Change user and group

When enter is pressed, passwd[len] will be set to '\0'. Pressing
backspace is supposed to remove the last entered character.

But currently, the clearing has an off-by-one, as in setting
passwd[len] to '\0' just like enter would do.

You can also verify it by imagining len=1 and that it's impossible to
clear passwd[0] by pressing backspace with the current code.

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>

.hgtags

@@ -1,10 +0,0 @@
-0a95c73c7374fbc2342b6040d9f35ddf597729e1 0.1
-da5cb1f0a685258d5315ea109860bacbc2871a57 0.2
-f9157b1864388ad8f1920e5fde7c5849e73d8327 0.3
-4c2cf4d6a2d0e08cbe280ec50ef76c9aecfc0fbe 0.4
-bd24ea7fcca26b161225c464df23ecbfe85280e1 0.5
-dd226a81c09adfa86db232419b3000b7e406df68 0.6
-c4635bb35a4581261f0187b347d5e596dd390ca3 0.7
-c0eb8221ba49c6d10becc93c063c45196a3bb1ba 0.8
-1e8a77601cb9c872921bbfc47909d9339027b295 0.9
-05b949016e85da011c48783d6896de801d347bed 1.0

LICENSE

@@ -1,7 +1,9 @@
 MIT/X Consortium License
 
+© 2015-2016 Markus Teich <markus.teich@stusta.mhn.de>
 © 2014 Dimitris Papastamos <sin@2f30.org>
 © 2006-2014 Anselm R Garbe <anselm@garbe.us>
+© 2014-2016 Laslo Hunhold <dev@frign.de>
 
 Permission is hereby granted, free of charge, to any person obtaining a
 copy of this software and associated documentation files (the "Software"),

Makefile

@@ -3,7 +3,7 @@
 
 include config.mk
 
-SRC = slock.c
+SRC = slock.c ${COMPATSRC}
 OBJ = ${SRC:.c=.o}
 
 all: options slock
@@ -18,7 +18,7 @@ options:
 	@echo CC $<
 	@${CC} -c ${CFLAGS} $<
 
-${OBJ}: config.h config.mk
+${OBJ}: config.h config.mk arg.h util.h
 
 config.h:
 	@echo creating $@ from config.def.h
@@ -35,7 +35,8 @@ clean:
 dist: clean
 	@echo creating dist tarball
 	@mkdir -p slock-${VERSION}
-	@cp -R LICENSE Makefile README config.def.h config.mk ${SRC} slock-${VERSION}
+	@cp -R LICENSE Makefile README slock.1 config.mk \
+		${SRC} explicit_bzero.c config.def.h arg.h util.h slock-${VERSION}
 	@tar -cf slock-${VERSION}.tar slock-${VERSION}
 	@gzip slock-${VERSION}.tar
 	@rm -rf slock-${VERSION}
@@ -46,9 +47,15 @@ install: all
 	@cp -f slock ${DESTDIR}${PREFIX}/bin
 	@chmod 755 ${DESTDIR}${PREFIX}/bin/slock
 	@chmod u+s ${DESTDIR}${PREFIX}/bin/slock
+	@echo installing manual page to ${DESTDIR}${MANPREFIX}/man1
+	@mkdir -p ${DESTDIR}${MANPREFIX}/man1
+	@sed "s/VERSION/${VERSION}/g" <slock.1 >${DESTDIR}${MANPREFIX}/man1/slock.1
+	@chmod 644 ${DESTDIR}${MANPREFIX}/man1/slock.1
 
 uninstall:
 	@echo removing executable file from ${DESTDIR}${PREFIX}/bin
 	@rm -f ${DESTDIR}${PREFIX}/bin/slock
+	@echo removing manual page from ${DESTDIR}${MANPREFIX}/man1
+	@rm -f ${DESTDIR}${MANPREFIX}/man1/slock.1
 
 .PHONY: all options clean dist install uninstall

README

@@ -1,6 +1,6 @@
 slock - simple screen locker
 ============================
-simple screen locker utility for X. 
+simple screen locker utility for X.
 
