From sacadmin Fri Jul 21 15:20:28 2006 Received: from sac.sfbay.sun.com (localhost [127.0.0.1]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6LMKSQL013811; Fri, 21 Jul 2006 15:20:28 -0700 (PDT) Received: (from alanc@localhost) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6/Submit) id k6LMKSiC013807; Fri, 21 Jul 2006 15:20:28 -0700 (PDT) Date: Fri, 21 Jul 2006 15:20:28 -0700 (PDT) From: Alan Coopersmith Message-Id: <200607212220.k6LMKSiC013807@sac.sfbay.sun.com> To: LSARC@sac.sfbay.sun.com Cc: Mahmood.Ali@Sun.COM Subject: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] Status: RO Content-Length: 8225 Subject: LSARC FastTrack [07/28/2006]: xscreensaver upgrade to version 5.0 I am sponsoring this fasttrack for Mahmood Ali & myself. It times out on Friday, July 28. Template Version: @(#)sac_nextcase 1.56 10/26/05 SMI This information Copyright 2006 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: xscreensaver upgrade to version 5.0 1.2. Name of Document Author/Supplier: Author: Alan Coopersmith 1.3 Date of This Document: 21 July, 2006 4. Technical Description This project upgrades the xscreensaver code base from the open source upstream from 4.05 to 5.0. The increment in major version number is not due to major incompatibilities but to the major feature addition of native MacOS X support. It also includes a couple of other updates that have been accumulating. Sun's xscreensaver uses the display modes from the open source xscreensaver mostly unmodified (a bit of censorship is applied for some things that users may find offensive or which our lawyers may find risky), but modifies the core driver program quite a bit to add support for accessibility via a GTK+ UI, to correct the PAM implementation, and make several other changes not accepted by the upstream maintainer. This ARC review also converts xscreensaver stability statements to the new taxonomy and incorporates several additional changes being made to xscreensaver as well. This case requests a minor release binding for all portions except the few noted as applying to a patch release. --------------------------------------------------------------------------- Changes from upstream: The xscreensaver-command CLI has been modified to remove the commands -throttle and -unthrottle. The man page description of these commands was: -throttle Temporarily switch to ``blank screen'' mode, and don't run any display modes at all, until the screensaver is next de-activated. This is useful if you're using a machine remotely, and you find that some display modes are using too much CPU. (If you want to do this permanently, that is, you want the screen saver to only blank the screen and not run demos at all, then set the programs resource to an empty list: See xscreensaver(1) for details.) -unthrottle Turn `-throttle' mode off and resume normal behavior. The replacement functionality listed in the new man page is: If xscreensaver is running, but you want it to stop running screen hacks (e.g., if you are logged in remotely, and you want the console to remain locked but just be black, with no graphics processes running) you can accomplish that by sim- ply powering down the monitor remotely. In a minute or so, xscreensaver will notice that the monitor is off, and will stop running screen hacks. You can power off the monitor like so: xset dpms force off See the xset(1) manual for more info. xscreensaver-demo no longer supports the --crapplet flag for embedding in the GNOME 1.x Control Center. Use as a GNOME 2.x preference panel continues to work unchanged. A number of new display "hacks" have been added - since those are architectually uninteresting and Project Private, they are not detailed here. --------------------------------------------------------------------------- Installation location: This case follows the precedent set in PSARC 2004/187 and migrates xscreensaver from /usr/openwin to /usr/X11. Symbolic links will be left in /usr/openwin/bin for the xscreensaver commands and from /usr/openwin/lib/xscreensaver to /usr/X11/lib/xscreensaver (though nothing outside the xscreensaver project should be using the private interfaces in that directory). --------------------------------------------------------------------------- Smartcard support: xscreensaver currently uses the SCF API to detect smartcard removal and perform a screen lock at that time. PSARC 2004/678 has EOF'ed the SCF API so this functionality will be removed from xscreensaver. By agreement with the smartcard development team, the SCF replacement project will be responsible for calling xscreensaver-command -lock to lock the screen when needed, instead of modifying xscreensaver to monitor the smartcard. (The Sun Ray smartcard framework already does this.) This case declares the smartcard support Obsolete in a Patch Release, and removes it in a Minor Release. (Under the new taxonomy, I am calling this "Obsolete Uncommitted" though there was no specific stability given to the smartcard functionality in