++) userEnviron = putEnv( environ[i], userEnviron ); # endif /* !HAVE_SETUSERCONTEXT */ #else /* PAM || !_AIX */ /* * Set the user's credentials: uid, gid, groups, * audit classes, user limits, and umask. */ if (setpcred( curuser, NULL ) == -1) { LogError( "setpcred for %s failed: %m\n", curuser ); exit( 1 ); } /* * Set the users process environment. Store protected variables and * obtain updated user environment list. This call will initialize * global 'newenv'. */ if (setpenv( curuser, PENV_INIT | PENV_ARGV | PENV_NOEXEC, userEnviron, NULL ) != 0) { LogError( "Can't set %s's process environment\n", curuser ); exit( 1 ); } userEnviron = newenv; #endif /* _AIX */ /* * for user-based authorization schemes, * use the password to get the user's credentials. */ #ifdef SECURE_RPC /* do like "keylogin" program */ if (!curpass[0]) LogInfo( "No password for NIS provided.\n" ); else { char netname[MAXNETNAMELEN+1], secretkey[HEXKEYBYTES+1]; int nameret, keyret; int len; int key_set_ok = 0; struct key_netstarg netst; nameret = getnetname( netname ); Debug( "user netname: %s\n", netname ); len = strlen( curpass ); if (len > 8) bzero( curpass + 8, len - 8 ); keyret = getsecretkey( netname, secretkey, curpass ); Debug( "getsecretkey returns %d, key length %d\n", keyret, strlen( secretkey ) ); netst.st_netname = netname; memcpy( netst.st_priv_key, secretkey, HEXKEYBYTES ); memset( netst.st_pub_key, 0, HEXKEYBYTES ); if (key_setnet( &netst ) < 0) Debug( "Could not set secret key.\n" ); /* is there a key, and do we have the right password? */ if (keyret == 1) { if (*secretkey) { keyret = key_setsecret( secretkey ); Debug( "key_setsecret returns %d\n", keyret ); if (keyret == -1) LogError( "Failed to set NIS secret key\n" ); else key_set_ok = 1; } else { /* found a key, but couldn't interpret it */ LogError( "Password incorrect for NIS principal %s\n", nameret ? netname : curuser ); } } if (!key_set_ok) NukeAuth( 9, "SUN-DES-1" ); bzero( secretkey, strlen( secretkey ) ); } #endif #ifdef K5AUTH /* do like "kinit" program */ if (!curpass[0]) LogInfo( "No password for Kerberos5 provided.\n" ); else if ((str = Krb5Init( curuser, curpass, td->name ))) userEnviron = setEnv( userEnviron, "KRB5CCNAME", str ); else NukeAuth( 14, "MIT-KERBEROS-5" ); #endif /* K5AUTH */ if (td->autoReLogin) { GSendInt( D_ReLogin ); GSendStr( curuser ); GSendStr( curpass ); GSendStr( newdmrc ); } if (curpass) bzero( curpass, strlen( curpass ) ); SetUserAuthorization( td ); home = getEnv( userEnviron, "HOME" ); if (home) { if (chdir( home ) < 0) { LogError( "Cannot chdir to %s's home %s: %m, using /\n", curuser, home ); home = 0; userEnviron = setEnv( userEnviron, "HOME", "/" ); goto cdroot; } ASPrintf( &lname, td->clientLogFile, td->name ); if ((lfd = creat( lname, 0600 )) < 0) { LogWarn( "Cannot create session log file %s: %m\n", lname ); free( lname ); goto tmperr; } } else { cdroot: chdir( "/" ); tmperr: ASPrintf( &lname, "/tmp/xerr-%s-%s", curuser, td->name ); unlink( lname ); if ((lfd = open( lname, O_WRONLY|O_CREAT|O_EXCL, 0600 )) < 0) { LogError( "Cannot create fallback session log file %s: %m\n", lname ); goto logerr; } } dup2( lfd, 1 ); dup2( lfd, 2 ); close( lfd ); logerr: free( lname ); if (!*dmrcDir) mergeSessionArgs( home != 0 ); if (!(desksess = iniEntry( curdmrc, "Desktop", "Session", 0 ))) desksess = "failsafe"; /* only due to OOM */ GSendInt( D_User ); GSendInt( curuid ); GSendStr( curuser ); GSendStr( desksess ); close( mstrtalk.pipe->wfd ); userEnviron = setEnv( userEnviron, "DESKTOP_SESSION", desksess ); for (i = 0; td->sessionsDirs[i]; i++) { fname = 0; if (StrApp( &fname, td->sessionsDirs[i], "/", desksess, ".desktop", (char *)0 )) { if ((str = iniLoad( fname ))) { if (!StrCmp( iniEntry( str, "Desktop Entry", "Hidden", 0 ), "true" ) || !(sessargs = iniEntry( str, "Desktop Entry", "Exec", 0 ))) sessargs = ""; free( str ); free( fname ); goto gotit; } free( fname ); } } if (!strcmp( desksess, "failsafe" ) || !strcmp( desksess, "default" ) || !strcmp( desksess, "custom" )) sessargs = desksess; else sessargs = ""; gotit: if (!(argv = parseArgs( (char **)0, td->session )) || !(argv = addStrArr( argv, sessargs, -1 ))) exit( 1 ); if (argv[0] && *argv[0]) { Debug( "executing session %\"[s\n", argv ); execute( argv, userEnviron ); LogError( "Session %\"s execution failed: %m\n", argv[0] ); } else LogError( "Session has no command/arguments\n" ); failsafeArgv[0] = td->failsafeClient; failsafeArgv[1] = 0; execute( failsafeArgv, userEnviron ); LogError( "Failsafe client %\"s execution failed: %m\n", failsafeArgv[0] ); exit( 1 ); case -1: RegisterCloseOnFork( mstrtalk.pipe->wfd ); LogError( "Forking session on %s failed: %m\n", td->name ); return 0; default: RegisterCloseOnFork( mstrtalk.pipe->wfd ); Debug( "StartSession, fork succeeded %d\n", pid ); return pid; } } void SessionExit( int status ) { int pid; #ifdef USE_PAM int pretc; #endif if (removeAuth) { if (source( systemEnviron, td->reset, td_setup )) LogError( "Cannot execute reset script %\"s\n", td->reset ); sessreg( td, 0, 0, 0 ); switch ((pid = Fork())) { case 0: #if defined(USE_PAM) && defined(HAVE_INITGROUPS) if (restoreGids() && SetUid( curuser, curuid )) #else if (SetUser( curuser, curuid, curgid )) #endif { RemoveUserAuthorization( td ); #ifdef K5AUTH Krb5Destroy( td->name ); #endif /* K5AUTH */ #if !defined(USE_PAM) && !defined(_AIX) # ifdef KERBEROS if (krbtkfile[0]) { (void)dest_tkt(); # ifdef AFS if (k_hasafs()) (void)k_unlog(); # endif } # endif #endif /* !USE_PAM && !_AIX*/ } exit( 0 ); case -1: LogError( "Cannot clean up session: fork() failed: %m" ); break; default: Wait4( pid ); break; } } #ifdef USE_PAM if (removeCreds) { # ifdef HAVE_INITGROUPS restoreGids(); # endif if (removeSession) if ((pretc = pam_close_session( pamh, 0 )) != PAM_SUCCESS) LogError( "pam_close_session() failed: %s\n", pam_strerror( pamh, pretc ) ); if ((pretc = pam_setcred( pamh, PAM_DELETE_CRED )) != PAM_SUCCESS) LogError( "pam_setcred(DELETE_CRED) failed: %s\n", pam_strerror( pamh, pretc ) ); resetGids(); } if (pamh) { pam_end( pamh, PAM_SUCCESS ); ReInitErrorLog(); } #endif /* make sure the server gets reset after the session is over */ if (td->serverPid >= 2) { if (!td->terminateServer && td->resetSignal) TerminateProcess( td->serverPid, td->resetSignal ); } else ResetServer( td ); Debug( "display %s exiting with status %d\n", td->name, status ); exit( status ); } int ReadDmrc() { char *data, *fname = 0; int len, pid, pfd[2], err; if (!dmrcuser || !dmrcuser[0] || !(p = getpwnam( dmrcuser ))) return GE_NoUser; if (*dmrcDir) { if (!StrApp( &fname, dmrcDir, "/", dmrcuser, ".dmrc", (char *)0 )) return GE_Error; if (!(curdmrc = iniLoad( fname ))) { free( fname ); return GE_Ok; } free( fname ); return GE_NoFile; } if (!StrApp( &fname, p->pw_dir, "/.dmrc", (char *)0 )) return GE_Error; if (pipe( pfd )) return GE_Error; if ((pid = Fork()) < 0) { close( pfd[0] ); close( pfd[1] ); return GE_Error; } if (!pid) { if (!SetUser( p->pw_name, p->pw_uid, p->pw_gid )) exit( 0 ); if (!(data = iniLoad( fname ))) { static const int m1 = -1; write( pfd[1], &m1, sizeof(int) ); exit( 0 ); } len = strlen( data ); write( pfd[1], &len, sizeof(int) ); write( pfd[1], data, len + 1 ); exit( 0 ); } close( pfd[1] ); free( fname ); err = GE_Error; if (Reader( pfd[0], &len, sizeof(int) ) == sizeof(int)) { if (len == -1) err = GE_Denied; else if ((curdmrc = Malloc( len + 1 ))) { if (Reader( pfd[0], curdmrc, len + 1 ) == len + 1) err = GE_Ok; else { free( curdmrc ); curdmrc = 0; } } } close( pfd[0] ); (void)Wait4( pid ); return err; } diff --git a/kdm/backend/ctrl.c b/kdm/backend/ctrl.c index d813af0f28..e5b1fd54f7 100644 --- a/kdm/backend/ctrl.c +++ b/kdm/backend/ctrl.c @@ -1,955 +1,902 @@ /* Copyright 1988, 1998 The Open Group Copyright 2001-2005 Oswald Buddenhagen Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the copyright holder. */ /* * xdm - display manager daemon * Author: Keith Packard, MIT X Consortium * * display manager */ #include "dm.h" #include "dm_socket.h" #include "dm_error.h" #include #include #include static void acceptSock( CtrlRec *cr ) { struct cmdsock *cs; int fd; if ((fd = accept( cr->fd, 0, 0 )) < 0) { bust: LogError( "Error accepting command connection\n" ); return; } if (!(cs = Malloc( sizeof(*cs) ))) { close( fd ); goto bust; } cs->sock.fd = fd; cs->sock.buffer = 0; cs->sock.buflen = 0; cs->next = cr->css; cr->css = cs; fcntl( fd, F_SETFL, fcntl( fd, F_GETFL ) | O_NONBLOCK ); RegisterCloseOnFork( fd ); RegisterInput( fd ); } static void nukeSock( struct cmdsock *cs ) { UnregisterInput( cs->sock.fd ); CloseNClearCloseOnFork( cs->sock.fd ); if (cs->sock.buffer) free( cs->sock.buffer ); free( cs ); } -static CtrlRec ctrl = { 0, 0, -1, 0, 0, { -1, 0, 0 } }; +static CtrlRec ctrl = { 0, 0, -1, 0 }; void openCtrl( struct display *d ) { CtrlRec *cr; const char *dname; char *sockdir; struct sockaddr_un sa; if (!*fifoDir) return; if (d) { cr = &d->ctrl, dname = d->name; if (!memcmp( dname, "localhost:", 10 )) dname += 9; } else cr = &ctrl, dname = 0; - if (cr->fifo.fd < 0) { + if (cr->fd < 0) { if (mkdir( fifoDir, 0755 )) { if (errno != EEXIST) { LogError( "mkdir %\"s failed; no control FiFos will be available\n", fifoDir ); return; } } else chmod( fifoDir, 0755 ); /* override umask */ - StrApp( &cr->fpath, fifoDir, dname ? "/xdmctl-" : "/xdmctl", - dname, (char *)0 ); - if (cr->fpath) { - unlink( cr->fpath ); - if (mkfifo( cr->fpath, 0 ) < 0) - LogError( "Cannot create control FiFo %\"s\n", cr->fpath ); - else { - cr->gid = fifoGroup; - if (!d) - chown( cr->fpath, -1, fifoGroup ); - chmod( cr->fpath, 0620 ); - if ((cr->fifo.fd = open( cr->fpath, O_RDWR | O_NONBLOCK )) >= 0) { - RegisterCloseOnFork( cr->fifo.fd ); - RegisterInput( cr->fifo.fd ); - goto fifok; - } - unlink( cr->fpath ); - LogError( "Cannot open control FiFo %\"s\n", cr->fpath ); - } - free( cr->fpath ); - cr->fpath = 0; - } - } - fifok: - if (cr->fd < 0) { - /* fifoDir is created above already */ sockdir = 0; StrApp( &sockdir, fifoDir, dname ? "/dmctl-" : "/dmctl", dname, (char *)0 ); if (sockdir) { StrApp( &cr->path, sockdir, "/socket", (char *)0 ); if (cr->path) { if (strlen( cr->path ) >= sizeof(sa.sun_path)) LogError( "path %\"s too long; no control sockets will be available\n", cr->path ); else if (mkdir( sockdir, 0755 ) && errno != EEXIST) LogError( "mkdir %\"s failed; no control sockets will be available\n", sockdir ); else { if (!d) chown( sockdir, -1, fifoGroup ); chmod( sockdir, 0750 ); if ((cr->fd = socket( PF_UNIX, SOCK_STREAM, 0 )) < 0) LogError( "Cannot create control socket\n" ); else { unlink( cr->path ); sa.sun_family = AF_UNIX; strcpy( sa.sun_path, cr->path ); if (!bind( cr->fd, (struct sockaddr *)&sa, sizeof(sa) )) { if (!listen( cr->fd, 5 )) { chmod( cr->path, 0666 ); RegisterCloseOnFork( cr->fd ); RegisterInput( cr->fd ); free( sockdir ); return; } unlink( cr->path ); LogError( "Cannot listen on control socket %\"s\n", cr->path ); } else LogError( "Cannot bind control socket %\"s\n", cr->path ); close( cr->fd ); cr->fd = -1; } } free( cr->path ); cr->path = 0; } free( sockdir ); } } } void closeCtrl( struct display *d ) { CtrlRec *cr = d ? &d->ctrl : &ctrl; if (cr->fd >= 0) { UnregisterInput( cr->fd ); CloseNClearCloseOnFork( cr->fd ); cr->fd = -1; unlink( cr->path ); *strrchr( cr->path, '/' ) = 0; rmdir( cr->path ); free( cr->path ); cr->path = 0; while (cr->css) { struct cmdsock *cs = cr->css; cr->css = cs->next; nukeSock( cs ); } } - if (cr->fifo.fd >= 0) { - UnregisterInput( cr->fifo.fd ); - CloseNClearCloseOnFork( cr->fifo.fd ); - cr->fifo.fd = -1; - unlink( cr->fpath ); - free( cr->fpath ); - cr->fpath = 0; - if (cr->fifo.buffer) - free( cr->fifo.buffer ); - cr->fifo.buffer = 0; - cr->fifo.buflen = 0; - } } void chownCtrl( CtrlRec *cr, int uid ) { - if (cr->fpath) - chown( cr->fpath, uid, -1 ); if (cr->path) { char *ptr = strrchr( cr->path, '/' ); *ptr = 0; chown( cr->path, uid, -1 ); *ptr = '/'; } } void updateCtrl( void ) { unsigned ffl, slc; ffl = 0; if (ctrl.path) for (ffl = strlen( ctrl.path ), slc = 2; ;) if (ctrl.path[--ffl] == '/') if (!--slc) break; if (ffl != strlen( fifoDir ) || memcmp( fifoDir, ctrl.path, ffl ) || ctrl.gid != fifoGroup) { closeCtrl( 0 ); openCtrl( 0 ); } } static void fLog( struct display *d, int fd, const char *sts, const char *msg, ... ) { char *fmsg, *otxt; const char *what; int olen; va_list va; va_start( va, msg ); VASPrintf( &fmsg, msg, va ); va_end( va ); if (!fmsg) return; if (fd >= 0) { olen = ASPrintf( &otxt, "%s\t%\\s\n", sts, fmsg ); if (otxt) { Writer( fd, otxt, olen ); free( otxt ); } what = "socket"; } else what = "FiFo"; if (d) Debug( "control %s for %s: %s - %s", what, d->name, sts, fmsg ); else Debug( "global control %s: %s - %s", what, sts, fmsg ); free( fmsg ); } static char * unQuote( const char *str ) { char *ret, *adp; if (!(ret = Malloc( strlen( str ) + 1 ))) return 0; for (adp = ret; *str; str++, adp++) if (*str == '\\') switch (*++str) { case 0: str--; /* fallthrough */ case '\\': *adp = '\\'; break; case 'n': *adp = '\n'; break; case 't': *adp = '\t'; break; default: *adp++ = '\\'; *adp = *str; break; } else *adp = *str; *adp = 0; return ret; } static void str_cat_l( char **bp, const char *str, int max ) { int dnl = StrNLen( str, max ); memcpy( *bp, str, dnl ); *bp += dnl; } static void str_cat( char **bp, const char *str ) { int dnl = strlen( str ); memcpy( *bp, str, dnl ); *bp += dnl; } static void sd_cat( char **bp, SdRec *sdr ) { if (sdr->how == SHUT_HALT) str_cat( bp, "halt," ); else str_cat( bp, "reboot," ); if (sdr->start == TO_INF) str_cat( bp, "0," ); else *bp += sprintf( *bp, "%d,", sdr->start ); if (sdr->timeout == TO_INF) str_cat( bp, "-1," ); else *bp += sprintf( *bp, "%d,", sdr->timeout ); if (sdr->force == SHUT_ASK) str_cat( bp, "ask" ); else if (sdr->force == SHUT_FORCE) str_cat( bp, "force" ); else if (sdr->force == SHUT_FORCEMY) str_cat( bp, "forcemy" ); else str_cat( bp, "cancel" ); *bp += sprintf( *bp, ",%d,%s", sdr->uid, sdr->osname ? sdr->osname : "-" ); } static void emitXSessC( struct display *di, struct display *d, void *ctx ) { char *dname, *bp; char cbuf[1024]; bp = cbuf; *bp++ = '\t'; dname = di->name; if (!memcmp( dname, "localhost:", 10 )) dname += 9; str_cat_l( &bp, dname, sizeof(cbuf)/2 ); *bp++ = ','; #ifdef HAVE_VTS if (di->serverVT) bp += sprintf( bp, "vt%d", di->serverVT ); #endif *bp++ = ','; #ifdef XDMCP if (di->status == remoteLogin) { *bp++ = ','; str_cat_l( &bp, di->remoteHost, sizeof(cbuf)/3 ); } else #endif { if (di->userName) str_cat_l( &bp, di->userName, sizeof(cbuf)/5 ); *bp++ = ','; if (di->sessName) str_cat_l( &bp, di->sessName, sizeof(cbuf)/5 ); } *bp++ = ','; if (di == d) *bp++ = '*'; if (di->userSess >= 0 && (d ? (d->userSess != di->userSess && (d->allowNuke == SHUT_NONE || (d->allowNuke == SHUT_ROOT && d->userSess))) : !fifoAllowNuke)) *bp++ = '!'; Writer( (int)ctx, cbuf, bp - cbuf ); } static void emitTTYSessC( STRUCTUTMP *ut, struct display *d, void *ctx ) { struct passwd *pw; char *bp; int vt, l; char cbuf[sizeof(ut->ut_line) + sizeof(ut->ut_user) + sizeof(ut->ut_host) + 16]; char user[sizeof(ut->ut_user) + 1]; #ifndef BSD_UTMP if (ut->ut_type != USER_PROCESS) l = 0; else #endif { l = StrNLen( ut->ut_user, sizeof(ut->ut_user) ); memcpy( user, ut->ut_user, l ); } user[l] = 0; bp = cbuf; *bp++ = '\t'; str_cat_l( &bp, ut->ut_line, sizeof(ut->ut_line) ); *bp++ = ','; if (*ut->ut_host) { *bp++ = '@'; str_cat_l( &bp, ut->ut_host, sizeof(ut->ut_host) ); } #ifdef HAVE_VTS else if ((vt = TTYtoVT( ut->ut_line ))) bp += sprintf( bp, "vt%d", vt ); #endif *bp++ = ','; str_cat( &bp, user ); *bp++ = ','; /* blank: session type unknown */ *bp++ = ','; /* blank: certainly not querying display */ *bp++ = 't'; if (*user && (d ? ((d->allowNuke == SHUT_NONE || (d->allowNuke == SHUT_ROOT && d->userSess)) && (!