 
 Requirements

arg.h

@@ -0,0 +1,65 @@
+/*
+ * Copy me if you can.
+ * by 20h
+ */
+
+#ifndef ARG_H__
+#define ARG_H__
+
+extern char *argv0;
+
+/* use main(int argc, char *argv[]) */
+#define ARGBEGIN	for (argv0 = *argv, argv++, argc--;\
+					argv[0] && argv[0][0] == '-'\
+					&& argv[0][1];\
+					argc--, argv++) {\
+				char argc_;\
+				char **argv_;\
+				int brk_;\
+				if (argv[0][1] == '-' && argv[0][2] == '\0') {\
+					argv++;\
+					argc--;\
+					break;\
+				}\
+				for (brk_ = 0, argv[0]++, argv_ = argv;\
+						argv[0][0] && !brk_;\
+						argv[0]++) {\
+					if (argv_ != argv)\
+						break;\
+					argc_ = argv[0][0];\
+					switch (argc_)
+
+/* Handles obsolete -NUM syntax */
+#define ARGNUM				case '0':\
+					case '1':\
+					case '2':\
+					case '3':\
+					case '4':\
+					case '5':\
+					case '6':\
+					case '7':\
+					case '8':\
+					case '9'
+
+#define ARGEND			}\
+			}
+
+#define ARGC()		argc_
+
+#define ARGNUMF()	(brk_ = 1, estrtonum(argv[0], 0, INT_MAX))
+
+#define EARGF(x)	((argv[0][1] == '\0' && argv[1] == NULL)?\
+				((x), abort(), (char *)0) :\
+				(brk_ = 1, (argv[0][1] != '\0')?\
+					(&argv[0][1]) :\
+					(argc--, argv++, argv[0])))
+
+#define ARGF()		((argv[0][1] == '\0' && argv[1] == NULL)?\
+				(char *)0 :\
+				(brk_ = 1, (argv[0][1] != '\0')?\
+					(&argv[0][1]) :\
+					(argc--, argv++, argv[0])))
+
+#define LNGARG()	&argv[0][0]
+
+#endif

config.def.h

@@ -1,2 +1,12 @@
-#define COLOR1 "black"
-#define COLOR2 "#005577"
+/* user and group to drop privileges to */
+static const char *user  = "krrish";
+static const char *group = "krrish";
+
+static const char *colorname[NUMCOLS] = {
+	[INIT] =   "black",     /* after initialization */
+	[INPUT] =  "#005577",   /* during input */
+	[FAILED] = "#CC3333",   /* wrong password */
+};
+
+/* treat a cleared input like a wrong password (color) */
+static const int failonclear = 1;

config.h

@@ -0,0 +1,12 @@
+/* user and group to drop privileges to */
+static const char *user  = "krrish";
+static const char *group = "krrish";
+
+static const char *colorname[NUMCOLS] = {
+	[INIT] =   "black",     /* after initialization */
+	[INPUT] =  "#005577",   /* during input */
+	[FAILED] = "#CC3333",   /* wrong password */
+};
+
+/* treat a cleared input like a wrong password (color) */
+static const int failonclear = 1;

config.mk

@@ -1,30 +1,32 @@
 # slock version
-VERSION = 1.2
+VERSION = 1.4
 
 # Customize below to fit your system
 
 # paths
 PREFIX = /usr/local
+MANPREFIX = ${PREFIX}/share/man
 
 X11INC = /usr/X11R6/include
 X11LIB = /usr/X11R6/lib
 
 # includes and libs
 INCS = -I. -I/usr/include -I${X11INC}
-LIBS = -L/usr/lib -lc -lcrypt -L${X11LIB} -lX11 -lXext
+LIBS = -L/usr/lib -lc -lcrypt -L${X11LIB} -lX11 -lXext -lXrandr
 
 # flags
-CPPFLAGS = -DVERSION=\"${VERSION}\" -DHAVE_SHADOW_H
+CPPFLAGS = -DVERSION=\"${VERSION}\" -D_DEFAULT_SOURCE -DHAVE_SHADOW_H
 CFLAGS = -std=c99 -pedantic -Wall -Os ${INCS} ${CPPFLAGS}
 LDFLAGS = -s ${LIBS}
+COMPATSRC = explicit_bzero.c
 