past cases.) Since the proposed replacement and a number of other consumers use or will use xscreensaver-command -lock to lock the screen, but none have requested contracts, this case accepts the obvious conclusion that this functionality is an interface that needs to be provided at a higher stability level than External/Volatile and raises it to Uncommitted. --------------------------------------------------------------------------- Auditing: Xscreensaver will audit screen lock and unlock in the same manner as xlock already does. A contract will be signed with the audit group using the same terms as the xlock/audit contract PSARC/2000/517/contract-03. --------------------------------------------------------------------------- Root ability to unlock: Xscreensaver has previously hardcoded allowing the user named "root" to unlock the system. A resource will be added to the xscreensaver configuration file named "allowRoot" which takes a value of True to allow this, or False to only allow the logged-in user to unlock. The default value of this resource will be set to False, requiring users who need the current behaviour to change the default setting. This is explictly tied to a Minor Release binding and a separate case will have to be filed to discuss correct handling if a Patch/Micro Release is ever desired. --------------------------------------------------------------------------- Future direction: Long term, the stated goal of the Desktop C-Team is to move from xscreensaver to gnome-screensaver for the JDS screen lock functionality. However, since gnome-screensaver does not yet work on Solaris, xscreensaver remains the JDS desktop screen lock provider for the near-term. --------------------------------------------------------------------------- Imported interfaces: Interface Stability Comments ---------- --------- -------- xscreensaver CLI (see man page) External LSARC 2001/121 xscreensaver-command CLI (see man page) External LSARC 2001/121 xscreensaver-demo CLI (see man page) External LSARC 2001/121 xscreensaver graphics applications External LSARC 2001/121 /usr/openwin/lib/xscreensaver Stable LSARC 2001/121 Auditing interfaces Contracted Proj. Private PSARC 2000/517 /usr/X11 hierarchy Stable PSARC 2004/187 GTK+, Glib, Pango, ATK Evolving LSARC 2004/713 at-spi, login-helper External LSARC 2004/713 Exported interfaces: -------------------- xscreensaver CLI Volatile was External xscreensaver-command -lock Uncommitted was External rest of xscreensaver-command CLI Volatile was External xscreensaver-demo CLI Volatile was External xscreensaver graphics applications Project Private was External /usr/openwin/bin/xscreensaver* Obsolete External Replaced by symlink /usr/X11/bin/xscreensaver* Stable Pathnames only /usr/openwin/lib/xscreensaver Obsolete Stable Replaced by symlink /usr/X11/lib/xscreensaver Stable Pathname only /usr/X11/lib/xscreensaver Project Private Contents SCF smartcard support in xscreensaver Obsolete Uncommitted Patch Release binding SCF smartcard support in xscreensaver Removed Minor Release binding allowRoot Uncomitted 6. Resources and Schedule 6.4. Steering Committee requested information 6.4.1. Consolidation C-team Name: X Consolidation / Desktop C-Team 6.5. ARC review type: FastTrack From sacadmin Fri Jul 21 17:54:54 2006 Received: from engmail3mpk.sfbay.Sun.COM (engmail3mpk.SFBay.Sun.COM [129.146.11.26]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6M0ssNl020450; Fri, 21 Jul 2006 17:54:54 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k6M0ssEQ002220; Fri, 21 Jul 2006 17:54:54 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id k6M0uj1Z001864; Fri, 21 Jul 2006 17:56:45 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id k6M0ujKW001863; Fri, 21 Jul 2006 17:56:45 -0700 (PDT) Date: Fri, 21 Jul 2006 17:56:45 -0700 (PDT) From: Gary Winiger Message-Id: <200607220056.k6M0ujKW001863@marduk.eng.sun.com> To: LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] Cc: Mahmood.Ali@sun.com X-Sun-Charset: US-ASCII Status: RO Content-Length: 417 > as well. This case requests a minor release binding for all portions except > the few noted as applying to a patch release. Hummm, seems like the only patch thing is announcing smartcard removal. If xscreensaver is the JDS screen lock and JDS is to be an evaluated desktop (along with CDE), it seems like proper PAM functionality and audit (and allowRoot=False) might be needed in a patch release. Gary.. From sacadmin Fri Jul 21 18:04:44 2006 Received: from jurassic.eng.sun.com (jurassic.SFBay.Sun.COM [129.146.106.31]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6M14iQr020955; Fri, 21 Jul 2006 18:04:44 -0700 (PDT) Received: from [129.146.108.211] (almas.SFBay.Sun.COM [129.146.108.211]) by jurassic.eng.sun.com (8.13.7+Sun/8.13.6) with ESMTP id k6M14h83119424; Fri, 21 Jul 2006 18:04:44 -0700 (PDT) Message-ID: <44C179AB.8020806@sun.com> Date: Fri, 21 Jul 2006 18:04:43 -0700 From: Alan Coopersmith User-Agent: Thunderbird 1.5.0.2 (X11/20060427) MIME-Version: 