(pw = getpwnam( user )) || d->userSess != (int)pw->pw_uid)) : !fifoAllowNuke)) *bp++ = '!'; Writer( (int)ctx, cbuf, bp - cbuf ); } static void processCtrl( const char *string, int len, int fd, struct display *d ) { #define Reply(t) Writer (fd, t, strlen (t)) struct display *di; const char *word; char **ar, **ap, *args, *bp; SdRec sdr; char cbuf[1024]; if (!(ar = initStrArr( 0 ))) return; for (word = string; ; string++, len--) if (!len || *string == '\t') { if (!(ar = addStrArr( ar, word, string - word ))) return; if (!len) break; word = string + 1; } word = fd >= 0 ? "socket" : "FiFo"; if (d) Debug( "control %s for %s received %'[s\n", word, d->name, ar ); else Debug( "global control %s received %'[s\n", word, ar ); if (ar[0]) { if (fd >= 0 && !strcmp( ar[0], "caps" )) { if (ar[1]) goto exce; Reply( "ok\tkdm\tlist\t" ); if (bootManager != BO_NONE) Reply( "bootoptions\t" ); if (d) { if ((d->displayType & d_location) == dLocal) #ifdef HAVE_VTS Reply( "local\tactivate\t" ); #else Reply( "local\t" ); #endif if (d->allowShutdown != SHUT_NONE) { if (d->allowShutdown == SHUT_ROOT && d->userSess) Reply( "shutdown root\t" ); else Reply( "shutdown\t" ); Reply( "shutdown ask\t" ); if (d->allowNuke != SHUT_NONE) { if (d->allowNuke == SHUT_ROOT && d->userSess) Reply( "nuke root\t" ); else Reply( "nuke\t" ); } } if ((d->displayType & d_location) == dLocal && AnyReserveDisplays()) Writer( fd, cbuf, sprintf( cbuf, "reserve %d\t", idleReserveDisplays() ) ); Reply( "lock\tsuicide\n" ); } else { if (fifoAllowShutdown) { Reply( "shutdown\t" ); if (fifoAllowNuke) Reply( "nuke\t" ); } if (AnyReserveDisplays()) Writer( fd, cbuf, sprintf( cbuf, "reserve %d\t", idleReserveDisplays() ) ); #ifdef HAVE_VTS Reply( "login\tactivate\n" ); #else Reply( "login\n" ); #endif } goto bust; } else if (fd >= 0 && !strcmp( ar[0], "list" )) { int flags = lstRemote | lstTTY; if (ar[1]) { if (!strcmp( ar[1], "all" )) flags = lstRemote | lstPassive | lstTTY; else if (!strcmp( ar[1], "alllocal" )) flags = lstPassive | lstTTY; else { fLog( d, fd, "bad", "invalid list scope %\"s", ar[1] ); goto bust; } if (ar[2]) goto exce; } Reply( "ok" ); ListSessions( flags, d, (void *)fd, emitXSessC, emitTTYSessC ); Reply( "\n" ); goto bust; } else if (!strcmp( ar[0], "reserve" )) { int lt = 60; /* XXX make default timeout configurable? */ if (ar[1]) { lt = strtol( ar[1], &bp, 10 ); if (lt < 15 || *bp) { fLog( d, fd, "bad", "invalid timeout %\"s", ar[1] ); goto bust; } if (ar[2]) goto exce; } if (d && (d->displayType & d_location) != dLocal) { fLog( d, fd, "perm", "display is not local" ); goto bust; } if (!StartReserveDisplay( lt )) { fLog( d, fd, "noent", "no reserve display available" ); goto bust; } #ifdef HAVE_VTS } else if (!strcmp( ar[0], "activate" )) { int vt; if (!ar[1]) goto miss; if (ar[2]) goto exce; if (d && (d->displayType & d_location) != dLocal) { fLog( d, fd, "perm", "display is not local" ); goto bust; } if (ar[1][0] != 'v' || ar[1][1] != 't' || (vt = atoi( ar[1] + 2 )) <= 0) { if (!(di = FindDisplayByName( ar[1] ))) { fLog( d, fd, "noent", "display not found" ); goto bust; } if ((di->displayType & d_location) != dLocal) { fLog( d, fd, "inval", "target display is not local" ); goto bust; } if (!di->serverVT) { fLog( d, fd, "noent", "target display has no VT assigned" ); goto bust; } vt = di->serverVT; } if (!activateVT( vt )) { fLog( d, fd, "inval", "VT switch failed" ); goto bust; } #endif } else if (!strcmp( ar[0], "shutdown" )) { ap = ar; if (!*++ap) goto miss; sdr.force = SHUT_CANCEL; sdr.osname = 0; if (!strcmp( *ap, "status" )) { if (fd < 0) goto bust; if (*++ap) goto exce; bp = cbuf; *bp++ = 'o'; *bp++ = 'k'; if (sdRec.how) { str_cat( &bp, "\tglobal," ); sd_cat( &bp, &sdRec ); } if (d && d->hstent->sdRec.how) { str_cat( &bp, "\tlocal," ); sd_cat( &bp, &d->hstent->sdRec ); } *bp++ = '\n'; Writer( fd, cbuf, bp - cbuf ); goto bust; } else if (!strcmp( *ap, "cancel" )) { sdr.how = 0; sdr.start = 0; if (ap[1]) { if (!d) goto exce; if (!strcmp( *++ap, "global" )) sdr.start = TO_INF; else if (strcmp( *ap, "local" )) { fLog( d, fd, "bad", "invalid cancel scope %\"s", *ap ); goto bust; } } } else { if (!strcmp( *ap, "reboot" )) sdr.how = SHUT_REBOOT; else if (!strcmp( *ap, "halt" )) sdr.how = SHUT_HALT; else { fLog( d, fd, "bad", "invalid type %\"s", *ap ); goto bust; } sdr.uid = -1; if (!*++ap) goto miss; if (**ap == '=') { switch (setBootOption( *ap + 1, &sdr )) { case BO_NOMAN: fLog( d, fd, "notsup", "boot options unavailable" ); goto bust; case BO_NOENT: fLog( d, fd, "noent", "no such boot option" ); goto bust; case BO_IO: fLog( d, fd, "io", "io error" ); goto bust; } if (!*++ap) goto miss; } sdr.start = strtol( *ap, &bp, 10 ); if (bp != *ap && !*bp) { if (**ap == '+') sdr.start += now; if (!*++ap) goto miss; sdr.timeout = strtol( *ap, &bp, 10 ); if (bp == *ap || *bp) { fLog( d, fd, "bad", "invalid timeout %\"s", ar[3] ); goto bust; } if (**ap == '+') sdr.timeout += sdr.start ? sdr.start : now; if (sdr.timeout < 0) sdr.timeout = TO_INF; else { if (!*++ap) goto miss; if (!strcmp( *ap, "force" )) sdr.force = SHUT_FORCE; else if (d && !strcmp( *ap, "forcemy" )) sdr.force = SHUT_FORCEMY; else if (strcmp( *ap, "cancel" )) { fLog( d, fd, "bad", "invalid timeout action %\"s", *ap ); goto bust; } } } else { sdr.timeout = 0; if (d && !strcmp( *ap, "ask" )) sdr.force = SHUT_ASK; else if (!strcmp( *ap, "forcenow" )) sdr.force = SHUT_FORCE; else if (!strcmp( *ap, "schedule" )) sdr.timeout = TO_INF; else if (strcmp( *ap, "trynow" )) { fLog( d, fd, "bad", "invalid mode %\"s", *ap ); goto bust; } } } if (*++ap) goto exce; if (d) { sdr.uid = d->userSess >= 0 ? d->userSess : 0; if (d->allowShutdown == SHUT_NONE || (d->allowShutdown == SHUT_ROOT && sdr.uid && sdr.force != SHUT_ASK)) { fLog( d, fd, "perm", "shutdown forbidden" ); goto bust; } if (!sdr.how && !sdr.start) { if (d->hstent->sdRec.osname) free( d->hstent->sdRec.osname ); d->hstent->sdRec = sdr; } else { if (sdRec.how && sdRec.force == SHUT_FORCE && ((d->allowNuke == SHUT_NONE && sdRec.uid != sdr.uid) || (d->allowNuke == SHUT_ROOT && sdr.uid))) { fLog( d, fd, "perm", "overriding forced shutdown forbidden" ); goto bust; } if (sdr.force == SHUT_FORCE && (d->allowNuke == SHUT_NONE || (d->allowNuke == SHUT_ROOT && sdr.uid))) { fLog( d, fd, "perm", "forced shutdown forbidden" ); goto bust; } if (!sdr.start) { if (d->hstent->sdRec.osname) free( d->hstent->sdRec.osname ); d->hstent->sdRec = sdr; } else { if (!sdr.how) cancelShutdown(); else { if (sdRec.osname) free( sdRec.osname ); sdRec = sdr; } } } } else { if (!fifoAllowShutdown) { fLog( d, fd, "perm", "shutdown forbidden" ); goto bust; } if (sdRec.how && sdRec.force == SHUT_FORCE && sdRec.uid != -1 && !fifoAllowNuke) { fLog( d, fd, "perm", "overriding forced shutdown forbidden" ); goto bust; } if (!sdr.how) cancelShutdown(); else { if (sdr.force != SHUT_CANCEL) { if (!fifoAllowNuke) { fLog( d, fd, "perm", "forced shutdown forbidden" ); goto bust; } } else { if (!sdr.start && !sdr.timeout && AnyActiveDisplays()) { fLog( d, fd, "busy", "user sessions running" ); goto bust; } } sdr.uid = -1; if (sdRec.osname) free( sdRec.osname ); sdRec = sdr; } } } else if (fd >= 0 && !strcmp( ar[0], "listbootoptions" )) { char **opts; int def, cur, i, j; if (ar[1]) goto exce; switch (getBootOptions( &opts, &def, &cur )) { case BO_NOMAN: fLog( d, fd, "notsup", "boot options unavailable" ); goto bust; case BO_IO: fLog( d, fd, "io", "io error" ); goto bust; } Reply( "ok\t" ); for (i = 0; opts[i]; i++) { bp = cbuf; if (i) *bp++ = ' '; for (j = 0; opts[i][j]; j++) if (opts[i][j] == ' ') { *bp++ = '\\'; *bp++ = 's'; } else *bp++ = opts[i][j]; Writer( fd, cbuf, bp - cbuf ); } freeStrArr( opts ); Writer( fd, cbuf, sprintf( cbuf, "\t%d\t%d\n", def, cur ) ); goto bust; } else if (d) { if (!strcmp( ar[0], "lock" )) { if (ar[1]) goto exce; d->hstent->lock = 1; } else if (!strcmp( ar[0], "unlock" )) { if (ar[1]) goto exce; d->hstent->lock = 0; } else if (!strcmp( ar[0], "suicide" )) { if (ar[1]) goto exce; if (d->status == running && d->pid != -1) { TerminateProcess( d->pid, SIGTERM ); d->status = raiser; } } else { fLog( d, fd, "nosys", "unknown command" ); goto bust; } } else { if (!strcmp( ar[0], "login" )) { int nuke; if (arrLen( ar ) < 5) { miss: fLog( d, fd, "bad", "missing argument(s)" ); goto bust; } if (!(di = FindDisplayByName( ar[1] ))) { fLog( d, fd, "noent", "display %s not found", ar[1] ); goto bust; } if (ar[5]) { if (!(args = unQuote( ar[5] ))) { fLog( d, fd, "nomem", "out of memory" ); goto bust; } if (ar[6]) { free( args ); exce: fLog( d, fd, "bad", "excess argument(s)" ); goto bust; } setNLogin( di, ar[3], ar[4], args, 2 ); free( args ); } else setNLogin( di, ar[3], ar[4], 0, 2 ); nuke = !strcmp( ar[2], "now" ); switch (di->status) { case running: if (di->pid != -1 && (di->userSess < 0 || nuke)) { TerminateProcess( di->pid, SIGTERM ); di->status = raiser; } break; case remoteLogin: if (di->serverPid != -1 && nuke) TerminateProcess( di->serverPid, di->termSignal ); break; case reserve: di->status = notRunning; break; case textMode: #ifndef HAVE_VTS SwitchToX( di ); #endif break; default: break; } } else { fLog( d, fd, "nosys", "unknown command" ); goto bust; } } if (fd >= 0) Reply( "ok\n" ); } bust: freeStrArr( ar ); } static int handleChan( struct display *d, struct bsock *cs, int fd, FD_TYPE *reads ) { char *bufp, *nbuf, *obuf, *eol; int len, bl, llen; char buf[1024]; bl = cs->buflen; obuf = cs->buffer; if (bl <= 0 && FD_ISSET( cs->fd, reads )) { FD_CLR( cs->fd, reads ); bl = -bl; memcpy( buf, obuf, bl ); if ((len = Reader( cs->fd, buf + bl, sizeof(buf) - bl )) <= 0) return -1; bl += len; bufp = buf; } else { len = 0; bufp = obuf; } if (bl > 0) { if ((eol = memchr( bufp, '\n', bl ))) { llen = eol - bufp + 1; bl -= llen; if (bl) { if (!(nbuf = Malloc( bl ))) return -1; memcpy( nbuf, bufp + llen, bl ); } else nbuf = 0; cs->buffer = nbuf; cs->buflen = bl; processCtrl( bufp, llen - 1, fd, d ); if (obuf) free( obuf ); return 1; } else if (!len) { if (fd >= 0) cs->buflen = -bl; else fLog( d, -1, "bad", "unterminated command" ); } } return 0; } int handleCtrl( FD_TYPE *reads, struct display *d ) { CtrlRec *cr = d ? &d->ctrl : &ctrl; struct cmdsock *cs, **csp; - if (cr->fifo.fd >= 0) { - switch (handleChan( d, &cr->fifo, -1, reads )) { - case -1: - if (cr->fifo.buffer) - free( cr->fifo.buffer ); - cr->fifo.buflen = 0; - break; - case 1: - return 1; - default: - break; - } - } if (cr->fd >= 0 && FD_ISSET( cr->fd, reads )) acceptSock( cr ); else { for (csp = &cr->css; (cs = *csp); ) { switch (handleChan( d, &cs->sock, cs->sock.fd, reads )) { case -1: *csp = cs->next; nukeSock( cs ); continue; case 1: return 1; default: break; } csp = &cs->next; } } return 0; } diff --git a/kdm/backend/dm.h b/kdm/backend/dm.h index ebd4e8184c..65b4738813 100644 --- a/kdm/backend/dm.h +++ b/kdm/backend/dm.h @@ -1,620 +1,617 @@ /* Copyright 1988, 1998 The Open Group Copyright 2000-2005 Oswald Buddenhagen Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the copyright holder. */ /* * xdm - display manager daemon * Author: Keith Packard, MIT X Consortium * * global xdm core declarations */ #ifndef _DM_H_ #define _DM_H_ 1 #include "greet.h" #include #include /* FamilyInternet6 */ #include #include #include #include #include #include #ifdef HAVE_LIMITS_H # include #endif #include #define Time_t time_t #include #include #ifdef XDMCP # if defined(__osf__) /* someone somewhere defines QUERY under Tru64 which confuses Xdmcp.h */ # undef QUERY # endif # include #endif #ifndef PATH_MAX # ifdef MAXPATHLEN # define PATH_MAX MAXPATHLEN # else # define PATH_MAX 1024 # endif #endif #include #define waitCode(w) (WIFEXITED(w) ? WEXITSTATUS(w) : 0) #define waitSig(w) (WIFSIGNALED(w) ? WTERMSIG(w) : 0) #ifdef WCOREDUMP # define waitCore(w) (WCOREDUMP(w)) #else # define waitCore(w) 0 /* not in POSIX. so what? */ #endif typedef int waitType; #define waitCompose(sig,core,code) ((sig) * 256 + (core) * 128 + (code)) #define waitVal(w) waitCompose(waitSig(w), waitCore(w), waitCode(w)) #define WaitCode(w) ((w) & 0x7f) #define WaitCore(w) (((w) >> 7) & 1) #define WaitSig(w) (((w) >> 8) & 0xff) #include #define FD_TYPE fd_set #include #if defined(__EMX__) || (defined(__NetBSD__) && defined(__sparc__)) /* XXX netbsd? */ # define Setjmp(e) setjmp(e) # define Longjmp(e,v) longjmp(e,v) # define Jmp_buf jmp_buf #else # define Setjmp(e) sigsetjmp(e,1) # define Longjmp(e,v) siglongjmp(e,v) # define Jmp_buf sigjmp_buf #endif #include #ifdef HAVE_UTMPX # include # define STRUCTUTMP struct utmpx # define UTMPNAME utmpxname # define SETUTENT setutxent # define GETUTENT getutxent # define PUTUTLINE pututxline # define ENDUTENT endutxent # define LASTLOG lastlogx # define ut_time ut_tv.tv_sec # define ll_time ll_tv.tv_sec #else # define STRUCTUTMP struct utmp # define UTMPNAME utmpname # define SETUTENT setutent # define GETUTENT getutent # define PUTUTLINE pututline # define ENDUTENT endutent # define LASTLOG lastlog #endif #ifndef HAVE_STRUCT_UTMP_UT_USER # define ut_user ut_name #endif #ifndef WTMP_FILE # ifdef _PATH_WTMPX # define WTMP_FILE _PATH_WTMPX # elif defined(_PATH_WTMP) # define WTMP_FILE _PATH_WTMP # else # define WTMP_FILE "/usr/adm/wtmp" # endif #endif #ifndef UTMP_FILE # ifdef _PATH_UTMPX # define UTMP_FILE _PATH_UTMPX # elif defined(_PATH_UTMP) # define UTMP_FILE _PATH_UTMP # else # define UTMP_FILE "/etc/utmp" # endif #endif #ifdef HAVE_NETCONFIG_H # define STREAMSCONN #else # define UNIXCONN # define TCPCONN # ifdef FamilyInternet6 # define IPv6 # endif # ifdef HAVE_NETDNET_DN_H # define DNETCONN # endif #endif #if !defined(HAVE_ARC4RANDOM) && !defined(DEV_RANDOM) # define NEED_ENTROPY #endif typedef struct GPipe { int wfd, rfd; char *who; } GPipe; typedef struct GTalk { GPipe *pipe; Jmp_buf errjmp; } GTalk; typedef struct GProc { GPipe pipe; int pid; } GProc; typedef enum displayStatus { notRunning = 0, running, zombie, phoenix, raiser, textMode, reserve, remoteLogin } DisplayStatus; typedef enum serverStatus { ignore = 0, awaiting, starting, terminated, killed, pausing } ServerStatus; typedef struct RcStr { struct RcStr *next; char *str; int cnt; } RcStr; typedef struct CfgDep { RcStr *name; long time; } CfgDep; typedef