-# On *BSD remove -DHAVE_SHADOW_H from CPPFLAGS and add -DHAVE_BSD_AUTH
 # On OpenBSD and Darwin remove -lcrypt from LIBS
+#LIBS = -L/usr/lib -lc -L${X11LIB} -lX11 -lXext -lXrandr
+# On *BSD remove -DHAVE_SHADOW_H from CPPFLAGS
+# On NetBSD add -D_NETBSD_SOURCE to CPPFLAGS
+#CPPFLAGS = -DVERSION=\"${VERSION}\" -D_BSD_SOURCE -D_NETBSD_SOURCE
+# On OpenBSD set COMPATSRC to empty
+#COMPATSRC =
 
 # compiler and linker
 CC = cc
-
-# Install mode. On BSD systems MODE=2755 and GROUP=auth
-# On others MODE=4755 and GROUP=root
-#MODE=2755
-#GROUP=auth

explicit_bzero.c

@@ -0,0 +1,19 @@
+/*	$OpenBSD: explicit_bzero.c,v 1.3 2014/06/21 02:34:26 matthew Exp $ */
+/*
+ * Public domain.
+ * Written by Matthew Dempsky.
+ */
+
+#include <string.h>
+
+__attribute__((weak)) void
+__explicit_bzero_hook(void *buf, size_t len)
+{
+}
+
+void
+explicit_bzero(void *buf, size_t len)
+{
+	memset(buf, 0, len);
+	__explicit_bzero_hook(buf, len);
+}

slock.1

@@ -0,0 +1,39 @@
+.Dd 2016-08-23
+.Dt SLOCK 1
+.Sh NAME
+.Nm slock
+.Nd simple X screen locker
+.Sh SYNOPSIS
+.Nm
+.Op Fl v
+.Op Ar cmd Op Ar arg ...
+.Sh DESCRIPTION
+.Nm
+is a simple X screen locker. If provided,
+.Ar cmd Op Ar arg ...
+is executed after the screen has been locked.
+.Sh OPTIONS
+.Bl -tag -width Ds
+.It Fl v
+Print version information to stdout and exit.
+.El
+.Sh SECURITY CONSIDERATIONS
+To make sure a locked screen can not be bypassed by switching VTs
+or killing the X server with Ctrl+Alt+Backspace, it is recommended
+to disable both in
+.Xr xorg.conf 5
+for maximum security:
+.Bd -literal -offset left
+Section "ServerFlags"
+	Option "DontVTSwitch" "True"
+	Option "DontZap"      "True"
+EndSection
+.Ed
+.Sh EXAMPLES
+$
+.Nm
+/usr/sbin/s2ram
+.Sh CUSTOMIZATION
+.Nm
+can be customized by creating a custom config.h from config.def.h and
+(re)compiling the source code. This keeps it fast, secure and simple.

slock.c

@@ -1,4 +1,3 @@
-
 /* See LICENSE file for license details. */
 #define _XOPEN_SOURCE 500
 #if HAVE_SHADOW_H
@@ -7,6 +6,7 @@
 
 #include <ctype.h>
 #include <errno.h>
+#include <grp.h>
 #include <pwd.h>
 #include <stdarg.h>
 #include <stdlib.h>
@@ -14,302 +14,382 @@
 #include <string.h>
 #include <unistd.h>
 #include <sys/types.h>
+#include <X11/extensions/Xrandr.h>
 #include <X11/keysym.h>
 #include <X11/Xlib.h>
 #include <X11/Xutil.h>
 
-#if HAVE_BSD_AUTH
-#include <login_cap.h>
-#include <bsd_auth.h>
-#endif
+#include "arg.h"
+#include "util.h"
 
-#include "config.h"
+char *argv0;
 
-typedef struct {
+enum {
+	INIT,
+	INPUT,
+	FAILED,
+	NUMCOLS
+};
+
+struct lock {
 	int screen;
 	Window root, win;
 	Pixmap pmap;
-	unsigned long colors[2];
-} Lock;
+	unsigned long colors[NUMCOLS];
+};
 
