Path: utzoo!attcan!uunet!nbires!isis!udenva!news
From: news@udenva.cair.du.edu (netnews)
Newsgroups: comp.windows.x
Subject: Xlock small fix, X security
Keywords: Orange Book
Message-ID: <10508@udenva.cair.du.edu>
Date: 18 Jul 88 04:15:59 GMT
Distribution: na
Organization: Univ. of Denver, CO, USA
Lines: 27


This is my first posting to xpert. Please be easy on me if this ground
has been covered before.

1) Xlock.c, recently reposted needed a small fix to be portable to the
HP 9000s here.  The HP server uses full addresses (machine:0.0), so
unix:0 didn't work.  It seems the proper way to get the machine name is
through the environment variable DISPLAY if it is defined; my fix was to
use getenv(DISPLAY) if non-NULL, otherwise use unix:0.  Perhaps unix:0.0
would be more portable?

2) The Xlock program, among other embarrassing things I have done from
dumb terminals to console users, brings up the ugly spectre of what it
means to have X program security.  In my work environment, security not
only means that a third party should not be able to blitz my screen, but
has certain "Orange Book"ishness as well.  The problems are too verbose
to detail here, but the question is, is anyone thinking about them for
implementation into the X Window System (Ok, Bob?) Version N?  Is Athena
looking for a forum for discussion/suggestion?  My assertion is that the
non-existant X security model is a disaster in the making.  How can we
get started in preventing it?

Michael Schwartz (ncar!udenva!mschwart, MSchwartz@DOCKMASTER)
-- 
Michael Schwartz
University of Denver -- New College
udenva!mschwart     MSchwartz@Dockmaster.ARPA