xwayland: default to local user if no xauth file given. [CVE-2015-3164 3/3]
Right now if "-auth" isn't passed on the command line, we let any user on the system connect to the Xwayland server. That's clearly suboptimal, given Xwayland is generally designed to be used by one user at a time. This commit changes the behavior, so only the user who started the X server can connect clients to it. Signed-off-by: Ray Strode <rstrode@redhat.com> Reviewed-by: Daniel Stone <daniels@collabora.com> Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com> Signed-off-by: Keith Packard <keithp@keithp.com>
This commit is contained in:
parent
4b4b9086d0
commit
76636ac12f
|
@ -702,4 +702,6 @@ InitOutput(ScreenInfo * screen_info, int argc, char **argv)
|
||||||
if (AddScreen(xwl_screen_init, argc, argv) == -1) {
|
if (AddScreen(xwl_screen_init, argc, argv) == -1) {
|
||||||
FatalError("Couldn't add screen\n");
|
FatalError("Couldn't add screen\n");
|
||||||
}
|
}
|
||||||
|
|
||||||
|
LocalAccessScopeUser();
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue
Block a user