-static Lock **locks;
-static int nscreens;
-static Bool running = True;
+struct xrandr {
+	int active;
+	int evbase;
+	int errbase;
+};
+
+#include "config.h"
 
 static void
-die(const char *errstr, ...) {
+die(const char *errstr, ...)
+{
 	va_list ap;
 
 	va_start(ap, errstr);
 	vfprintf(stderr, errstr, ap);
 	va_end(ap);
-	exit(EXIT_FAILURE);
+	exit(1);
 }
 
 #ifdef __linux__
 #include <fcntl.h>
+#include <linux/oom.h>
 
 static void
-dontkillme(void) {
-	int fd;
+dontkillme(void)
+{
+	FILE *f;
+	const char oomfile[] = "/proc/self/oom_score_adj";
 
-	fd = open("/proc/self/oom_score_adj", O_WRONLY);
-	if (fd < 0 && errno == ENOENT)
-		return;
-	if (fd < 0 || write(fd, "-1000\n", 6) != 6 || close(fd) != 0)
-		die("cannot disable the out-of-memory killer for this process\n");
+	if (!(f = fopen(oomfile, "w"))) {
+		if (errno == ENOENT)
+			return;
+		die("slock: fopen %s: %s\n", oomfile, strerror(errno));
+	}
+	fprintf(f, "%d", OOM_SCORE_ADJ_MIN);
+	if (fclose(f)) {
+		if (errno == EACCES)
+			die("slock: unable to disable OOM killer. "
+			    "Make sure to suid or sgid slock.\n");
+		else
+			die("slock: fclose %s: %s\n", oomfile, strerror(errno));
+	}
 }
 #endif
 
-#ifndef HAVE_BSD_AUTH
 static const char *
-getpw(void) { /* only run as root */
-	const char *rval;
+gethash(void)
+{
+	const char *hash;
 	struct passwd *pw;
 
+	/* Check if the current user has a password entry */
 	errno = 0;
-	pw = getpwuid(getuid());
-	if (!pw) {
+	if (!(pw = getpwuid(getuid()))) {
 		if (errno)
 			die("slock: getpwuid: %s\n", strerror(errno));
 		else
-			die("slock: cannot retrieve password entry (make sure to suid or sgid slock)\n");
+			die("slock: cannot retrieve password entry\n");
 	}
-	rval =  pw->pw_passwd;
+	hash = pw->pw_passwd;
 
 #if HAVE_SHADOW_H
-	if (rval[0] == 'x' && rval[1] == '\0') {
+	if (!strcmp(hash, "x")) {
 		struct spwd *sp;
-		sp = getspnam(getenv("USER"));
-		if(!sp)
-			die("slock: cannot retrieve shadow entry (make sure to suid or sgid slock)\n");
-		rval = sp->sp_pwdp;
+		if (!(sp = getspnam(pw->pw_name)))
+			die("slock: getspnam: cannot retrieve shadow entry. "
+			    "Make sure to suid or sgid slock.\n");
+		hash = sp->sp_pwdp;
 	}
-#endif
+#else
+	if (!strcmp(hash, "*")) {
+#ifdef __OpenBSD__
+		if (!(pw = getpwuid_shadow(getuid())))
+			die("slock: getpwnam_shadow: cannot retrieve shadow entry. "
+			    "Make sure to suid or sgid slock.\n");
+		hash = pw->pw_passwd;
+#else
+		die("slock: getpwuid: cannot retrieve shadow entry. "
+		    "Make sure to suid or sgid slock.\n");
+#endif /* __OpenBSD__ */
+	}
+#endif /* HAVE_SHADOW_H */
 