struct CfgArr { char *data; /* config value array; allocated */ long *idx; /* config index array; alias */ CfgDep dep; /* filestamp */ int numCfgEnt; /* number of config entries */ } CfgArr; struct bsock { int fd; int buflen; char *buffer; }; struct cmdsock { struct cmdsock *next; struct bsock sock; /* buffered fd of the socket */ }; typedef struct { struct cmdsock *css; /* open connections */ char *path; /* filename of the socket */ int fd; /* fd of the socket */ int gid; /* owner group of the socket */ - - char *fpath; /* filename of the fifo */ - struct bsock fifo; /* buffered fd of the fifo */ } CtrlRec; struct display { struct display *next; struct disphist *hstent; /* display history entry */ /* basic display information */ char *name; /* DISPLAY name -- also referenced in hstent */ char *class2; /* display class (may be NULL) */ int displayType; /* location/origin/lifetime */ CfgArr cfg; /* config data array */ /* display state */ DisplayStatus status; /* current status */ int zstatus; /* substatus while zombie */ int pid; /* process id of child */ int serverPid; /* process id of server (-1 if none) */ #ifdef HAVE_VTS int serverVT; /* server VT (0 = none, -1 = pending) */ struct display *follower; /* on exit, hand VT to this display */ #endif ServerStatus serverStatus; /* X server startup state */ Time_t lastStart; /* time of last display start */ int startTries; /* current start try */ int stillThere; /* state during HUP processing */ int userSess; /* -1=nobody, otherwise uid */ char *userName; char *sessName; - CtrlRec ctrl; /* command socket & fifo */ + CtrlRec ctrl; /* command socket */ GPipe pipe; /* comm master <-> slave */ GPipe gpipe; /* comm master <-> greeter */ #ifdef XDMCP char *remoteHost; /* for X -query type remote login */ /* XDMCP state */ unsigned sessionID; /* ID of active session */ ARRAY8 peer; /* display peer address */ ARRAY8 from; /* XDMCP port of display */ unsigned displayNumber; /* numerical part of name */ int useChooser; /* Run the chooser for this display */ ARRAY8 clientAddr; /* for chooser picking */ unsigned connectionType; /* ... */ int xdmcpFd; #endif CONF_CORE_LOCAL_DEFS int idleTimeout; /* abort login after that time */ unsigned short *authNameLens; /* authorization protocol name lens */ /* information potentially derived from resources */ int authNameNum; /* number of protocol names */ Xauth **authorizations; /* authorization data */ int authNum; /* number of authorizations */ char *authFile; /* file to store authorization in */ }; typedef struct { unsigned how:2, /* 0=none 1=reboot 2=halt (SHUT_*) */ force:2; int uid; int start; int timeout; char *osname; time_t bmstamp; int osindex; } SdRec; struct disphist { struct disphist *next; char *name; Time_t lastExit; /* time of last display exit */ unsigned rLogin:2, /* 0=nothing 1=relogin 2=login */ lock:1, /* screen locker running */ goodExit:1; /* was the last exit "peaceful"? */ SdRec sdRec; char *nuser, *npass, *nargs; }; #ifdef XDMCP #define PROTO_TIMEOUT (30 * 60) /* 30 minutes should be long enough */ struct protoDisplay { struct protoDisplay *next; XdmcpNetaddr address; /* UDP address */ int addrlen; /* UDP address length */ unsigned long date; /* creation date */ CARD16 displayNumber; CARD16 connectionType; ARRAY8 connectionAddress; CARD32 sessionID; Xauth *fileAuthorization; Xauth *xdmcpAuthorization; ARRAY8 authenticationName; ARRAY8 authenticationData; XdmAuthKeyRec key; }; #endif /* XDMCP */ /* status code for RStopDisplay */ #define DS_RESTART 0 #define DS_TEXTMODE 1 #define DS_RESERVE 2 #define DS_REMOTE 3 #define DS_REMOVE 4 /* command codes dpy process -> master process */ #define D_User 1 #define D_ReLogin 2 #define D_ChooseHost 4 #define D_RemoteHost 5 #define D_XConnOk 6 extern int debugLevel; CONF_CORE_GLOBAL_DECLS /* in daemon.c */ void BecomeDaemon( void ); /* in dm.c */ extern char *prog, *progpath; extern time_t now; extern SdRec sdRec; void StartDisplay( struct display *d ); void StartDisplayP2( struct display *d ); void StopDisplay( struct display *d ); void SetTitle( const char *name ); void SwitchToX( struct display *d ); void setNLogin( struct display *d, const char *nuser, const char *npass, char *nargs, int rl ); void cancelShutdown( void ); int TTYtoVT( const char *tty ); int activateVT( int vt ); /* in ctrl.c */ void openCtrl( struct display *d ); void closeCtrl( struct display *d ); int handleCtrl( FD_TYPE *reads, struct display *d ); void chownCtrl( CtrlRec *cr, int uid ); void updateCtrl( void ); /* in dpylist.c */ extern struct display *displays; /* that's ugly ... */ int AnyDisplaysLeft( void ); void ForEachDisplay( void (*f)( struct display * ) ); #ifdef HAVE_VTS void ForEachDisplayRev( void (*f)( struct display * ) ); #endif void RemoveDisplay( struct display *old ); struct display *FindDisplayByName( const char *name ), #ifdef XDMCP *FindDisplayBySessionID( CARD32 sessionID ), *FindDisplayByAddress( XdmcpNetaddr addr, int addrlen, CARD16 displayNumber ), #endif /* XDMCP */ *FindDisplayByPid( int pid ), *FindDisplayByServerPid( int serverPid ), *NewDisplay( const char *name ); int AnyActiveDisplays( void ); int AnyRunningDisplays( void ); int AnyReserveDisplays( void ); int idleReserveDisplays( void ); int AllLocalDisplaysLocked( struct display *dp ); int StartReserveDisplay( int lt ); void ReapReserveDisplays( void ); /* in reset.c */ void pseudoReset( void ); /* in resource.c */ char **FindCfgEnt( struct display *d, int id ); int InitResources( char **argv ); int LoadDMResources( int force ); int LoadDisplayResources( struct display *d ); void ScanServers( void ); void CloseGetter( void ); int startConfig( int what, CfgDep *dep, int force ); RcStr *newStr( char *str ); void delStr( RcStr *str ); extern GTalk cnftalk; /* in session.c */ extern struct display *td; extern const char *td_setup; char **baseEnv( const char *user ); char **inheritEnv( char **env, const char **what ); char **systemEnv( const char *user ); int source( char **env, const char *file, const char *arg ); void ManageSession( struct display *d ); extern GTalk mstrtalk, grttalk; extern GProc grtproc; void OpenGreeter( void ); int CloseGreeter( int force ); int CtrlGreeterWait( int wreply ); void PrepErrorGreet( void ); char *conv_interact( int what, const char *prompt ); /* process.c */ typedef void (*SIGFUNC)( int ); SIGFUNC Signal( int, SIGFUNC Handler ); void RegisterInput( int fd ); void UnregisterInput( int fd ); void RegisterCloseOnFork( int fd ); void ClearCloseOnFork( int fd ); void CloseNClearCloseOnFork( int fd ); int Fork( void ); int Wait4( int pid ); void execute( char **argv, char **env ); int runAndWait( char **args, char **env ); FILE *pOpen( char **what, char m, int *pid ); int pClose( FILE *f, int pid ); char *locate( const char *exe ); void TerminateProcess( int pid, int sig ); void GSet( GTalk *talk ); /* call before GOpen! */ int GFork( GPipe *pajp, const char *pname, char *cname, GPipe *ogp, char *cgname ); void GClosen( GPipe *pajp ); int GOpen( GProc *proc, char **argv, const char *what, char **env, char *cname, GPipe *gp ); int GClose( GProc *proc, GPipe *gp, int force ); void GSendInt( int val ); int GRecvInt( void ); int GRecvCmd( int *cmd ); void GSendArr( int len, const char *data ); char *GRecvArr( int *len ); int GRecvStrBuf( char *buf ); int GRecvArrBuf( char *buf ); void GSendStr( const char *buf ); void GSendNStr( const char *buf, int len ); /* exact len, buf != 0 */ void GSendStrN( const char *buf, int len ); /* maximal len */ char *GRecvStr( void ); void GSendArgv( char **argv ); void GSendStrArr( int len, char **data ); char **GRecvStrArr( int *len ); char **GRecvArgv( void ); /* client.c */ #define GCONV_NORMAL 0 #define GCONV_HIDDEN 1 #define GCONV_USER 2 #define GCONV_PASS 3 #define GCONV_PASS_ND 4 #define GCONV_BINARY 5 typedef char *(*GConvFunc)( int what, const char *prompt ); int Verify( GConvFunc gconv, int rootok ); int StartClient( void ); void SessionExit( int status ) ATTR_NORETURN; int ReadDmrc( void ); extern char **userEnviron, **systemEnviron; extern char *curuser, *curpass, *curtype, *newpass, *dmrcuser, *curdmrc, *newdmrc; extern int cursource; #define PWSRC_MANUAL 0 #define PWSRC_AUTOLOGIN 1 #define PWSRC_RELOGIN 2 /* server.c */ char **PrepServerArgv( struct display *d, const char *args ); void StartServer( struct display *d ); void AbortStartServer( struct display *d ); void StartServerSuccess( void ); void StartServerFailed( void ); void StartServerTimeout( void ); extern struct display *startingServer; extern time_t serverTimeout; void WaitForServer( struct display *d ); void ResetServer( struct display *d ); int PingServer( struct display *d ); extern Display *dpy; /* in util.c */ void *Calloc( size_t nmemb, size_t size ); void *Malloc( size_t size ); void *Realloc( void *ptr, size_t size ); void WipeStr( char *str ); int StrCmp( const char *s1, const char *s2 ); #ifdef HAVE_STRNLEN # define StrNLen(s, m) strnlen(s, m) #else int StrNLen( const char *s, int max ); #endif int StrNDup( char **dst, const char *src, int len ); int StrDup( char **dst, const char *src ); int arrLen( char **arr ); void freeStrArr( char **arr ); char **initStrArr( char **arr ); char **xCopyStrArr( int rn, char **arr ); /* Note: the following functions free the old data even in case of failure */ int ReStrN( char **dst, const char *src, int len ); int ReStr( char **dst, const char *src ); int StrApp( char **dst, ... ); char **addStrArr( char **arr, const char *str, int len ); char **parseArgs( char **argv, const char *string ); /* End note */ char **setEnv( char **e, const char *name, const char *value ); char **putEnv( const char *string, char **env ); const char *getEnv( char **e, const char *name ); const char *localHostname( void ); int Reader( int fd, void *buf, int len ); int Writer( int fd, const void *buf, int len ); int fGets( char *buf, int max, FILE *f ); time_t mTime( const char *fn ); void ListSessions( int flags, struct display *d, void *ctx, void (*emitXSess)( struct display *, struct display *, void * ), void (*emitTTYSess)( STRUCTUTMP *, struct display *, void * ) ); /* in inifile.c */ char *iniLoad( const char *fname ); int iniSave( const char *data, const char *fname ); char *iniEntry( char *data, const char *section, const char *key, const char *value ); char *iniMerge( char *data, const char *newdata ); /* in bootman.c */ int getBootOptions( char ***opts, int *def, int *cur ); int setBootOption( const char *opt, SdRec *sdr ); void commitBootOption( void ); /* in netaddr.c */ char *NetaddrAddress( char *netaddrp, int *lenp ); char *NetaddrPort( char *netaddrp, int *lenp ); int ConvertAddr( char *saddr, int *len, char **addr ); int NetaddrFamily( char *netaddrp ); int addressEqual( char *a1, int len1, char *a2, int len2 ); #ifdef XDMCP /* in xdmcp.c */ char *NetworkAddressToHostname( CARD16 connectionType, ARRAY8Ptr connectionAddress ); void SendFailed( struct display *d, const char *reason ); void init_session_id( void ); /* in policy.c */ struct sockaddr; ARRAY8Ptr Accept( struct sockaddr *from, int fromlen, CARD16 displayNumber ); ARRAY8Ptr ChooseAuthentication( ARRAYofARRAY8Ptr authenticationNames ); int CheckAuthentication( struct protoDisplay *pdpy, ARRAY8Ptr displayID, ARRAY8Ptr name, ARRAY8Ptr data ); int SelectAuthorizationTypeIndex( ARRAY8Ptr authenticationName, ARRAYofARRAY8Ptr authorizationNames ); int SelectConnectionTypeIndex( ARRAY16Ptr connectionTypes, ARRAYofARRAY8Ptr connectionAddresses ); int Willing( ARRAY8Ptr addr, CARD16 connectionType, ARRAY8Ptr authenticationName, ARRAY8Ptr status, xdmOpCode type ); /* in protodpy.c */ void DisposeProtoDisplay( struct protoDisplay *pdpy ); struct protoDisplay *FindProtoDisplay( XdmcpNetaddr address, int addrlen, CARD16 displayNumber ); struct protoDisplay *NewProtoDisplay( XdmcpNetaddr address, int addrlen, CARD16 displayNumber, CARD16 connectionType, ARRAY8Ptr connectionAddress, CARD32 sessionID ); #define FamilyBroadcast 0xffff typedef void (*ChooserFunc)( CARD16 connectionType, ARRAY8Ptr addr, char *closure ); typedef void (*ListenFunc)( ARRAY8Ptr addr, void **closure ); /* in access.c */ ARRAY8Ptr getLocalAddress( void ); int AcceptableDisplayAddress( ARRAY8Ptr clientAddress, CARD16 connectionType, xdmOpCode type ); int ForEachMatchingIndirectHost( ARRAY8Ptr clientAddress, CARD16 connectionType, ChooserFunc function, char *closure ); void ScanAccessDatabase( int force ); int UseChooser( ARRAY8Ptr clientAddress, CARD16 connectionType ); void ForEachChooserHost( ARRAY8Ptr clientAddress, CARD16 connectionType, ChooserFunc function, char *closure ); void ForEachListenAddr( ListenFunc listenfunction, ListenFunc mcastfcuntion, void **closure ); /* in choose.c */ ARRAY8Ptr IndirectChoice( ARRAY8Ptr clientAddress, CARD16 connectionType ); int IsIndirectClient( ARRAY8Ptr clientAddress, CARD16 connectionType ); int RememberIndirectClient( ARRAY8Ptr clientAddress, CARD16 connectionType ); void ForgetIndirectClient( ARRAY8Ptr clientAddress, CARD16 connectionType ); int RegisterIndirectChoice( ARRAY8Ptr clientAddress, CARD16 connectionType, ARRAY8Ptr choice ); int DoChoose( void ); /* socket.c or streams.c */ void UpdateListenSockets( void ); int AnyListenSockets( void ); int ProcessListenSockets( FD_TYPE *reads ); /* in xdmcp.c */ void ProcessRequestSocket( int fd ); #endif /* XDMCP */ /* in sessreg.c */ void sessreg( struct display *d, int pid, const char *user, int uid ); #endif /* _DM_H_ */ diff --git a/kdm/backend/dpylist.c b/kdm/backend/dpylist.c index b512293f79..f76519b4fa 100644 --- a/kdm/backend/dpylist.c +++ b/kdm/backend/dpylist.c @@ -1,294 +1,293 @@ /* Copyright 1988, 1998 The Open Group Copyright 2000-2005 Oswald Buddenhagen Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of a copyright holder shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the copyright holder. */ /* * xdm - display manager daemon * Author: Keith Packard, MIT X Consortium * * a simple linked list of known displays */ #include "dm.h" #include "dm_error.h" struct display *displays; static struct disphist *disphist; int AnyDisplaysLeft( void ) { return displays != (struct display *)0; } int AnyActiveDisplays( void ) { struct display *d; for (d = displays; d; d = d->next) if (d->status == remoteLogin || d->userSess >= 0) return 1; return 0; } int AnyRunningDisplays( void ) { struct display *d; for (d = displays; d; d = d->next) switch (d->status) { case notRunning: case textMode: case reserve: break; default: return 1; } return 0; } int AnyReserveDisplays( void ) { struct display *d; for (d = displays; d; d = d->next) if ((d->displayType & d_lifetime) == dReserve) return 1; return 0; } int idleReserveDisplays( void ) { struct display *d; int cnt = 0; for (d = displays; d; d = d->next) if (d->status == reserve) cnt++; return cnt; } int StartReserveDisplay( int lt ) { struct display *d, *rd; for (rd = 0, d = displays; d; d = d->next) if (d->status == reserve) rd = d; if (rd) { rd->idleTimeout = lt; rd->status = notRunning; return 1; } return 0; } void ForEachDisplay( void (*f)( struct display * ) ) { struct display *d, *next; for (d = displays; d; d = next) { next = d->next; (*f)( d ); } } #ifdef HAVE_VTS static void _forEachDisplayRev( struct display *d, void (*f)( struct display * ) ) { if (d) { if (d->next) _forEachDisplayRev( d->next, f ); (*f)( d ); } } void ForEachDisplayRev( void (*f)( struct display * ) ) { _forEachDisplayRev( displays, f ); } #endif struct display * FindDisplayByName( const char *name ) { struct display *d; for (d = displays; d; d = d->next) if (!strcmp( name, d->name )) return d; return 0; } struct display * FindDisplayByPid( int pid ) { struct display *d; for (d = displays; d; d = d->next) if (pid == d->pid) return d; return 0; } struct display * FindDisplayByServerPid( int serverPid ) { struct display *d; for (d = displays; d; d = d->next) if (serverPid == d->serverPid) return d; return 0; } #ifdef XDMCP struct display * FindDisplayBySessionID( CARD32 sessionID ) { struct display *d; for (d = displays; d; d = d->next) if (sessionID == d->sessionID) return d; return 0; } struct display * FindDisplayByAddress( XdmcpNetaddr addr, int addrlen, CARD16 displayNumber ) { struct display *d; for (d = displays; d; d = d->next) if ((d->displayType & d_origin) == dFromXDMCP && d->displayNumber == displayNumber && addressEqual( (XdmcpNetaddr)d->from.data, d->from.length, addr, addrlen )) return d; return 0; } #endif /* XDMCP */ #define IfFree(x) if (x) free( (char *)x ) void RemoveDisplay( struct display *old ) { struct display *d, **dp; int i; for (dp = &displays; (d = *dp); dp = &(*dp)->next) { if (d == old) { Debug( "Removing display %s\n", d->name ); *dp = d->next; IfFree( d->class2 ); IfFree( d->cfg.data ); delStr( d->cfg.dep.name ); #ifdef XDMCP IfFree( d->remoteHost ); #endif if (d->authorizations) { for (i = 0; i < d->authNum; i++) XauDisposeAuth( d->authorizations[i] ); free( (char *)d->authorizations ); } if (d->authFile) { (void)unlink( d->authFile ); free( d->authFile ); } IfFree( d->authNameLens ); #ifdef XDMCP XdmcpDisposeARRAY8( &d->peer ); XdmcpDisposeARRAY8( &d->from ); XdmcpDisposeARRAY8( &d->clientAddr ); #endif free( (char *)d ); break; } } } static struct disphist * FindHist( const char *name ) { struct disphist *hstent; for (hstent = disphist; hstent; hstent = hstent->next) if (!strcmp( hstent->name, name )) return hstent; return 0; } struct display * NewDisplay( const char *name ) { struct display *d; struct disphist *hstent; if (!(hstent = FindHist( name ))) { if (!(hstent = Calloc( 1, sizeof(*hstent) ))) return 0; if (!StrDup( &hstent->name, name )) { free( hstent ); return 0; } hstent->next = disphist; disphist = hstent; } if (!(d = (struct display *)Calloc( 1, sizeof(*d) ))) return 0; d->next = displays; d->hstent = hstent; d->name = hstent->name; /* initialize fields (others are 0) */ d->pid = -1; d->serverPid = -1; d->ctrl.fd = -1; - d->ctrl.fifo.fd = -1; d->pipe.rfd = -1; d->pipe.wfd = -1; d->gpipe.rfd = -1; d->gpipe.wfd = -1; d->userSess = -1; #ifdef XDMCP d->xdmcpFd = -1; #endif displays = d; Debug( "created new display %s\n", d->name ); return d; } diff --git a/kdm/config.def b/kdm/config.def index 701ce5eade..683dd2d4fb 100644 --- a/kdm/config.def +++ b/kdm/config.def @@ -1,2614 +1,2613 @@ # # Copyright 2004-2005 Oswald Buddenhagen # # Permission to use, copy, modify, distribute, and sell this software and its # documentation for any purpose is hereby granted without fee, provided that # the above copyright notice appear in all copies and that both that # copyright notice and this permission notice appear in supporting # documentation. # # The above copyright notice and this permission notice shall be included # in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS # OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF # MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. # IN NO EVENT SHALL THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR # OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, # ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. # # Except as contained in this notice, the name of a copyright holders shall # not be used in advertising or otherwise to promote the sale, use or # other dealings in this Software without prior written authorization # from the copyright holders. # # The contents of this section are copied into config.ci verbatim. #define RCVERMAJOR 2 #define RCVERMINOR 3 #define KDMCONF KDE_CONFDIR "/kdm" #define KDMDATA KDE_DATADIR "/kdm" #ifdef _AIX # define HALT_CMD "/usr/sbin/shutdown -h now" # define REBOOT_CMD "/usr/sbin/shutdown -r now" #elif defined(BSD) # define HALT_CMD "/sbin/shutdown -h now" # define REBOOT_CMD "/sbin/shutdown -r now" #elif defined(__SVR4) # define HALT_CMD "/usr/sbin/halt" # define REBOOT_CMD "/usr/sbin/reboot" #else # define HALT_CMD "/sbin/halt" # define REBOOT_CMD "/sbin/reboot" #endif #if defined(BSD) || defined(__linux__) # define DEF_USER_PATH "/usr/local/bin:/usr/bin:/bin:" XBINDIR ":/usr/games" # define DEF_SYSTEM_PATH "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:" XBINDIR #else # define DEF_USER_PATH "/usr/local/bin:/usr/bin:/bin:" XBINDIR ":/usr/games:/usr/ucb" # define DEF_SYSTEM_PATH "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:" XBINDIR ":/etc:/usr/ucb" #endif #if 0 /*def HASXDMAUTH*/ # define DEF_AUTH_NAME "XDM-AUTHORIZATION-1,MIT-MAGIC-COOKIE-1" #else # define DEF_AUTH_NAME "MIT-MAGIC-COOKIE-1" #endif #ifdef HAVE_VTS #elif defined(__sun__) # define DEF_SERVER_TTY "console" #elif defined(_AIX) # define DEF_SERVER_TTY "lft0" #else # define DEF_SERVER_TTY "" #endif #ifdef _AIX # define DEF_SERVER_CMD XBINDIR "/X -T -force" #elif defined(__linux__) || defined(__GNU__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__) /* we just assume that any free *nix installation has a recent xfree86/xorg */ # define DEF_SERVER_CMD XBINDIR "/X -br" #else # define DEF_SERVER_CMD XBINDIR "/X" #endif # The contents of this section are copied mostly verbatim to the # default/example configuration file. # Everything indented with a space is considered a comment for the output; # it is prefixed with a hash mark but otherwise copied verbatim (except # for lines consisting of a single underscore, which generate empty comment # lines). # Section headers are "condensation seeds" for the Instance:s in the key # definitions below. &kdm; master configuration file _ Definition: the greeter is the login dialog, i.e., the part of &kdm; which the user sees. _ You can configure every X-display individually. Every display has a display name, which consists of a host name (which is empty for local displays specified in {Static|Reserve}Servers), a colon, and a display number. Additionally, a display belongs to a display class (which can be ignored in most cases; the control center does not support this feature at all). Sections with display-specific settings have the formal syntax "[X-" host [":" number [ "_" class ]] "-" sub-section "]" You can use the "*" wildcard for host, number, and class. You may omit trailing components; they are assumed to be "*" then. The host part may be a domain specification like ".inf.tu-dresden.de". It may also be "+", which means non-empty, i.e. remote displays only. From which section a setting is actually taken is determined by these rules: - an exact match takes precedence over a partial match (for the host part), which in turn takes precedence over a wildcard ("+" taking precedence over "*") - precedence decreases from left to right for equally exact matches Example: display name "myhost:0", class "dpy". [X-myhost:0_dpy] precedes [X-myhost:0_*] (same as [X-myhost:0]) precedes [X-myhost:*_dpy] precedes [X-myhost:*_*] (same as [X-myhost]) precedes [X-+:0_dpy] precedes [X-*:0_dpy] precedes [X-*:0_*] (same as [X-*:0]) precedes [X-*:*_*] (same as [X-*]) These sections do NOT match this display: [X-hishost], [X-myhost:0_dec], [X-*:1], [X-:*] If a setting is not found in any matching section, the default is used. _ Every comment applies to the following section or key. Note that all comments will be lost if you change this file with the kcontrol frontend. The defaults refer to &kdm;'s built-in values, not anything set in this file. _ Special characters need to be backslash-escaped (leading and trailing spaces (\\s), tab (\\t), linefeed (\\n), carriage return (\\r) and the backslash itself (\\\\)). In lists, fields are separated with commas without whitespace in between. Some command strings are subject to simplified sh-style word splitting: single quotes (') and double quotes (") have the usual meaning; the backslash quotes everything (not only special characters). Note that the backslashes need to be doubled because of the two levels of quoting. [General] [Xdmcp] [Shutdown] Rough estimations about how many seconds &kdm; will spend at most on - opening a connection to the X-server (OpenTime) if the attempt - times out: OpenTimeout - is refused: OpenRepeat * OpenDelay - starting a local X-server (ServerTime): ServerAttempts * (ServerTimeout + OpenDelay) - starting a display: - local display: ServerTime + OpenTime - foreign display: StartAttempts * OpenTime - &XDMCP; display: OpenTime (repeated indefinitely by client) Core config for all displays [X-*-Core] Greeter config for all displays [X-*-Greeter] Core config for local displays [X-:*-Core] Greeter config for local displays [X-:*-Greeter] Core config for 1st local display [X-:0-Core] Greeter config for 1st local display [X-:0-Greeter] # The contents of this section are copied into kdmrc-ref.docbook. # The macro %REF% is replaced with the accumulated Description:s from the key # definitions below. The Files &kdm; Uses for Configuration This chapter documents the files that control &kdm;'s behavior. Some of this can be also controlled from the &kcontrol; module, but not all. &kdmrc; - The &kdm; master configuration file The basic format of the file is INI-like. Options are key/value pairs, placed in sections. Everything in the file is case sensitive. Syntactic errors and unrecognized key/section identifiers cause &kdm; to issue non-fatal error messages. Lines beginning with # are comments; empty lines are ignored as well. Sections are denoted by [Name of Section]. You can configure every X-display individually. Every display has a display name, which consists of a host name (which is empty for local displays specified in or ), a colon, and a display number. Additionally, a display belongs to a display class (which can be ignored in most cases). Sections with display-specific settings have the formal syntax [X- host [ : number [ _ class ] ] - sub-section ] All sections with the same sub-section make up a section class. You can use the wildcard * (match any) for host, number, and class. You may omit trailing components; they are assumed to be * then. The host part may be a domain specification like .inf.tu-dresden.de or the wildcard + (match non-empty). From which section a setting is actually taken is determined by these rules: An exact match takes precedence over a partial match (for the host part), which in turn takes precedence over a wildcard (+ taking precendence over *). Precedence decreases from left to right for equally exact matches. Example: display name myhost.foo:0, class dpy [X-myhost.foo:0_dpy] precedes [X-myhost.foo:0_*] (same as [X-myhost.foo:0]) precedes [X-myhost.foo:*_dpy] precedes [X-myhost.foo:*_*] (same as [X-myhost.foo]) precedes [X-.foo:*_*] (same as [X-.foo]) precedes [X-+:0_dpy] precedes [X-*:0_dpy] precedes [X-*:0_*] (same as [X-*:0]) precedes [X-*:*_*] (same as [X-*]). These sections do not match this display: [X-hishost], [X-myhost.foo:0_dec], [X-*:1], [X-:*] Common sections are [X-*] (all displays), [X-:*] (all local displays) and [X-:0] (the first local display). The format for all keys is  = value. Keys are only valid in the section class they are defined for. Some keys do not apply to particular displays, in which case they are ignored. If a setting is not found in any matching section, the default is used. Special characters need to be backslash-escaped (leading and trailing spaces (\s), tab (\t), linefeed (\n), carriage return (\r) and the backslash itself (\\)). In lists, fields are separated with commas without whitespace in between. Some command strings are subject to simplified sh-style word splitting: single quotes (') and double quotes (") have the usual meaning; the backslash quotes everything (not only special characters). Note that the backslashes need to be doubled because of the two levels of quoting. A pristine &kdmrc; is very thoroughly commented. All comments will be lost if you change this file with the kcontrol frontend. %REF% Specifying permanent &X-Server;s Each entry in the list indicates a display which should constantly be managed and which is not using &XDMCP;. This method is typically used only for local &X-Server;s that are started by &kdm;, but &kdm; can manage externally started (foreign) &X-Server;s as well, may they run on the local machine or rather remotely. The formal syntax of a specification is display name [_display class] for all &X-Server;s. Foreign displays differ in having a host name in the display name, may it be localhost. The display name must be something that can be passed in the option to an X program. This string is used to generate the display-specific section names, so be careful to match the names. The display name of &XDMCP; displays is derived from the display's address by reverse host name resolution. For configuration purposes, the localhost prefix from locally running &XDMCP; displays is not stripped to make them distinguishable from local &X-Server;s started by &kdm;. The display class portion is also used in the display-specific sections. This is useful if you have a large collection of similar displays (such as a corral of X terminals) and would like to set options for groups of them. When using &XDMCP;, the display is required to specify the display class, so the manual for your particular X terminal should document the display class string for your device. If it does not, you can run &kdm; in debug mode and grep the log for class. The displays specified in will not be started when &kdm; starts up, but when it is explicitly requested via -the command socket (or FiFo). +the command socket. If reserve displays are specified, the &kde; menu will have a Start New Session item near the bottom; use that to activate a reserve display with a new login session. The monitor will switch to the new display, and you will have a minute to login. If there are no more reserve displays available, the menu item will be disabled. When &kdm; starts a session, it sets up authorization data for the &X-Server;. For local servers, &kdm; passes  filename on the &X-Server;'s command line to point it at its authorization data. For &XDMCP; displays, &kdm; passes the authorization data to the &X-Server; via the Accept &XDMCP; message. &XDMCP; access control The file specified by the option provides information which &kdm; uses to control access from displays requesting service via &XDMCP;. The file contains four types of entries: entries which control the response to Direct and Broadcast queries, entries which control the response to Indirect queries, macro definitions for Indirect entries, and entries which control on which network interfaces &kdm; listens for &XDMCP; queries. Blank lines are ignored, # is treated as a comment delimiter causing the rest of that line to be ignored, and \ causes an immediately following newline to be ignored, allowing indirect host lists to span multiple lines. The format of the Direct entries is simple, either a host name or a pattern, which is compared against the host name of the display device. Patterns are distinguished from host names by the inclusion of one or more meta characters; * matches any sequence of 0 or more characters, and ? matches any single character. If the entry is a host name, all comparisons are done using network addresses, so any name which converts to the correct network address may be used. Note that only the first network address returned for a host name is used. For patterns, only canonical host names are used in the comparison, so ensure that you do not attempt to match aliases. Host names from &XDMCP; queries always contain the local domain name even if the reverse lookup returns a short name, so you can use patterns for the local domain. Preceding the entry with a ! character causes hosts which match that entry to be excluded. To only respond to Direct queries for a host or pattern, it can be followed by the optional NOBROADCAST keyword. This can be used to prevent a &kdm; server from appearing on menus based on Broadcast queries. An Indirect entry also contains a host name or pattern, but follows it with a list of host names or macros to which the queries should be forwarded. Indirect entries can be excluding as well, in which case a (valid) dummy host name must be supplied to make the entry distinguishable from a Direct entry. If compiled with IPv6 support, multicast address groups may also be included in the list of addresses the queries are forwarded to. If the indirect host list contains the keyword CHOOSER, Indirect queries are not forwarded, but instead a host chooser dialog is displayed by &kdm;. The chooser will send a Direct query to each of the remaining host names in the list and offer a menu of all the hosts that respond. The host list may contain the keyword BROADCAST, to make the chooser send a Broadcast query as well; note that on some operating systems, UDP packets cannot be broadcast, so this feature will not work. When checking access for a particular display host, each entry is scanned in turn and the first matching entry determines the response. Direct and Broadcast entries are ignored when scanning for an Indirect entry and vice-versa. A macro definition contains a macro name and a list of host names and other macros that the macro expands to. To distinguish macros from hostnames, macro names start with a % character. The last entry type is the LISTEN directive. The formal syntax is  LISTEN [interface [multicast list]] If one or more LISTEN lines are specified, &kdm; listens for &XDMCP; requests only on the specified interfaces. interface may be a hostname or IP address representing a network interface on this machine, or the wildcard * to represent all available network interfaces. If multicast group addresses are listed on a LISTEN line, &kdm; joins the multicast groups on the given interface. For IPv6 multicasts, the IANA has assigned ff0X:0:0:0:0:0:0:12b as the permanently assigned range of multicast addresses for &XDMCP;. The X in the prefix may be replaced by any valid scope identifier, such as 1 for Node-Local, 2 for Link-Local, 5 for Site-Local, and so on (see IETF RFC 2373 or its replacement for further details and scope definitions). &kdm; defaults to listening on the Link-Local scope address ff02:0:0:0:0:0:0:12b to most closely match the IPv4 subnet broadcast behavior. If no LISTEN lines are given, &kdm; listens on all interfaces and joins the default &XDMCP; IPv6 multicast group (when compiled with IPv6 support). To disable listening for &XDMCP; requests altogether, a LISTEN line with no addresses may be specified, but using the [Xdmcp] option is preferred. Supplementary programs The following programs are run by &kdm; at various stages of a session. They typically are shell scripts. The Setup, Startup and Reset programs are run as root, so they should be careful about security. Their first argument is auto if the session results from an automatic login; otherwise, no arguments are passed to them. Setup program The Xsetup program is run after the &X-Server; is started or reset, but before the greeter is offered. This is the place to change the root background (if is disabled) or bring up other windows that should appear on the screen along with the greeter. In addition to any specified by , the following environment variables are passed: DISPLAY the associated display name PATH the value of SHELL the value of XAUTHORITY may be set to an authority file DM_CONTROL the value of Note that since &kdm; grabs the keyboard, any other windows will not be able to receive keyboard input. They will be able to interact with the mouse, however; beware of potential security holes here. If is set, Xsetup will not be able to connect to the display at all. Resources for this program can be put into the file named by . Startup program The Xstartup program is run as root when the user logs in. This is the place to put commands which add entries to utmp (the sessreg program may be useful here), mount users' home directories from file servers, or abort the session if some requirements are not met (but note that on modern systems, many of these tasks are already taken care of by PAM modules). In addition to any specified by , the following environment variables are passed: DISPLAY the associated display name HOME the initial working directory of the user LOGNAME the username USER the username PATH the value of SHELL the value of XAUTHORITY may be set to an authority file DM_CONTROL the value of &kdm; waits until this program exits before starting the user session. If the exit value of this program is non-zero, &kdm; discontinues the session and starts another authentication cycle. Session program The Xsession program is the command which is run as the user's session. It is run with the permissions of the authorized user. One of the keywords failsafe, default or custom, or a string to eval by a Bourne-compatible shell is passed as the first argument. In addition to any specified by , the following environment variables are passed: DISPLAY the associated display name HOME the initial working directory of the user LOGNAME the username USER the username PATH the value of (or for root user sessions) SHELL the user's default shell XAUTHORITY may be set to a non-standard authority file KRBTKFILE may be set to a Kerberos4 credentials cache name KRB5CCNAME may be set to a Kerberos5 credentials cache name DM_CONTROL the value of XDM_MANAGED will contain a comma-separated list of parameters the - session might find interesting, like the location of the command - FiFo and its capabilities, and which conversation + session might find interesting, like which conversation plugin was used for the login DESKTOP_SESSION the name of the session the user has chosen to run Reset program Symmetrical with Xstartup, the Xreset program is run after the user session has terminated. Run as root, it should contain commands that undo the effects of commands in Xstartup, removing entries from utmp or unmounting directories from file servers. The environment variables that were passed to Xstartup are also passed to Xreset. # The rest of this file are section and key definitions for the options. # The order of the keywords is fixed and everything is case sensitive. # A keyword may expect supplementary data in the form of space-indented # lines following it. Definitions are delimited by empty lines. # # Section definition: # Section: # Section name. Section classes start with a dash. # If: # C preprocessor conditional for supporting this section. # If it evaluates to false, all keys in this section are disabled as well. # Description: # A docbook description of this section is expected in the next lines. # The contents are automatically enclosed in . # # Option key definition: # Key: # Option name. # If: # C preprocessor conditional for supporting this option. # Type: (int|bool|enum|group|string|path|list) # The option's data type. # If the type is enum, the element definitions follow in the next lines: # [/]: # Default: # Default value. string, path and list are copied verbatim and therefore # must be already quoted appropriately. The other types are auto-quoted. # If the default value is prefixed with a "*", a c #define def_ is # created. # The default is automatically appended to the kdmrc comment and the # documentation entry. # CDefault: # Append this instead of the real default to the two docs. The quoting # rules are the same as for Default. # DDefault: - # If specified, the default value will not be appended to the documentation # entry. The Description should mention the default then. Use this when # the default is system-dependent. # PostProc: # A function to postprocess the read config value before using it. # User: (dummy|(core|greeter|greeter-c|dep|config)[()][:font]) # These entries specify which parts of kdm need the option in question: # dummy: no user; entry is there only for syntactical correctness. # dep: this option is an internal dependency for another option. # config: this option configures the config reader itself. # core: the kdm backend needs this option. # greeter-c: the kdm frontend needs this option as a C data type. # greeter: the kdm frontend needs this option as a C++/Qt data type. # If a :font tag is appended, a string entry is converted to a QFont. # If no variable name is specified, it will be derived from the Key by # un-capitalizing it. # Instance: (-|[#][/](!|)) # These entries specify option instances for the default/example kdmrc. # A "-" entry is a dummy for syntactical correctness. # A prefixing hash mark will be copied to kdmrc. # For options in a section class a display must be specified. # For bool options "!" can be used as the value to specify the negation # of the default. # Update: [/] # Call this function on each occurence of this option in genkdmconf. # Options with higher numbers (default is 0) will be processed later. # Merge: (xdm[:][()]|kdm:[
/][][]) # Specify config options to merge from xdm and older kdm versions. # Kdm options from the current version are automatically merged. # When merging an xdm resource and no resource name is specified, it is # derived from the Key by un-capitalizing it. # When merging a kdm option, at least one of
and must # be given; an unspecified entity defaults to the current Section/Key. #
may be a dash-prefixed section class. # A function to postprocess the read value can be specified. # Comment: [&|-] # A kdmrc comment for this option is expected in the next lines. # If "-" is given to Comment, no comment is generated at all. # If "&" is given, the comment is derived from the Description below by # applying some simple docbook interpretation to it. Note that the # Description must be preformatted in this case. Use # sed -ne 's/^\(.\{79,\}\)$/\1/p' < kdmrc # after running "make install" to see whether all lines still fit. # If Type is enum, a list of the previously defined element/description # pairs is appended; the descriptions undergo docbook interpretation. # Finally, a sentence with the Default (or CDefault, if given) is appended. # Description: [!|-] # A docbook description of this option is expected in the next lines. # The contents are automatically enclosed in . # If "-" is given to Description, no comment is generated at all. # If "!" is given, enums are not treated specially; otherwise, the macro # %ENUM% is replaced with a list of the defined element/description pairs, # or - if the macro is not present - the list is appended to the # description. # Finally, a sentence with the Default (or CDefault, if given) is appended, # unless "DDefault: -" was specified. # Each option entry generates an anchor named option-; # it can be referenced in the main documentation. # Do not forget to run "make ref" in kdebase/doc/kdm after changing # Descriptions. Section: General Description: This section contains global options that do not fit into any specific section. Key: ConfigVersion Type: string Default: "" CDefault: - User: dummy # will be overwritten Instance: Comment: This option exists solely for the purpose of a clean automatic upgrade. Do not even think about changing it! Description: This option exists solely for the purpose of clean automatic upgrades. Do not change it, you may interfere with future upgrades and this could result in &kdm; failing to run. Key: PAMService If: defined(USE_PAM) Type: string Default: KDM_PAM_SERVICE User: core Instance: - Comment: - Description: - Proc: absorb_xservers # note: this can miss Xservers from kdm for kde 2.2 because of stupid default. Source: kdm:General/Xservers Source: xdm:servers Key: StaticServers Type: list Default: ":0" User: core Instance: ":0" Comment: List of permanent displays. Displays with a hostname are foreign. A display class may be specified separated by an underscore. Description: List of displays (&X-Server;s) permanently managed by &kdm;. Displays with a hostname are foreign displays which are expected to be already running, the others are local displays for which &kdm; starts an own &X-Server;; see . Each display may belong to a display class; append it to the display name separated by an underscore. See for the details. Key: ReserveServers Type: list Default: "" User: core Instance: ":1,:2,:3" Comment: & Description: List of on-demand displays. See for syntax. Key: ServerVTs If: defined(HAVE_VTS) Type: list Default: "" User: core Instance: #"7,8,-9,-10" Update: upd_servervts Comment: VTs to allocate to &X-Server;s. A negative number means that the VT will be used only if it is free. If all VTs in this list are used up, the next free one greater than the last one in this list will be allocated. Description: List of Virtual Terminals to allocate to &X-Server;s. For negative numbers the absolute value is used, and the VT will be allocated only if the kernel says it is free. If &kdm; exhausts this list, it will allocate free VTs greater than the absolute value of the last entry in this list. Currently Linux only. Key: ConsoleTTYs If: defined(HAVE_VTS) Type: list Default: "" User: core Instance: #"tty1,tty2,tty3,tty4,tty5,tty6" Update: upd_consolettys Comment: TTYs (without /dev/) to monitor for activity while in console mode. Description: This option is for operating systems (OSs) with support for virtual terminals (VTs), by both &kdm; and the OSs itself. Currently this applies only to Linux. When &kdm; switches to console mode, it starts monitoring all TTY lines listed here (without the leading /dev/). If none of them is active for some time, &kdm; switches back to the X login. Key: PidFile Type: string Default: "" User: core Instance: "/var/run/kdm.pid" Merge: xdm Comment: Where &kdm; should store its PID (do not store if empty). Description: The filename specified will be created to contain an ASCII representation of the process ID of the main &kdm; process; the PID will not be stored if the filename is empty. Key: LockPidFile Type: bool Default: true User: core Instance: #! Merge: xdm Comment: Whether &kdm; should lock the PID file to prevent having multiple &kdm; instances running at once. Do not change unless you are brave. Description: This option controls whether &kdm; uses file locking to keep multiple display managers from running onto each other. Key: AuthDir Type: path # differs from XDM Default: "/var/run/xauth" User: core Instance: #"/tmp" Merge: xdm(P_authDir) Comment: Where to store authorization files. Description: This names a directory under which &kdm; stores &X-Server; authorization files while initializing the session. &kdm; expects the system to clean up this directory from stale files on reboot. The authorization file to be used for a particular display can be specified with the option in [X-*-Core]. Key: AutoRescan Type: bool Default: true User: core Instance: #! Merge: xdm Comment: Whether &kdm; should automatically re-read configuration files, if it finds them having changed. Description: This boolean controls whether &kdm; automatically re-reads its configuration files if it finds them to have changed. Key: ExportList Type: list Default: "" User: core Instance: #"LD_LIBRARY_PATH,ANOTHER_IMPORTANT_VAR" Merge: xdm(P_List) Comment: & Description: Additional environment variables &kdm; should pass on to all programs it runs. LD_LIBRARY_PATH and XCURSOR_THEME are good candidates; otherwise, it should not be necessary very often. Key: RandomFile If: !defined(ARC4_RANDOM) && !defined(DEV_RANDOM) Type: string Default: "/dev/mem" User: core Instance: #"" Merge: xdm Comment: A file &kdm; should read entropy from. Description: If the system has no native entropy source like /dev/urandom (see ) and no entropy daemon like EGD (see and ) is running, &kdm; will fall back to its own pseudo-random number generator that will, among other things, successively checksum parts of this file (which, obviously, should change frequently). This option does not exist on Linux and various BSDs. Key: PrngdSocket If: !defined(ARC4_RANDOM) && !defined(DEV_RANDOM) Type: string # differs from xdm! Default: "" User: core Instance: #"/tmp/entropy" Merge: xdm Comment: A UNIX domain socket &kdm; should read entropy from. Description: If the system has no native entropy source like /dev/urandom (see ), read random data from a Pseudo-Random Number Generator Daemon, like EGD (http://egd.sourceforge.net) via this UNIX domain socket. This option does not exist on Linux and various BSDs. Key: PrngdPort If: !defined(ARC4_RANDOM) && !defined(DEV_RANDOM) Type: int Default: 0 User: core Instance: #4840 Merge: xdm Comment: A TCP socket on localhost &kdm; should read entropy from. Description: Same as , only use a TCP socket on localhost. Key: RandomDevice If: !defined(ARC4_RANDOM) Type: string Default: "" User: core Instance: #"/dev/altrandom" Merge: xdm Comment: A character device &kdm; should read entropy from. Empty means use the system's preferred entropy device. Description: The path to a character device which &kdm; should read random data from. Empty means to use the system's preferred entropy device if there is one. This option does not exist on OpenBSD, as it uses the arc4_random function instead. Key: FifoDir Type: path Default: *"/var/run/xdmctl" User: core Instance: #"/tmp" Update: upd_fifodir Comment: - Where the command FiFos should be created; make it empty to disable + Where the command sockets should be created; make it empty to disable them. Description: - The directory in which the command FiFos should + The directory in which the command sockets should be created; make it empty to disable them. # See for the details. Key: FifoGroup Type: group Default: 0 User: core Instance: #xdmctl Comment: & Description: - The group to which the global command FiFo should belong; + The group to which the global command socket should belong; can be either a name or a numerical ID. Key: DataDir Type: path Default: *"/var/lib/kdm" User: greeter Instance: #"" Update: upd_datadir Comment: The directory in which &kdm; should store persistent working data. Description: The directory in which &kdm; should store persistent working data; such data is, for example, the previous user that logged in on a particular display. Key: DmrcDir Type: path Default: "" User: core Instance: #"/nfs-shared/var/dmrcs" Comment: & Description: The directory in which &kdm; should store users' .dmrc files. This is only needed if the home directories are not readable before actually logging in (like with AFS). Section: Xdmcp If: defined(XDMCP) Description: This section contains options that control &kdm;'s handling of &XDMCP; requests. # See to find out what &XDMCP; is. Key: Enable Type: bool Default: true User: dep(xdmcpEnable) Instance: false Comment: & Description: Whether &kdm; should listen to incoming &XDMCP; requests. Key: Port Type: int Default: 177 PostProc: PrequestPort User: core(request_port) Instance: # Merge: xdm:requestPort(P_requestPort) Comment: The UDP port on which &kdm; should listen for &XDMCP; requests. Do not change. Description: This indicates the UDP port number which &kdm; uses to listen for incoming &XDMCP; requests. Unless you need to debug the system, leave this with its default value. Key: KeyFile Type: string Default: "" User: core Instance: #KDMCONF "/kdmkeys" Update: cp_keyfile Merge: xdm Comment: File with the private keys of X-terminals. Required for XDM authentication. Description: XDM-AUTHENTICATION-1 style &XDMCP; authentication requires a private key to be shared between &kdm; and the terminal. This option specifies the file containing those values. Each entry in the file consists of a display name and the shared key. Key: Xaccess Type: string # differs from xdm Default: *KDMCONF "/Xaccess" User: config(Xaccess) Instance: #"" Update: mk_xaccess Merge: xdm:accessFile Comment: &XDMCP; access control file in the usual XDM-Xaccess format. Description: To prevent unauthorized &XDMCP; service and to allow forwarding of &XDMCP; IndirectQuery requests, this file contains a database of hostnames which are either allowed direct access to this machine, or have a list of hosts to which queries should be forwarded to. The format of this file is described in . Key: ChoiceTimeout Type: int Default: 15 User: core Instance: #10 Merge: xdm Comment: Number of seconds to wait for display to respond after the user has selected a host from the chooser. Description: Number of seconds to wait for the display to respond after the user has selected a host from the chooser. If the display sends an &XDMCP; IndirectQuery within this time, the request is forwarded to the chosen host; otherwise, it is assumed to be from a new session and the chooser is offered again. Key: RemoveDomainname Type: bool Default: true User: core Instance: #! Merge: xdm Comment: Strip domain name from remote display names if it is equal to the local domain. Description: When computing the display name for &XDMCP; clients, the name resolver will typically create a fully qualified host name for the terminal. As this is sometimes confusing, &kdm; will remove the domain name portion of the host name if it is the same as the domain name of the local host when this option is enabled. Key: SourceAddress Type: bool Default: false User: core Instance: #! Merge: xdm Comment: Use the numeric IP address of the incoming connection on multihomed hosts instead of the host name. Description: Use the numeric IP address of the incoming connection on multihomed hosts instead of the host name. This is to avoid trying to connect on the wrong interface which might be down at this time. Key: Willing Type: string Default: "" User: core # will be overwritten Instance: # Update: mk_willing Merge: xdm Merge: kdm:Xwilling Comment: The program which is invoked to dynamically generate replies to &XDMCP; DirectQuery or BroadcastQuery requests. If empty, no program is invoked and "Willing to manage" is sent. Description: This specifies a program which is run (as root) when an &XDMCP; DirectQuery or BroadcastQuery is received and this host is configured to offer &XDMCP; display management. The output of this program may be displayed in a chooser window. If no program is specified, the string Willing to manage is sent. Section: Shutdown Description: This section contains global options concerning system shutdown. Key: HaltCmd Type: string Default: HALT_CMD DDefault: - User: core(cmdHalt) Instance: #"" Comment: The command (subject to word splitting) to run to halt the system. Description: The command (subject to word splitting) to run to halt/poweroff the system. The default is something reasonable for the system on which &kdm; was built, like /sbin/shutdown  now. Key: RebootCmd Type: string Default: REBOOT_CMD DDefault: - User: core(cmdReboot) Instance: #"" Comment: The command (subject to word splitting) to run to reboot the system. Description: The command (subject to word splitting) to run to reboot the system. The default is something reasonable for the system &kdm; on which was built, like /sbin/shutdown  now. Key: AllowFifo Type: bool Default: false User: core(fifoAllowShutdown) Instance: #! Comment: & Description: - Whether it is allowed to shut down the system via the global command FiFo. + Whether it is allowed to shut down the system via the global command socket. Key: AllowFifoNow Type: bool Default: true User: core(fifoAllowNuke) Instance: #! Comment: Whether it is allowed to abort active sessions when shutting down the - system via the global command FiFo. + system via the global command socket. Description: Whether it is allowed to abort active sessions when shutting down the - system via the global command FiFo. + system via the global command socket. This will have no effect unless is enabled. Key: BootManager Type: enum None/BO_NONE: no boot manager Grub/BO_GRUB: Grub boot manager Lilo/BO_LILO: Lilo boot manager (Linux on i386 & x86-64 only) Default: None User: core User: greeter Instance: #Grub Merge: kdm:UseLilo(P_UseLilo) Comment: & Description: The boot manager &kdm; should use for offering boot options in the shutdown dialog. Section: -Core Description: This section class contains options concerning the configuration of the &kdm; backend (core). Key: OpenDelay Type: int Default: 15 User: core Instance: #*/ Merge: xdm(P_openDelay) Comment: How long to wait before retrying to connect a display. Description: See . Key: OpenTimeout Type: int Default: 120 User: core Instance: #*/ Merge: xdm Comment: How long to wait before timing out a display connection attempt. Description: See . Key: OpenRepeat Type: int Default: 5 User: core Instance: #*/ Merge: xdm Comment: How many connection attempts to make during a start attempt. Note that a timeout aborts the entire start attempt. Description: These options control the behavior of &kdm; when attempting to open a connection to an &X-Server;. is the length of the pause (in seconds) between successive attempts, is the number of attempts to make and is the amount of time to spend on a connection attempt. After attempts have been made, or if seconds elapse in any particular connection attempt, the start attempt is considered failed. Key: StartAttempts Type: int Default: 4 User: core Instance: #*/ Merge: xdm Comment: Try at most that many times to start a display. If this fails, the display is disabled. Description: How many times &kdm; should attempt to start a foreign display listed in before giving up and disabling it. Local displays are attempted only once, and &XDMCP; displays are retried indefinitely by the client (unless the option was given to the &X-Server;). Key: ServerAttempts Type: int Default: 1 User: core Instance: #:*/ Merge: xdm Comment: How often to try to run the &X-Server;. Running includes executing it and waiting for it to come up. Description: How many times &kdm; should attempt to start up a local &X-Server;. Starting up includes executing it and waiting for it to come up. Key: ServerTimeout Type: int Default: 15 User: core Instance: #:*/ Comment: How long to wait for a local &X-Server; to come up. Description: How many seconds &kdm; should wait for a local &X-Server; to come up. Key: ServerCmd Type: string Default: DEF_SERVER_CMD DDefault: - User: core Instance: :*/DEF_SERVER_CMD Comment: The command line to start the &X-Server;, without display number and VT spec. This string is subject to word splitting. Description: The command line to start the &X-Server;, without display number and VT spec. This string is subject to word splitting. The default is something reasonable for the system on which &kdm; was built, like /usr/X11R6/bin/X. Key: ServerArgsLocal Type: string Default: "" User: core Instance: :*/"-nolisten tcp" Comment: & Description: Additional arguments for the &X-Server;s for local sessions. This string is subject to word splitting. Key: ServerArgsRemote Type: string Default: "" User: core Instance: #:*/"" Comment: & Description: Additional arguments for the &X-Server;s for remote sessions. This string is subject to word splitting. Key: ServerVT If: defined(HAVE_VTS) Type: int Default: 0 User: core(reqSrvVT) Instance: #:0/7 Comment: The VT the &X-Server; should run on; auto-assign if zero, don't assign if -1. Better leave it zero and use ServerVTs. Description: The VT the &X-Server; should run on. should be used instead of this option. Leave it zero to let &kdm; assign a VT automatically. Set it to -1 to avoid assigning a VT alltogether - this is required for setups with multiple physical consoles. Currently Linux only. Key: ServerTTY If: !defined(HAVE_VTS) Type: string Default: "" User: core(console) Instance: :0/DEF_SERVER_TTY Comment: The TTY line (without /dev/) the &X-Server; covers physically. Description: This option is for OSs without support for VTs, either by &kdm; or the OS itself. Currently this applies to all OSs but Linux. When &kdm; switches to console mode, it starts monitoring this TTY line (specified without the leading /dev/) for activity. If the line is not used for some time, &kdm; switches back to the X login. Key: PingInterval Type: int Default: 5 User: core User: greeter Instance: #*/ Merge: xdm Comment: Ping remote display every that many minutes. Description: See . Key: PingTimeout Type: int Default: 5 User: core