Subject: Bug#4233: startx does not initialize X cookies

From: Thomas Koenig <[email-masked]>
Date: Thu, 22 Aug 1996 16:57:13 +0200 (MET DST)

Package: xbase
Version: 3.1.2-9

The startx script does not initialize the X Magic Cookies when
X is started up.  This can be a significant security hole.

I would suggest adding a line like

xauth add :0 . `dd if=/dev/urandom count=1 bs=16 | md5sum`

to startx (ok, so md5sum is merely the fastest way to get
a correctly formatted string - possibly od can be persuaded with
the right options, or somebody can write a Perl script).
-- 
Thomas Koenig, [email-masked], [email-masked].
The joy of engineering is to find a straight line on a double
logarithmic diagram.

---

From: Guy Maor <[email-masked]>
Date: Thu, 22 Aug 1996 17:21:08 -0500 (CDT)

> xauth add :0 . `dd if=/dev/urandom count=1 bs=16 | md5sum`

util-linux 2.5-5, includes mcookie, a small c program which does this,
so the line should really be:

xauth add :0 . `mcookie`

Incidentally, mcookie tries /dev/random, /dev/urandom, some files in
/proc, and /dev/audio as a last resort.

Guy