-	/* drop privileges */
-	if (geteuid() == 0
-	   && ((getegid() != pw->pw_gid && setgid(pw->pw_gid) < 0) || setuid(pw->pw_uid) < 0))
-		die("slock: cannot drop privileges\n");
-	return rval;
+	return hash;
 }
-#endif
 
 static void
-#ifdef HAVE_BSD_AUTH
-readpw(Display *dpy)
-#else
-readpw(Display *dpy, const char *pws)
-#endif
+readpw(Display *dpy, struct xrandr *rr, struct lock **locks, int nscreens,
+       const char *hash)
 {
-	char buf[32], passwd[256];
-	int num, screen;
-	unsigned int len, llen;
+	XRRScreenChangeNotifyEvent *rre;
+	char buf[32], passwd[256], *inputhash;
+	int num, screen, running, failure, oldc;
+	unsigned int len, color;
 	KeySym ksym;
 	XEvent ev;
 
-	len = llen = 0;
-	running = True;
+	len = 0;
+	running = 1;
+	failure = 0;
+	oldc = INIT;
 
-	/* As "slock" stands for "Simple X display locker", the DPMS settings
-	 * had been removed and you can set it with "xset" or some other
-	 * utility. This way the user can easily set a customized DPMS
-	 * timeout. */
-	while(running && !XNextEvent(dpy, &ev)) {
-		if(ev.type == KeyPress) {
-			buf[0] = 0;
-			num = XLookupString(&ev.xkey, buf, sizeof buf, &ksym, 0);
-			if(IsKeypadKey(ksym)) {
-				if(ksym == XK_KP_Enter)
+	while (running && !XNextEvent(dpy, &ev)) {
+		if (ev.type == KeyPress) {
+			explicit_bzero(&buf, sizeof(buf));
+			num = XLookupString(&ev.xkey, buf, sizeof(buf), &ksym, 0);
+			if (IsKeypadKey(ksym)) {
+				if (ksym == XK_KP_Enter)
 					ksym = XK_Return;
-				else if(ksym >= XK_KP_0 && ksym <= XK_KP_9)
+				else if (ksym >= XK_KP_0 && ksym <= XK_KP_9)
 					ksym = (ksym - XK_KP_0) + XK_0;
 			}
-			if(IsFunctionKey(ksym) || IsKeypadKey(ksym)
-					|| IsMiscFunctionKey(ksym) || IsPFKey(ksym)
-					|| IsPrivateKeypadKey(ksym))
+			if (IsFunctionKey(ksym) ||
+			    IsKeypadKey(ksym) ||
+			    IsMiscFunctionKey(ksym) ||
+			    IsPFKey(ksym) ||
+			    IsPrivateKeypadKey(ksym))
 				continue;
-			switch(ksym) {
+			switch (ksym) {
 			case XK_Return:
-				passwd[len] = 0;
-#ifdef HAVE_BSD_AUTH
-				running = !auth_userokay(getlogin(), NULL, "auth-xlock", passwd);
-#else
-				running = !!strcmp(crypt(passwd, pws), pws);
-#endif
-				if(running)
+				passwd[len] = '\0';
+				errno = 0;
+				if (!(inputhash = crypt(passwd, hash)))
+					fprintf(stderr, "slock: crypt: %s\n", strerror(errno));
+				else
+					running = !!strcmp(inputhash, hash);
+				if (running) {
 					XBell(dpy, 100);
+					failure = 1;
+				}
+				explicit_bzero(&passwd, sizeof(passwd));
 				len = 0;
 				break;
 			case XK_Escape:
+				explicit_bzero(&passwd, sizeof(passwd));
 				len = 0;
 				break;
 			case XK_BackSpace:
-				if(len)
-					--len;
+				if (len)
+					passwd[--len] = '\0';
 				break;
 			default:
-				if(num && !iscntrl((int) buf[0]) && (len + num < sizeof passwd)) {
+				if (num && !iscntrl((int)buf[0]) &&
+				    (len + num < sizeof(passwd))) {
 					memcpy(passwd + len, buf, num);
 					len += num;
 				}
 				break;
 			}
-			if(llen == 0 && len != 0) {
-				for(screen = 0; screen < nscreens; screen++) {
-					XSetWindowBackground(dpy, locks[screen]->win, locks[screen]->colors[1]);
+			color = len ? INPUT : ((failure || failonclear) ? FAILED : INIT);
+			if (running && oldc != color) {
+				for (screen = 0; screen < nscreens; screen++) {
+					XSetWindowBackground(dpy,
+					                     locks[screen]->win,
+					                     locks[screen]->colors[color]);
 					XClearWindow(dpy, locks[screen]->win);
 				}
-			} else if(llen != 0 && len == 0) {
-				for(screen = 0; screen < nscreens; screen++) {
-					XSetWindowBackground(dpy, locks[screen]->win, locks[screen]->colors[0]);
+				oldc = color;
+			}
+		} else if (rr->active && ev.type == rr->evbase + RRScreenChangeNotify) {
+			rre = (XRRScreenChangeNotifyEvent*)&ev;
+			for (screen = 0; screen < nscreens; screen++) {
+				if (locks[screen]->win == rre->window) {
+					if (rre->rotation == RR_Rotate_90 ||
+					    rre->rotation == RR_Rotate_270)
+						XResizeWindow(dpy, locks[screen]->win,
+						              rre->height, rre->width);
+					else
+						XResizeWindow(dpy, locks[screen]->win,
+						              rre->width, rre->height);
 					XClearWindow(dpy, locks[screen]->win);
+					break;
 				}
 			}
-			llen = len;
+		} else {
+			for (screen = 0; screen < nscreens; screen++)
+				XRaiseWindow(dpy, locks[screen]->win);
 		}
-		else for(screen = 0; screen < nscreens; screen++)
-			XRaiseWindow(dpy, locks[screen]->win);
 	}
 }
 