User: greeter Instance: #*/ Merge: xdm Comment: Wait for a Pong that many minutes. Description: To discover when remote displays disappear, &kdm; regularly pings them. specifies the time (in minutes) between the pings and specifies the maximum amount of time (in minutes) to wait for the terminal to respond to the request. If the terminal does not respond, the session is declared dead and terminated. If you frequently use X terminals which can become isolated from the managing host, you may wish to increase the timeout. The only worry is that sessions will continue to exist after the terminal has been accidentally disabled. Key: TerminateServer Type: bool Default: false User: core Instance: #:*/! Merge: xdm Comment: Restart instead of resetting the local &X-Server; after session exit. Use it if the server leaks memory etc. Description: Whether &kdm; should restart the local &X-Server; after session exit instead of resetting it. Use this if the &X-Server; leaks memory or crashes the system on reset attempts. Key: ResetSignal Type: int Default: 1 CDefault: 1 (SIGHUP) User: core Instance: #:*/ Merge: xdm Comment: The signal needed to reset the local &X-Server;. Description: The signal number to use to reset the local &X-Server;. Key: TermSignal Type: int Default: 15 CDefault: 15 (SIGTERM) User: core Instance: #:*/ Merge: xdm Comment: The signal needed to terminate the local &X-Server;. Description: The signal number to use to terminate the local &X-Server;. Key: Authorize Type: bool Default: true User: core Instance: #:*/! Merge: xdm Comment: Create X-authorizations for local displays. Description: Controls whether &kdm; generates and uses authorization for local &X-Server; connections. For &XDMCP; displays the authorization requested by the display is used; foreign non-&XDMCP; displays do not support authorization at all. Key: AuthNames Type: list Default: DEF_AUTH_NAME User: core Instance: #:*/"" Merge: xdm:authName Comment: Which X-authorization mechanisms should be used. Description: If is true, use the authorization mechanisms listed herein. The MIT-MAGIC-COOKIE-1 authorization is always available; XDM-AUTHORIZATION-1, SUN-DES-1 and MIT-KERBEROS-5 might be available as well, depending on the build configuration. Key: ResetForAuth Type: bool Default: false User: core Instance: #:*/! Merge: xdm Comment: Need to reset the &X-Server; to make it read initial Xauth file. Description: Some old &X-Server;s re-read the authorization file at &X-Server; reset time, instead of when checking the initial connection. As &kdm; generates the authorization information just before connecting to the display, an old &X-Server; would not get up-to-date authorization information. This option causes &kdm; to send SIGHUP to the &X-Server; after setting up the file, causing an additional &X-Server; reset to occur, during which time the new authorization information will be read. Key: AuthFile Type: string Default: "" User: core(clientAuthFile) Instance: #*/"" Merge: xdm Comment: The name of this &X-Server;'s Xauth file. If empty, a random name in the AuthDir directory will be used. Description: This file is used to communicate the authorization data from &kdm; to the &X-Server;, using the &X-Server; command line option. It should be kept in a directory which is not world-writable as it could easily be removed, disabling the authorization mechanism in the &X-Server;. If not specified, a random name is generated from and the name of the display. Key: Resources # XXX strictly speaking this is supposed to be a string list, i think. Type: string Default: "" User: core Instance: #*/"" Update: cp_resources Merge: xdm Comment: Specify a file with X-resources for the greeter, chooser and background. The KDE frontend does not use this file, so you do not need it unless you use another background generator than krootimage. Description: This option specifies the name of the file to be loaded by xrdb as the resource database onto the root window of screen 0 of the display. KDE programs generally do not use X-resources, so this option is only needed if the program needs some X-resources. Key: Xrdb Type: string Default: XBINDIR "/xrdb" User: core Instance: #*/"" Merge: xdm Comment: The xrdb program to use to read the above specified recources. Subject to word splitting. Description: The xrdb program to use to read the X-resources file specified in . The command is subject to word splitting. Key: Setup Type: string Default: "" User: core # will be overwritten Instance: #*/"" Update: mk_setup Merge: xdm Comment: A program to run before the greeter is shown. Can be used to start an xconsole or an alternative background generator. Subject to word splitting. Description: This string is subject to word splitting. It specifies a program which is run (as root) before offering the greeter window. This may be used to change the appearance of the screen around the greeter window or to put up other windows (e.g., you may want to run xconsole here). The conventional name for a file used here is Xsetup. See . Key: Startup Type: string Default: "" User: core # will be overwritten Instance: #*/"" Update: mk_startup Merge: xdm Comment: A program to run before a user session starts. Subject to word splitting. Description: This string is subject to word splitting. It specifies a program which is run (as root) after the user authentication process succeeds. The conventional name for a file used here is Xstartup. See . Key: Reset Type: string Default: "" User: core # will be overwritten Instance: #*/"" Update: mk_reset Merge: xdm Comment: A program to run after a user session exits. Subject to word splitting. Description: This string is subject to word splitting. It specifies a program which is run (as root) after the session terminates. The conventional name for a file used here is Xreset. See . Key: Session Type: string Default: XBINDIR "/xterm -ls -T" #Merge: xdm - incompatible! User: core # will be overwritten Instance: #*/"" Update: mk_session Comment: The program which is run as the user which logs in. It is supposed to interpret the session argument (see SessionsDirs) and start an appropriate session according to it. Subject to word splitting. Description: This string is subject to word splitting. It specifies the session program to be executed (as the user owning the session). The conventional name for a file used here is Xsession. See . Key: FailsafeClient Type: string Default: XBINDIR "/xterm" User: core Instance: #*/"" Merge: xdm Comment: The program to run if Session fails. Description: If the program fails to execute, &kdm; will fall back to this program. This program is executed with no arguments, but executes using the same environment variables as the session would have had (see ). Key: UserPath Type: string Default: DEF_USER_PATH DDefault: - User: core Instance: #*/"" Merge: xdm Comment: The PATH for the Session program. Description: The PATH environment variable for non-root s. The default depends on the system &kdm; was built on. Key: SystemPath Type: string Default: DEF_SYSTEM_PATH DDefault: - User: core Instance: #*/"" Merge: xdm Comment: The PATH for Setup, Startup and Reset, etc. Description: The PATH environment variable for all programs but non-root s. Note that it is good practice not to include . (the current directory) into this entry. The default depends on the system &kdm; was built on. Key: SystemShell Type: string Default: "/bin/sh" User: core Instance: #*/"/bin/bash" Merge: xdm Comment: The default system shell. Description: The SHELL environment variable for all programs but the . Key: UserAuthDir Type: path Default: "/tmp" User: core Instance: #*/"" Merge: xdm Comment: Where to put the user's &X-Server; authorization file if ~/.Xauthority cannot be created. Description: When &kdm; is unable to write to the usual user authorization file ($HOME/.Xauthority), it creates a unique file name in this directory and points the environment variable XAUTHORITY at the created file. Key: AutoReLogin Type: bool Default: false User: core Instance: #*/! Merge: xdm Comment: Whether to automatically restart sessions after &X-Server; crashes. Note that enabling this makes circumventing screen lockers other than KDE's built-in one possible! Description: If enabled, &kdm; will automatically restart a session after an &X-Server; crash (or if it is killed by Alt-Ctrl-BackSpace). Note that enabling this feature opens a security hole: a secured display lock can be circumvented (unless &kde;'s built-in screen locker is used). Key: AllowRootLogin Type: bool Default: true User: core User: greeter(showRoot) Instance: */false Merge: xdm Comment: Allow root logins? Description: If disabled, do not allow root (and any other user with UID = 0) to log in directly. Key: AllowNullPasswd Type: bool Default: true User: core # sensible? Instance: */false Instance: :*/true Merge: xdm Comment: Allow to log in, when user has set an empty password? Description: If disabled, only users that have passwords assigned can log in. Key: AllowShutdown Type: enum None/SHUT_NONE: no Shutdown... menu entry is shown at all Root/SHUT_ROOT: the root password must be entered to shut down All/SHUT_ALL: everybody can shut down the machine Default: All User: core User: greeter Instance: */Root Instance: :*/All Merge: kdm:-Greeter/ Comment: & Description: Who is allowed to shut down the system. This applies both to the - greeter and to the command FiFo. + greeter and to the command sockets. Key: AllowSdForceNow Type: enum None: no forced shutdown is allowed at all Root: the root password must be entered to shut down forcibly All: everybody can shut down the machine forcibly Default: All User: core(allowNuke) User: greeter(allowNuke) Instance: #*/Root Comment: & Description: Who is allowed to abort active sessions when shutting down. Key: DefaultSdMode Type: enum Schedule: shut down after all active sessions exit (possibly at once) TryNow: shut down, if no active sessions are open; otherwise, do nothing ForceNow: shut down unconditionally Default: Schedule User: core(defSdMode) User: greeter(defSdMode) Instance: #*/ForceNow Comment: & Description: The default choice for the shutdown condition/timing. Key: ScheduledSd Type: enum Never/SHUT_NEVER: not at all Optional/SHUT_OPTION: as a button in the simple shutdown dialogs Always/SHUT_ALWAYS: instead of the simple shutdown dialogs Default: Never User: greeter Instance: #*/Optional Comment: & Description: How to offer shutdown scheduling options: Key: NoPassEnable Type: bool Default: false User: dep Instance: #:*/true Comment: & Description: Enable password-less logins on this display. Use with extreme care! Key: NoPassUsers Type: list Default: "" PostProc: PnoPassUsers User: core Instance: #:*/"fred,ethel" Merge: xdm(P_noPassUsers) Comment: The users that do not need to provide a password to log in. NEVER list root! "*" means all non-root users. @ means all users in that group. Description: The users that do not need to provide a password to log in. Items which are prefixed with @ represent all users in the user group named by that item. * means all users but root (and any other user with UID = 0). Never list root. Key: AutoLoginEnable Type: bool Default: false User: dep Instance: #:0/true Comment: & Description: Enable automatic login. Use with extreme care! Key: AutoLoginAgain Type: bool Default: false User: core(autoAgain) User: greeter Instance: #:0/true Comment: & Description: If true, auto-login after logout. If false, auto-login is performed only when a display session starts up. Key: AutoLoginDelay Type: int Default: 0 User: core(autoDelay) User: greeter Instance: #:0/10 Comment: The delay in seconds before automatic login kicks in. Description: The delay in seconds before automatic login kicks in. This is also known as Timed Login. Key: AutoLoginUser Type: string Default: "" PostProc: PautoLoginX User: core(autoUser) User: greeter Instance: #:0/"fred" Merge: xdm:autoUser(P_autoUser) Comment: & Description: The user to log in automatically. Never specify root! Key: AutoLoginPass Type: string Default: "" PostProc: PautoLoginX User: core(autoPass) Instance: #:0/"secret!" Merge: xdm:autoPass(P_autoPass) Comment: & Description: The password for the user to log in automatically. This is not required unless the user is logged into a NIS or Kerberos domain. If you use this option, you should chmod  kdmrc for obvious reasons. Key: AutoLoginLocked Type: bool Default: false User: core(autoLock) Instance: #:0/! Comment: & Description: Immediately lock the automatically started session. This works only with KDE sessions. Key: SessionsDirs Type: list Default: KDMDATA "/sessions" User: core User: greeter-c Instance: #*/"/etc/X11/sessions,/usr/share/xsessions" Comment: The directories containing session type definitions in .desktop format. Description: A list of directories containing session type definitions. # See for details. Key: ClientLogFile Type: string Default: ".xsession-errors" User: core Instance: */".xsession-errors-%s" Instance: :0/".xsession-errors" Comment: The file (relative to $HOME) to redirect the session output to. This is a printf format string; one %s will be replaced with the display name. Description: The file (relative to the user's home directory) to redirect the session output to. One occurrence of %s in this string will be substituted with the display name. Use %% to obtain a literal %. Key: UseSessReg Type: bool Default: true User: core Instance: #*/! Comment: Whether &kdm;'s built-in utmp/wtmp/lastlog registration should be used. Description: Specify whether &kdm;'s built-in utmp/wtmp/lastlog registration should be used. If it is not, the tool sessreg should be used in the and scripts, or, alternatively, the pam_lastlog module should be used on PAM-enabled systems. Section: -Greeter Description: This section class contains options concerning the configuration of the &kdm; frontend (greeter). Key: GUIStyle Type: string Default: "" User: greeter Instance: #*/"Windows" Update: upd_guistyle Comment: Widget style of the greeter. "" means the built-in default which currently is "Plastik". Description: Specify the widget style for the greeter. Empty means to use the built-in default which currently is Plastik. Key: ColorScheme Type: string Default: "" User: greeter Instance: #*/"Pumpkin" Comment: Widget color scheme of the greeter. "" means the built-in default which currently is yellowish grey with some light blue and yellow elements. Description: Specify the widget color scheme for the greeter. Empty means to use the built-in default which currently is yellowish grey with some light blue and yellow elements. Key: LogoArea Type: enum None/LOGO_NONE: nothing Logo/LOGO_LOGO: the image specified by Clock/LOGO_CLOCK: a neat analog clock Default: Clock User: greeter Instance: */Logo Comment: What should be shown in the greeter's logo are: Description: What should be shown in the greeter righthand of the input lines (if is