Sugar-Emulator has no access control

[morgs]

Sugar-Emulator uses the '-ac' flag in the Xephyr command line, with turns off access control.

This means that anyone on the network can attach to the display/keyboard/mouse and interfer with the operation of Sugar (such as running xeyes, which goes full screen and can not be cancelled!).

Reported on Ubuntu at  https://bugs.launchpad.net/ubuntu/+source/sugar/+bug/296604

[morgs]

Patch from Ubuntu ticket - Simon Mungewell

[lfaraone]

Ubuntu:
"""
Slight problem with patch, 1 in 16 chance that xauth will fail as leading 0 is dropped, new to python so don't know how to fix this....

[...]
--
DEBUG:sugar-emulator:Xauth command: xauth add :3 . a3dd93f39f280dad34d58d6f301a84f
xauth: (argv):1: key contains odd number of or non-hex characters
--

Simon.
"""

[lfaraone]

git-diff of the patch fitted for upstream sugar

[mungewell]

The testing of len < 32 is a bit of a nasty way to compensate for leading '0's

Slightly better way of fixing leading zeros...

change
'%s' % hex(random.getrandbits(128))[2:-1]
for
'%032X' % random.getrandbits(128)

and then you don't need the test for lenght.
Mungewell.

[marcopg]

What about using mcookie? From man:

mcookie generates a 128-bit random hexadecimal number for use with the X authority system. Typical usage:
xauth add :0 . ‘mcookie‘

[RafaelOrtiz]

Maybe mstone work can be used as a reference to fix this.

 http://wiki.sugarlabs.org/go/Talk:Development_Team/Chroot