-static void
-unlockscreen(Display *dpy, Lock *lock) {
-	if(dpy == NULL || lock == NULL)
-		return;
-
-	XUngrabPointer(dpy, CurrentTime);
-	XFreeColors(dpy, DefaultColormap(dpy, lock->screen), lock->colors, 2, 0);
-	XFreePixmap(dpy, lock->pmap);
-	XDestroyWindow(dpy, lock->win);
-
-	free(lock);
-}
-
-static Lock *
-lockscreen(Display *dpy, int screen) {
+static struct lock *
+lockscreen(Display *dpy, struct xrandr *rr, int screen)
+{
 	char curs[] = {0, 0, 0, 0, 0, 0, 0, 0};
-	unsigned int len;
-	Lock *lock;
+	int i, ptgrab, kbgrab;
+	struct lock *lock;
 	XColor color, dummy;
 	XSetWindowAttributes wa;
 	Cursor invisible;
 
-	if(dpy == NULL || screen < 0)
-		return NULL;
-
-	lock = malloc(sizeof(Lock));
-	if(lock == NULL)
+	if (dpy == NULL || screen < 0 || !(lock = malloc(sizeof(struct lock))))
 		return NULL;
 
 	lock->screen = screen;
-
 	lock->root = RootWindow(dpy, lock->screen);
 
