1 =========================================
2 Linux Secure Attention Key (SAK) handling
3 =========================================
4
5 :Date: 18 March 2001
6 :Author: Andrew Morton
7
8 An operating system's Secure Attention Key is
9 provided as protection against trojan password
10 is an undefeatable way of killing all programs
11 masquerading as login applications. Users nee
12 this key sequence before they log in to the sy
13
14 From the PC keyboard, Linux has two similar bu
15 providing SAK. One is the ALT-SYSRQ-K sequenc
16 this sequence. It is only available if the ke
17 sysrq support.
18
19 The proper way of generating a SAK is to defin
20 ``loadkeys``. This will work whether or not s
21 into the kernel.
22
23 SAK works correctly when the keyboard is in ra
24 once defined, SAK will kill a running X server
25 run level 5, the X server will restart. This
26 happen.
27
28 What key sequence should you use? Well, CTRL-A
29 the machine. CTRL-ALT-BACKSPACE is magical to
30 choose CTRL-ALT-PAUSE.
31
32 In your rc.sysinit (or rc.local) file, add the
33
34 echo "control alt keycode 101 = SAK" |
35
36 And that's it! Only the superuser may reprogr
37
38
39 .. note::
40
41 1. Linux SAK is said to be not a "true SAK"
42 systems which implement C2 level security
43 know why.
44
45
46 2. On the PC keyboard, SAK kills all applica
47 /dev/console opened.
48
49 Unfortunately this includes a number of t
50 actually want killed. This is because th
51 incorrectly holding /dev/console open. B
52 Linux distributor about this!
53
54 You can identify processes which will be
55 command::
56
57 # ls -l /proc/[0-9]*/fd/* | grep conso
58 l-wx------ 1 root root
59
60 Then::
61
62 # ps aux|grep 579
63 root 579 0.0 0.1 1088 436 ?
64
65 So ``gpm`` will be killed by SAK. This i
66 be closing standard input. You can work
67 initscript which launches gpm and changin
68
69 Old::
70
71 daemon gpm
72
73 New::
74
75 daemon gpm < /dev/null
76
77 Vixie cron also seems to have this proble
78
79 Also, one prominent Linux distribution ha
80 lines in its rc.sysinit and rc scripts::
81
82 exec 3<&0
83 exec 4>&1
84 exec 5>&2
85
86 These commands cause **all** daemons whic
87 initscripts to have file descriptors 3, 4
88 /dev/console. So SAK kills them all. A
89 delete these lines, but this may cause sy
90 applications to malfunction - test everyt
91
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.