[Search for users] [Overall Top Noters] [List of all Conferences] [Download this site]

Conference bulova::decw_jan-89_to_nov-90

Title:DECWINDOWS 26-JAN-89 to 29-NOV-90
Notice:See 1639.0 for VMS V5.3 kit; 2043.0 for 5.4 IFT kit
Moderator:STAR::VATNE
Created:Mon Oct 30 1989
Last Modified:Mon Dec 31 1990
Last Successful Update:Fri Jun 06 1997
Number of topics:3726
Total number of notes:19516

545.0. "xphoon/security concern" by TLE::DANIELS (Brad Daniels, VAX C RTL whipping boy) Wed Apr 05 1989 18:44

I had  an  interesting thing happen today. I came in, and my workstation had
its  normal login prompt, but in the background was a moon against the stars
(a la xphoon).

I have  xphoon  running  in  a  queue  on the cluster, and start it with the
following command file:

$ set display/create/node=grue/transport=decnet
$ xphoon := $c$:[daniels.decwin]xphoon
$ xphoon -t 1440

The background had definitely been reset to the default when the last person
to use the workstation (this morning) logged out.

Somehow xphoon  was  able  to change the background even though there was no
one logged in. Shouldn't it have failed when it tried to do its thing? Could
its  "permission"  to  write  to  the  display  somehow be hanging on in the
absence of the window manager which allowed it to write?

I don't  know  enough  about  how  all this stuff works to make a reasonable
hypothesis, but it sounds like this could be a security hole (albeit a small
one)  on  a workstation with multiple users. (E.g., someone could start up a
program  which  does whatever xphoon does, then leave it waiting for someone
else  to log before deleting all windows or playing whatever tricks it wants
to play...)

Actually, the  screen looked pretty neat with the moon in the background. Is
there a way to set this up legitimately?

- Brad

T.RTitleUserPersonal
Name
DateLines
545.1Did you *give* someone access?MRFLEX::MILLERBush For President...Kate Bush!Wed Apr 05 1989 22:0816
    re:    <<< Note 545.0 by TLE::DANIELS "Brad Daniels, VAX C RTL whipping boy" >>>
                          -< xphoon/security concern >-
    
    Brad,
    
    Do you have either SYS$MANAGER:DECW$SERVER_ACCESS_ALLOWED.DAT or 
    SYS$MANAGER:DECW$SERVER_ACCESS_TRUSTED.DAT on your workstation?  If so,
    these files are read for security access in the absence of your
    session manager.  Whatever transport protocol/node/accounts  in that
    file will have connection access to your server process and * * * gives
    anybody access.
    
    Regards,
    
    	 	== ken miller ==

545.2Nope and nope.TLE::DANIELSBrad Daniels, VAX C RTL whipping boyFri Apr 07 1989 11:558
Re .1

I just  checked.  Neither  file  exists  on  my  system. BTW - where is some
documentation on how those files are used? As I said, I liked the way xphoon
looked on my login screen, and would like to set it up.

- Brad

545.3Don't think it's in a book (unsupported) but...MRFLEX::MILLERBush For President...Kate Bush!Fri Apr 07 1989 12:406
Check out notes 445.* for an idea of the format/purpose.

Regards,

           == ken miller ==

545.4me tooWATERS::LEVINEit&#039;s turtles all the way downSat Apr 08 1989 18:069
    I recently starting running my DECwindows applications as detached
    processes, rather than as subprocesses of the session manager.  The
    other day, after quitting the session and restarting it, I noticed that
    the Xphoon started in the previous session was still there.  Is there
    something different about Xphoon that keeps it from getting blown away
    when the session ends?
    
    -Lance-

545.5Maybe a dumb question, but...MCNALY::MILLERBush For President...Kate Bush!Sun Apr 09 1989 17:3715
    Are y'all *sure* XPHOON is still running?  If memory serves me right,
    XPHOON draws a bitmap to the root window, and thereafter the server
    deals with expose events.  There are no clients required to maintain
    the image.  The XPHOON client is around to *rotate* the phases of the
    moon by redrawing the bitmap.
    