+	for (i = 0; i < NUMCOLS; i++) {
+		XAllocNamedColor(dpy, DefaultColormap(dpy, lock->screen),
+		                 colorname[i], &color, &dummy);
+		lock->colors[i] = color.pixel;
+	}
+
 	/* init */
 	wa.override_redirect = 1;
-	wa.background_pixel = BlackPixel(dpy, lock->screen);
-	lock->win = XCreateWindow(dpy, lock->root, 0, 0, DisplayWidth(dpy, lock->screen), DisplayHeight(dpy, lock->screen),
-			0, DefaultDepth(dpy, lock->screen), CopyFromParent,
-			DefaultVisual(dpy, lock->screen), CWOverrideRedirect | CWBackPixel, &wa);
-	XAllocNamedColor(dpy, DefaultColormap(dpy, lock->screen), COLOR2, &color, &dummy);
-	lock->colors[1] = color.pixel;
-	XAllocNamedColor(dpy, DefaultColormap(dpy, lock->screen), COLOR1, &color, &dummy);
-	lock->colors[0] = color.pixel;
+	wa.background_pixel = lock->colors[INIT];
+	lock->win = XCreateWindow(dpy, lock->root, 0, 0,
+	                          DisplayWidth(dpy, lock->screen),
+	                          DisplayHeight(dpy, lock->screen),
+	                          0, DefaultDepth(dpy, lock->screen),
+	                          CopyFromParent,
+	                          DefaultVisual(dpy, lock->screen),
+	                          CWOverrideRedirect | CWBackPixel, &wa);
 	lock->pmap = XCreateBitmapFromData(dpy, lock->win, curs, 8, 8);
-	invisible = XCreatePixmapCursor(dpy, lock->pmap, lock->pmap, &color, &color, 0, 0);
+	invisible = XCreatePixmapCursor(dpy, lock->pmap, lock->pmap,
+	                                &color, &color, 0, 0);
 	XDefineCursor(dpy, lock->win, invisible);
-	XMapRaised(dpy, lock->win);
-	for(len = 1000; len; len--) {
-		if(XGrabPointer(dpy, lock->root, False, ButtonPressMask | ButtonReleaseMask | PointerMotionMask,
-			GrabModeAsync, GrabModeAsync, None, invisible, CurrentTime) == GrabSuccess)
-			break;
-		usleep(1000);
-	}
-	if(running && (len > 0)) {
-		for(len = 1000; len; len--) {
-			if(XGrabKeyboard(dpy, lock->root, True, GrabModeAsync, GrabModeAsync, CurrentTime)
-				== GrabSuccess)
-				break;
-			usleep(1000);
+
+	/* Try to grab mouse pointer *and* keyboard for 600ms, else fail the lock */
+	for (i = 0, ptgrab = kbgrab = -1; i < 6; i++) {
+		if (ptgrab != GrabSuccess) {
+			ptgrab = XGrabPointer(dpy, lock->root, False,
+			                      ButtonPressMask | ButtonReleaseMask |
+			                      PointerMotionMask, GrabModeAsync,
+			                      GrabModeAsync, None, invisible, CurrentTime);
 		}
+		if (kbgrab != GrabSuccess) {
+			kbgrab = XGrabKeyboard(dpy, lock->root, True,
+			                       GrabModeAsync, GrabModeAsync, CurrentTime);
+		}
+
+		/* input is grabbed: we can lock the screen */
+		if (ptgrab == GrabSuccess && kbgrab == GrabSuccess) {
+			XMapRaised(dpy, lock->win);
+			if (rr->active)
+				XRRSelectInput(dpy, lock->win, RRScreenChangeNotifyMask);
+
+			XSelectInput(dpy, lock->root, SubstructureNotifyMask);
+			return lock;
+		}
+
+		/* retry on AlreadyGrabbed but fail on other errors */
+		if ((ptgrab != AlreadyGrabbed && ptgrab != GrabSuccess) ||
+		    (kbgrab != AlreadyGrabbed && kbgrab != GrabSuccess))
+			break;
+
+		usleep(100000);
 	}
 
-	running &= (len > 0);
-	if(!running) {
-		unlockscreen(dpy, lock);
-		lock = NULL;
-	}
-	else 
-		XSelectInput(dpy, lock->root, SubstructureNotifyMask);
-
-	return lock;
+	/* we couldn't grab all input: fail out */
+	if (ptgrab != GrabSuccess)
+		fprintf(stderr, "slock: unable to grab mouse pointer for screen %d\n",
+		        screen);
+	if (kbgrab != GrabSuccess)
+		fprintf(stderr, "slock: unable to grab keyboard for screen %d\n",
+		        screen);
+	return NULL;
 }
 
 static void
-usage(void) {
-	fprintf(stderr, "usage: slock [-v]\n");
-	exit(EXIT_FAILURE);
+usage(void)
+{
+	die("usage: slock [-v] [cmd [arg ...]]\n");
 }
 
 int
 main(int argc, char **argv) {
-#ifndef HAVE_BSD_AUTH
-	const char *pws;
-#endif
+	struct xrandr rr;
+	struct lock **locks;
+	struct passwd *pwd;
+	struct group *grp;
+	uid_t duid;
+	gid_t dgid;
+	const char *hash;
 	Display *dpy;
-	int screen;
+	int s, nlocks, nscreens;
 