1.0 To: Gary Winiger CC: LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com, Mahmood.Ali@sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] References: <200607220056.k6M0ujKW001863@marduk.eng.sun.com> In-Reply-To: <200607220056.k6M0ujKW001863@marduk.eng.sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Status: RO Content-Length: 1214 Gary Winiger wrote: >> as well. This case requests a minor release binding for all portions except >> the few noted as applying to a patch release. > > Hummm, seems like the only patch thing is announcing smartcard > removal. If xscreensaver is the JDS screen lock and JDS is to > be an evaluated desktop (along with CDE), it seems like proper > PAM functionality and audit (and allowRoot=False) might be needed > in a patch release. Whoops - I meant to say that audit also had patch release binding, since it is planned for a Solaris 10 patch. As for PAM, I was simply assuming that "proper PAM implementation" is an implied part of the original xscreensaver integration to Solaris case, and we've just had a lot of bugfixes needed to bring us up to the specification. (The record for the previous case actually shows a commitment made in 2002 to do BSM auditing before the original Solaris integration, but the manager who made that commitment never followed through, and it hasn't been added until now.) I don't know what the plans are for evaluation or not of JDS in Solaris 10. -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From sacadmin Fri Jul 21 18:10:42 2006 Received: from engmail3mpk.sfbay.Sun.COM (engmail3mpk.SFBay.Sun.COM [129.146.11.26]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6M1Agq7021137; Fri, 21 Jul 2006 18:10:42 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k6M1AfY7004658; Fri, 21 Jul 2006 18:10:41 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id k6M1CWmu001920; Fri, 21 Jul 2006 18:12:32 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id k6M1CWMA001919; Fri, 21 Jul 2006 18:12:32 -0700 (PDT) Date: Fri, 21 Jul 2006 18:12:32 -0700 (PDT) From: Gary Winiger Message-Id: <200607220112.k6M1CWMA001919@marduk.eng.sun.com> To: gww@eng.sun.com, alan.coopersmith@sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] Cc: LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com, Mahmood.Ali@sun.com X-Sun-Charset: US-ASCII Status: RO Content-Length: 186 > I don't know what the plans are for evaluation or not of JDS in Solaris 10. Last I heard was that JDS was included in the S10 eval. Execs have sold TJDS as part of TX eval. Gary.. From sacadmin Mon Jul 24 16:14:25 2006 Received: from jurassic.eng.sun.com (jurassic.SFBay.Sun.COM [129.146.226.130]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6ONEPw1022813; Mon, 24 Jul 2006 16:14:25 -0700 (PDT) Received: from [129.146.108.211] (almas.SFBay.Sun.COM [129.146.108.211]) by jurassic.eng.sun.com (8.13.7+Sun/8.13.6) with ESMTP id k6ONEO4H425768; Mon, 24 Jul 2006 16:14:25 -0700 (PDT) Message-ID: <44C55450.8090901@sun.com> Date: Mon, 24 Jul 2006 16:14:24 -0700 From: Alan Coopersmith User-Agent: Thunderbird 1.5.0.2 (X11/20060427) MIME-Version: 1.0 To: Alan Coopersmith CC: Gary Winiger , LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com, Mahmood.Ali@sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] References: <200607220056.k6M0ujKW001863@marduk.eng.sun.com> <44C179AB.8020806@sun.com> In-Reply-To: <44C179AB.8020806@sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Status: RO Content-Length: 727 Alan Coopersmith wrote: > Whoops - I meant to say that audit also had patch release binding, since > it is planned for a Solaris 10 patch. [...] > I don't know what the plans are for evaluation or not of JDS in Solaris 10. Friday afternoon brain cramp - audit is going into an S10 patch because it was required by the group doing the Solaris 10 Evaluation, so I did know that. They have not requested the allowRoot feature though - though I don't know whether that is because they do not know of the "feature" of allowing root access or because they don't believe being able to disable it is a requirement. -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From sacadmin Mon Jul 24 16:36:04 2006 Received: from engmail3mpk.sfbay.Sun.COM (engmail3mpk.SFBay.Sun.COM [129.146.11.26]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6ONa3g6023513; Mon, 24 Jul 2006 16:36:03 -0700 (PDT) Received: from marduk.eng.sun.com (marduk.SFBay.Sun.COM [129.146.108.224]) by engmail3mpk.sfbay.Sun.COM (8.13.6+Sun/8.13.6/ENSMAIL,v2.2) with ESMTP id k6ONa3tq024038; Mon, 24 Jul 2006 16:36:03 -0700 (PDT) Received: from marduk.eng.sun.com (localhost [127.0.0.1]) by marduk.eng.sun.com (8.13.6+Sun/8.12.11) with ESMTP id k6ONYs69002035; Mon, 24 Jul 2006 16:34:54 -0700 (PDT) Received: (from gww@localhost) by marduk.eng.sun.com (8.13.6+Sun/8.12.11/Submit) id k6ONYseg002034; Mon, 24 Jul 2006 16:34:54 -0700 (PDT) Date: Mon, 24 Jul 2006 16:34:54 -0700 (PDT) From: Gary Winiger Message-Id: <200607242334.k6ONYseg002034@marduk.eng.sun.com> To: Alan.Coopersmith@sun.com, alan.coopersmith@sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] Cc: gww@eng.sun.com, LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com, Mahmood.Ali@sun.com X-Sun-Charset: US-ASCII Status: RO Content-Length: 360 > They have not requested the allowRoot feature though - though I don't know > whether that is because they do not know of the "feature" of allowing root > access or because they don't believe being able to disable it is a requirement. TS1.x -- TS8 and TX disable root in CDE -- even if we can skate as an evaluation issue for TJDS, it is a customer issue. From sacadmin Wed Jul 26 14:00:56 2006 Received: from almas.sfbay.sun.com (almas.SFBay.Sun.COM [129.146.108.211]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6QL0uDZ023682; Wed, 26 Jul 2006 14:00:56 -0700 (PDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by almas.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6QL0tcT003613; Wed, 26 Jul 2006 14:00:56 -0700 (PDT) Message-ID: <44C7D807.8080300@sun.com> Date: Wed, 26 Jul 2006 14:00:55 -0700 From: Alan Coopersmith User-Agent: Thunderbird 1.5.0.2 (X11/20060427) MIME-Version: 1.0 To: Gary Winiger CC: LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com, Mahmood.Ali@sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] References: <200607242334.k6ONYseg002034@marduk.eng.sun.com> In-Reply-To: <200607242334.k6ONYseg002034@marduk.eng.sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Status: RO Content-Length: 2219 I've updated the spec to include the changes agreed upon in e-mail and yesterday's meeting. I've left the timeout set to Friday, 7/28 - if anyone desires more time to review the updated spec, let me know. The full revised spec can be found in /shared/sac/LSARC/2006/446/spec. Changes to previous spec are: @@ -101,26 +101,37 @@ Auditing: Xscreensaver will audit screen lock and unlock in the same manner as xlock already does. A contract will be signed with the audit group using the same terms as the xlock/audit contract PSARC/2000/517/contract-03. +Addition of auditing support will have a patch release binding. + --------------------------------------------------------------------------- Root ability to unlock: Xscreensaver has previously hardcoded allowing the user named "root" to unlock the system. A resource will be added to the xscreensaver configuration file named "allowRoot" which takes a value of True to allow -this, or False to only allow the logged-in user to unlock. The default -value of this resource will be set to False, requiring users who need the -current behaviour to change the default setting. This is explictly tied -to a Minor Release binding and a separate case will have to be filed to -discuss correct handling if a Patch/Micro Release is ever desired. +this, or False to only allow the logged-in user to unlock. If running in +a Trusted Extensions desktop, this resource will be ignored and root will +never be allowed to unlock the session. (Since there have been no releases +of Trusted Extensions or Trusted JDS so far, there is no compatibility to +preserve.) + +Addition of this resource will have a patch release binding. + +The default value of this resource in any patch release will be set to True, +preserving current behaviour when installing patches. + +The default value of this resource in any minor releases it is delivered in +will be set to False, requiring users who need the current behaviour to +change the default setting. --------------------------------------------------------------------------- -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering From sacadmin Fri Jul 28 18:00:04 2006 Received: from almas.sfbay.sun.com (almas.SFBay.Sun.COM [129.146.108.211]) by sac.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6T104Sj005832; Fri, 28 Jul 2006 18:00:04 -0700 (PDT) Received: from [IPv6:::1] (localhost [IPv6:::1]) by almas.sfbay.sun.com (8.13.6+Sun/8.13.6) with ESMTP id k6T0xnS5005832; Fri, 28 Jul 2006 17:59:50 -0700 (PDT) Message-ID: <44CAB305.7080405@sun.com> Date: Fri, 28 Jul 2006 17:59:49 -0700 From: Alan Coopersmith User-Agent: Thunderbird 1.5.0.2 (X11/20060427) MIME-Version: 1.0 To: Alan Coopersmith CC: Gary Winiger , LSARC@sac.sfbay.sun.com, alanc@sac.sfbay.sun.com, Mahmood.Ali@sun.com Subject: Re: xscreensaver upgrade to version 5.0 [LSARC/2006/446 Timeout: 07/28/2006] References: <200607242334.k6ONYseg002034@marduk.eng.sun.com> <44C7D807.8080300@sun.com> In-Reply-To: <44C7D807.8080300@sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Status: RO Content-Length: 438 Alan Coopersmith wrote: > I've updated the spec to include the changes agreed upon in e-mail and > yesterday's meeting. I've left the timeout set to Friday, 7/28 - if > anyone desires more time to review the updated spec, let me know. There having been no further comments, I've now marked the case as "Closed Approved" -- -Alan Coopersmith- alan.coopersmith@sun.com Sun Microsystems, Inc. - X Window System Engineering