disabled) or above them (if is enabled): Key: LogoPixmap Type: string Default: "" User: greeter(logo) Instance: */KDMDATA "/pics/kdelogo.png" Comment: The image to show when LogoArea=Logo. Description: The image to show in the greeter if is Logo. Key: GreeterPos Type: string Default: "50,50" User: greeter-c Instance: #*/"30,40" Comment: The relative coordinates (X,Y in percent) of the center of the greeter. Description: The relative coordinates (percentages of the screen size; X,Y) at which the center of the greeter is put. &kdm; aligns the greeter to the edges of the screen it would cross otherwise. Key: GreeterScreen Type: int Default: 0 User: greeter Instance: #*/-1 Comment: & Description: The screen the greeter should be displayed on in multi-headed and Xinerama setups. The numbering starts with 0. For Xinerama, it corresponds to the listing order in the active ServerLayout section of XF86Config; -1 means to use the upper-left screen, -2 means to use the upper-right screen. Key: GreetString Type: string Default: "Welcome to %s at %n" User: greeter Instance: #*/"K Desktop Environment (%n)" Comment: The headline in the greeter. The following character pairs are replaced: - %d -> current display - %h -> host name, possibly with domain name - %n -> node name, most probably the host name without domain name - %s -> the operating system - %r -> the operating system's version - %m -> the machine (hardware) type - %% -> a single % Description: The headline in the greeter. An empty greeting means none at all. The following character pairs are replaced by their value: %d name of the current display %h local host name, possibly with the domain name %n local node name, most probably the host name without the domain name %s operating system %r operating system version %m machine (hardware) type %% a single % # This needs to come _in front_ of the font settings to be effective! Key: AntiAliasing Type: bool Default: false User: greeter Instance: #*/! Comment: & Description: Whether the fonts used in the greeter should be antialiased. Key: GreetFont Type: string Default: "Serif,20,5,0,50,0" CDefault: "Serif,20,bold" User: greeter:font Instance: #*/"Serif,20,5,0,50,0" Comment: & Description: The font for the greeter headline. Key: StdFont Type: string Default: "Sans Serif,10,5,0,50,0" CDefault: "Sans Serif,10" User: greeter(normalFont):font Instance: #*/"Sans Serif,10,5,0,50,0" Comment: & Description: The normal font used in the greeter. Key: FailFont Type: string Default: "Sans Serif,10,5,0,75,0" CDefault: "Sans Serif,10,bold" User: greeter:font Instance: #*/"Sans Serif,10,5,0,75,0" Comment: & Description: The font used for the Login Failed message. Key: NumLock Type: enum Off: turn off On: turn on Keep: do not change the state Default: Keep User: greeter(numLockStatus) Instance: #*/Off Comment: & Description: What to do with the Num Lock modifier for the time the greeter is running: Key: Language Type: string Default: "en_US" User: greeter-c Instance: #*/"de_DE" Update: upd_language Comment: & Description: Language and locale to use in the greeter, encoded like $LC_LANG. Key: UserCompletion Type: bool Default: false User: greeter Instance: #*/! Comment: & Description: Enable autocompletion in the username line edit. Key: UserList Type: bool Default: true User: greeter Instance: #*/! Comment: Enable user list (names along with images) in the greeter. Description: Show a user list with unix login names, real names, and images in the greeter. Key: ShowUsers Type: enum NotHidden/SHOW_ALL: all users except those listed in HiddenUsers Selected/SHOW_SEL: only the users listed in SelectedUsers Default: NotHidden User: greeter Instance: #*/Selected Update: upd_showusers Comment: User selection for UserCompletion and UserList: Description: ! This option controls which users will be shown in the user view () and/or offered for autocompletion (). If it is Selected, contains the final list of users. If it is NotHidden, the initial user list are all users found on the system. Users contained in are removed from the list, just like all users with a UID greater than specified in and users with a non-zero UID less than specified in . Items in and which are prefixed with @ represent all users in the user group named by that item. Finally, the user list will be sorted alphabetically, if is enabled. Key: SelectedUsers Type: list Default: "" User: greeter-c(users) Instance: #*/"root,johndoe" Merge: kdm:Users Comment: For ShowUsers=Selected. @ means all users in that group. Description: See . Key: HiddenUsers Type: list Default: "" User: greeter-c(noUsers) Instance: #*/"root" # depends on {Min,Max}ShowUID Update: upd_hiddenusers/1 Merge: kdm:NoUsers Comment: For ShowUsers=NotHidden. @ means all users in that group. Description: See . Key: MinShowUID Type: int Default: 0 User: greeter(lowUserId) # will be overwritten Instance: #*/ Update: upd_minshowuid Comment: Special case of HiddenUsers: users with a non-zero UID less than this number will not be shown as well. Description: See . Key: MaxShowUID Type: int Default: 65535 User: greeter(highUserId) # will be overwritten Instance: #*/ Update: upd_maxshowuid Comment: Complement to MinShowUID: users with a UID greater than this number will not be shown as well. Description: See . Key: SortUsers Type: bool Default: true User: greeter Instance: #*/! Comment: If false, the users are listed in the order they appear in /etc/passwd. If true, they are sorted alphabetically. Description: See . Key: FaceSource Type: enum AdminOnly/FACE_ADMIN_ONLY: from <>/$USER.face[.icon] PreferAdmin/FACE_PREFER_ADMIN: prefer <>, fallback on $HOME PreferUser/FACE_PREFER_USER: ... and the other way round UserOnly/FACE_USER_ONLY: from the user's $HOME/.face[.icon] Default: AdminOnly User: greeter Instance: #*/PreferUser Comment: Specify, where the users' pictures should be taken from. Description: If is enabled, this specifies where &kdm; gets the images from: %ENUM% The images can be in any format Qt recognizes, but the filename must match &kdm;'s expectations: .face.icon should be a 48x48 icon, while .face should be a 300x300 image. Currently the big image is used only as a fallback and is scaled down, but in the future it might be displayed full-size in the logo area or a tooltip. Key: FaceDir Type: string Default: *KDMDATA "/faces" User: greeter Instance: #*/"/usr/share/faces" Update: upd_facedir Comment: The directory containing the user images if FaceSource is not UserOnly. Description: See . Key: PreselectUser Type: enum None/PRESEL_NONE: do not preselect any user Previous/PRESEL_PREV: the user which successfully logged in last time Default/PRESEL_DEFAULT: the user specified in the option Default: None User: greeter(preselUser) Instance: #*/Previous Instance: :*/Previous Instance: #:0/Default Comment: Specify, if/which user should be preselected for log in. Description: Specify, if/which user should be preselected for log in: %ENUM% If is enabled and a user was preselected, the cursor is placed in the password input field automatically. Enabling user preselection can be considered a security hole, as it presents a valid login name to a potential attacker, so he only needs to guess the password. On the other hand, one could set to a fake login name. Key: DefaultUser Type: string Default: "" User: greeter Instance: #:0/"johndoe" Comment: The user to preselect if PreselectUser=Default. Description: See . Key: FocusPasswd Type: bool Default: false User: greeter Instance: #*/! Instance: :*/true Comment: If this is true, the password input line is focused automatically if a user is preselected. Description: See . Key: EchoMode Type: enum OneStar: * is shown for every typed letter ThreeStars: *** is shown for every typed letter NoEcho: nothing is shown at all, the cursor does not move # HACK! This must be in sync with KPasswordEdit::EchoModes (kpassdlg.h) Default: OneStar User: greeter Instance: #*/NoEcho Comment: & Description: The password input fields cloak the typed in text. Specify, how to do it: Key: UseBackground Type: bool Default: true User: greeter Instance: #*/! Comment: If true, krootimage will be automatically started by &kdm;; otherwise, the Setup script should be used to setup the background. Description: If enabled, &kdm; will automatically start the krootimage program to set up the background; otherwise, the program is responsible for the background. Key: BackgroundCfg Type: string Default: *KDMCONF "/backgroundrc" User: greeter-c Instance: #*/"" Update: handBgCfg Comment: The configuration file to be used by krootimage. Description: The configuration file to be used by krootimage. It contains a section named [Desktop0] like kdesktoprc does. Its options are not described herein; guess their meanings or use the control center. Key: GrabServer Type: bool Default: false User: greeter-c Instance: #*/! Comment: Hold the &X-Server; grabbed the whole time the greeter is visible. This may be more secure, but it will disable any background and other X-clients started from the Setup script. Description: To improve security, the greeter grabs the &X-Server; and then the keyboard when it starts up. This option specifies if the &X-Server; grab should be held for the duration of the name/password reading. When disabled, the &X-Server; is ungrabbed after the keyboard grab succeeds; otherwise, the &X-Server; is grabbed until just before the session begins. Enabling this option disables and . Key: GrabTimeout Type: int Default: 3 User: greeter Instance: #*/ Comment: How many seconds to wait for grab to succeed. Description: This option specifies the maximum time &kdm; will wait for the grabs to succeed. A grab may fail if some other X-client has the &X-Server; or the keyboard grabbed, or possibly if the network latencies are very high. You should be cautious when raising the timeout, as a user can be spoofed by a look-alike window on the display. If a grab fails, &kdm; kills and restarts the &X-Server; (if possible) and the session. Key: AuthComplain Type: bool Default: true User: greeter Instance: #*/! Merge: xdm Comment: Warn, if display has no X-authorization (local auth cannot be created, &XDMCP; display wants no auth, or display is foreign from StaticServers). Description: Warn, if a display has no X-authorization. This will be the case if the authorization file for a local &X-Server; could not be created, a remote display from &XDMCP; did not request any authorization or the display is a foreign display specified in . Key: LoginMode If: defined(XDMCP) Type: enum LocalOnly/LOGIN_LOCAL_ONLY: only local login possible DefaultLocal/LOGIN_DEFAULT_LOCAL: start up in local mode, but allow switching to remote mode DefaultRemote/LOGIN_DEFAULT_REMOTE: ... and the other way round RemoteOnly/LOGIN_REMOTE_ONLY: only choice of remote host possible Default: LocalOnly User: core User: greeter Instance: :*/DefaultLocal # from make_it_cool branch and SuSE 8.1 Merge: kdm:EnableChooser(P_EnableChooser) Comment: & Description: Specify whether the greeter of local displays should start up in host chooser (remote) or login (local) mode and whether it is allowed to switch to the other mode. Key: ChooserHosts If: defined(XDMCP) Type: list Default: "*" User: core Instance: #:*/"*,ugly,sky,dino,kiste.local,login.crap.com" Comment: A list of hosts to be automatically added to the remote login menu. The special name "*" means broadcast. Description: A list of hosts to be automatically added to the remote login menu. The special name * means broadcast. Has no effect if is LocalOnly. Key: ForgingSeed Type: int Default: 0 User: greeter Instance: #*/ Update: upd_forgingseed Comment: Random seed for forging saved session types, etc. of unknown users. This value should be random but constant across the login domain. Description: Use this number as a random seed when forging saved session types, etc. of unknown users. This is used to avoid telling an attacker about existing users by reverse conclusion. This value should be random but constant across the login domain. Key: ShowLog If: defined(WITH_KDM_XCONSOLE) Type: bool Default: false User: greeter Instance: :0/true Comment: Enable &kdm;'s built-in xconsole. Note that this can be enabled for only one display at a time. Description: Enable &kdm;'s built-in xconsole. Note that this can be enabled for only one display at a time. This option is available only if &kdm; was configured with . Key: LogSource If: defined(WITH_KDM_XCONSOLE) Type: string Default: "" User: greeter-c Instance: :0/"/dev/xconsole" Comment: The data source for &kdm;'s built-in xconsole. If empty, a console log redirection is requested from /dev/console. Description: The data source for &kdm;'s built-in xconsole. If empty, a console log redirection is requested from /dev/console. Has no effect if is disabled. Key: PluginsLogin Type: list Default: "classic" User: greeter Instance: #*/"sign" Comment: Specify conversation plugins for the login dialog. Each plugin can be specified as a base name (which expands to $kde_modulesdir/kgreet_$base) or as a full pathname. Description: Specify conversation plugins for the login dialog; the first in the list is selected initially. Each plugin can be specified as a base name (which expands to $kde_modulesdir/kgreet_base) or as a full pathname. Conversation plugins are modules for the greeter which obtain authentication data from the user. Currently only the classic plugin is shipped with &kde;; it presents the well-known username and password form. Key: PluginsShutdown Type: list Default: "classic" User: greeter Instance: #*/"modern" Comment: & Description: Same as , but for the shutdown dialog. Key: PluginOptions Type: list Default: "" User: greeter Instance: #*/"SomeKey=randomvalue,Foo=bar" Comment: A list of options of the form Key=Value. The conversation plugins can query these settings; it is up to them what possible keys are. Description: A list of options of the form Key=Value. The conversation plugins can query these settings; it is up to them what possible keys are. Key: AllowConsole Type: bool Default: true User: greeter(hasConsole) Instance: #*/! Comment: & Description: Show the Console Login action in the greeter (if / is configured). Key: AllowClose Type: bool Default: true User: greeter Instance: :*/false Comment: & Description: Show the Restart X Server/Close Connection action in the greeter. Key: Preloader Type: string Default: "" User: greeter-c Instance: */KDE_BINDIR "/preloadkde" Comment: & Description: A program to run while the greeter is visible. It is supposed to preload as much as possible of the session that is going to be started (most probably). Key: UseTheme Type: bool Default: false User: greeter Instance: #*/true Comment: & Description: Whether the greeter should be themed. Key: Theme Type: string Default: "" User: greeter Instance: */KDMDATA "/themes/circles" Comment: & Description: The theme to use for the greeter. Can point to either a directory or an XML file.