    The question still is definitely, "how come the server didn't reset
    when the session mgr. terminated".  Namely, why was the root window not
    reset.
    
    Regards,
    
    	 	== ken miller ==
    

545.6xsetroot stuck alsoSTAR::PARKEKung Fruit - Defense against agressive vegtablesThu Apr 13 1989 14:4610
    re .4
    
    I use xsetroot to put up various "slides" from all over as my
    background.  Last week I has such a background up, logged out and the
    background was all that remained.  I never got back tothe login screen.
    
    This has only happened once, but the xphoon problems sound sorta like
    this "sticky setroot" anomoly.
    

545.7The xsetroot occurred when no one was logged inTLE::DANIELSBrad Daniels, VAX C RTL whipping boyFri Apr 14 1989 12:1313
Re .6:

Not quite...  The  screen  had  definitely gone back to the default, and the
picture  of  the moon on the screen had a noticeably different phase than it
had had the night before.

BTW -  This is something of a tangent, but doesn't the shadow on the picture
of  the  moon have the wrong concavity when the moon is more than half full?
Does  anyone know of a version of XPHOON which does the shadowing correctly?
If not, where can I get the source to hack?

- Brad

545.8I could mail it to you...STAR::NOZELLLanguage is a virus from Outer Space.Fri Apr 14 1989 12:416
I have the sources, but no public place to put them. A Dick [IAGO::]
Schoeller grabbed a copy a while ago and put them somewhere publicly
accessible, but don't recall which notesfile it was posted in.

-marc

545.9It's good to advertise once in a while...25497::SCHOELLERWho&#039;s on first?Fri Apr 14 1989 15:247
Sources for all kinds of good stuff are at GVRIEL::DUA1:[SCHOELLER.C...]

If you have DFS you should be able to get to that disk with
eng.les.ecad.sim.gvriel_user

Dick

545.10What's with GVRIEL?ARTFUL::SCOTTLord, save me from these Mass-inine drivers!Mon Apr 17 1989 16:108
    RE: .9
    
    I've tried a few dozen times in the last couple of weeks to access
    GVRIEL and it has never been accessible.  What gives???  Is this some
    kind of cruel tease?
    
    						-- Mikey 

545.11AITG::DERAMODaniel V. {AITG,ZFC}:: D&#039;EramoTue Apr 18 1989 00:405
     Node GVRIEL is not in ARTFUL's node database.
     Use node 25519:: for GVRIEL::.
     
     Dan

545.12I know, I know ...ARTFUL::SCOTTLord, save me from these Mass-inine drivers!Tue Apr 18 1989 15:2615
I *know* that ARTFUL's node database doesn't know about GVRIEL and I *know* how
get the node address and how to derive a numeric equivalent.  When I said that
the node isn't available, I mean that I tried to access the node and was told
that it wasn't reachable.  Not that it was unknown.  Even ANCHOR thinks that
the node is unreachable whenever I've used it to get the address.

Thanks for your help, anyway.  In any case, I checked while writing this note
and GVRIEL was available, for once, and I fired off a couple of FTSV jobs to get
the stuff I wanted.

                                                                     -- Mikey

                                       

545.13GVRIEL is up...25517::SCHOELLERWho&#039;s on first?Tue Apr 18 1989 16:2816
Mikey

2 things happened recently.

1) GVRIEL was moved (along with me and the rest of my department  8^{) to PKO3-1
   That took us out for several days.

2) On Friday everything at PKO shut down for the weekend because of a power
   shutdown for annual maintenance (great timing, huh?  move just before the
   shutdown instead of just after)

Sorry for any inconvenience.  In general, GVRIEL is up and around most of the
time (BAGELerS would lynch me if it weren't  8^{)

Dick