92 lines · plain
1=========================================2Linux Secure Attention Key (SAK) handling3=========================================4 5:Date: 18 March 20016:Author: Andrew Morton7 8An operating system's Secure Attention Key is a security tool which is9provided as protection against trojan password capturing programs. It10is an undefeatable way of killing all programs which could be11masquerading as login applications. Users need to be taught to enter12this key sequence before they log in to the system.13 14From the PC keyboard, Linux has two similar but different ways of15providing SAK. One is the ALT-SYSRQ-K sequence. You shouldn't use16this sequence. It is only available if the kernel was compiled with17sysrq support.18 19The proper way of generating a SAK is to define the key sequence using20``loadkeys``. This will work whether or not sysrq support is compiled21into the kernel.22 23SAK works correctly when the keyboard is in raw mode. This means that24once defined, SAK will kill a running X server. If the system is in25run level 5, the X server will restart. This is what you want to26happen.27 28What key sequence should you use? Well, CTRL-ALT-DEL is used to reboot29the machine. CTRL-ALT-BACKSPACE is magical to the X server. We'll30choose CTRL-ALT-PAUSE.31 32In your rc.sysinit (or rc.local) file, add the command::33 34 echo "control alt keycode 101 = SAK" | /bin/loadkeys35 36And that's it! Only the superuser may reprogram the SAK key.37 38 39.. note::40 41 1. Linux SAK is said to be not a "true SAK" as is required by42 systems which implement C2 level security. This author does not43 know why.44 45 46 2. On the PC keyboard, SAK kills all applications which have47 /dev/console opened.48 49 Unfortunately this includes a number of things which you don't50 actually want killed. This is because these applications are51 incorrectly holding /dev/console open. Be sure to complain to your52 Linux distributor about this!53 54 You can identify processes which will be killed by SAK with the55 command::56 57 # ls -l /proc/[0-9]*/fd/* | grep console58 l-wx------ 1 root root 64 Mar 18 00:46 /proc/579/fd/0 -> /dev/console59 60 Then::61 62 # ps aux|grep 57963 root 579 0.0 0.1 1088 436 ? S 00:43 0:00 gpm -t ps/264 65 So ``gpm`` will be killed by SAK. This is a bug in gpm. It should66 be closing standard input. You can work around this by finding the67 initscript which launches gpm and changing it thusly:68 69 Old::70 71 daemon gpm72 73 New::74 75 daemon gpm < /dev/null76 77 Vixie cron also seems to have this problem, and needs the same treatment.78 79 Also, one prominent Linux distribution has the following three80 lines in its rc.sysinit and rc scripts::81 82 exec 3<&083 exec 4>&184 exec 5>&285 86 These commands cause **all** daemons which are launched by the87 initscripts to have file descriptors 3, 4 and 5 attached to88 /dev/console. So SAK kills them all. A workaround is to simply89 delete these lines, but this may cause system management90 applications to malfunction - test everything well.91 92