-	if((argc == 2) && !strcmp("-v", argv[1]))
-		die("slock-%s, © 2006-2014 slock engineers\n", VERSION);
-	else if(argc != 1)
+	ARGBEGIN {
+	case 'v':
+		fprintf(stderr, "slock-"VERSION"\n");
+		return 0;
+	default:
 		usage();
+	} ARGEND
+
+	/* validate drop-user and -group */
+	errno = 0;
+	if (!(pwd = getpwnam(user)))
+		die("slock: getpwnam %s: %s\n", user,
+		    errno ? strerror(errno) : "user entry not found");
+	duid = pwd->pw_uid;
+	errno = 0;
+	if (!(grp = getgrnam(group)))
+		die("slock: getgrnam %s: %s\n", group,
+		    errno ? strerror(errno) : "group entry not found");
+	dgid = grp->gr_gid;
 
 #ifdef __linux__
 	dontkillme();
 #endif
 
-	if(!getpwuid(getuid()))
-		die("slock: no passwd entry for you\n");
+	hash = gethash();
+	errno = 0;
+	if (!crypt("", hash))
+		die("slock: crypt: %s\n", strerror(errno));
 
-#ifndef HAVE_BSD_AUTH
-	pws = getpw();
-#endif
-
-	if(!(dpy = XOpenDisplay(0)))
+	if (!(dpy = XOpenDisplay(NULL)))
 		die("slock: cannot open display\n");
-	/* Get the number of screens in display "dpy" and blank them all. */
+
+	/* drop privileges */
+	if (setgroups(0, NULL) < 0)
+		die("slock: setgroups: %s\n", strerror(errno));
+	if (setgid(dgid) < 0)
+		die("slock: setgid: %s\n", strerror(errno));
+	if (setuid(duid) < 0)
+		die("slock: setuid: %s\n", strerror(errno));
+
+	/* check for Xrandr support */
+	rr.active = XRRQueryExtension(dpy, &rr.evbase, &rr.errbase);
+
+	/* get number of screens in display "dpy" and blank them */
 	nscreens = ScreenCount(dpy);
-	locks = malloc(sizeof(Lock *) * nscreens);
-	if(locks == NULL)
-		die("slock: malloc: %s\n", strerror(errno));
-	int nlocks = 0;
-	for(screen = 0; screen < nscreens; screen++) {
-		if ( (locks[screen] = lockscreen(dpy, screen)) != NULL)
+	if (!(locks = calloc(nscreens, sizeof(struct lock *))))
+		die("slock: out of memory\n");
+	for (nlocks = 0, s = 0; s < nscreens; s++) {
+		if ((locks[s] = lockscreen(dpy, &rr, s)) != NULL)
 			nlocks++;
+		else
+			break;
 	}
-	XSync(dpy, False);
+	XSync(dpy, 0);
 
-	/* Did we actually manage to lock something? */
-	if (nlocks == 0) { // nothing to protect
-		free(locks);
-		XCloseDisplay(dpy);
+	/* did we manage to lock everything? */
+	if (nlocks != nscreens)
 		return 1;
+
+	/* run post-lock command */
+	if (argc > 0) {
+		switch (fork()) {
+		case -1:
+			die("slock: fork failed: %s\n", strerror(errno));
+		case 0:
+			if (close(ConnectionNumber(dpy)) < 0)
+				die("slock: close: %s\n", strerror(errno));
+			execvp(argv[0], argv);
+			fprintf(stderr, "slock: execvp %s: %s\n", argv[0], strerror(errno));
+			_exit(1);
+		}
 	}
 
-	/* Everything is now blank. Now wait for the correct password. */
-#ifdef HAVE_BSD_AUTH
-	readpw(dpy);
-#else
-	readpw(dpy, pws);
-#endif
-
-	/* Password ok, unlock everything and quit. */
-	for(screen = 0; screen < nscreens; screen++)
-		unlockscreen(dpy, locks[screen]);
-
-	free(locks);
-	XCloseDisplay(dpy);
+	/* everything is now blank. Wait for the correct password */
+	readpw(dpy, &rr, locks, nscreens, hash);
 
 	return 0;
 }

util.h

@@ -0,0 +1,2 @@
+#undef explicit_bzero
+void explicit_bzero(void *, size_t);