The officially official Devuan Forum!

andyp67

Member

Registered: 2022-10-30

Posts: 228  

You are being hacked

First impressions, it appears to be something to do with seatd and or wayland.
Why does mouse driven logout take forever.
Why does ctrl_alt_bksp not action immediately.

Altoid

Member

Registered: 2017-05-07

Posts: 1,583  

Re: You are being hacked

Hello:

... appears to be something to do with seatd and or wayland.

I would not be surprised if it was related to wayland.

Why does mouse driven logout take forever.
Why does ctrl_alt_bksp not action immediately.

I don't use (or want/need to use) wayland, my box runs on X.
logout and/or ctrl_alt_bksp are practically instantaneous.
No delays at all.

The only thing that will cause a delay (quite obviously) in my box is a backintime process running.

I'd purge wayland and see what happens.

Best,

A.

czeekaj

Member

Registered: 2019-06-12

Posts: 154  

Re: You are being hacked

I made a switch to try wayland and sway. It ran fine from user space on tty6. While Xorg was running on 7.

Have not done much testing. Been more busy looking at other stuff lower.

andyp67

Member

Registered: 2022-10-30

Posts: 228  

Re: You are being hacked

I am very greatful to see some interest in this post.
I suppose we can all agree that Wayland is a work in progress therefore intrinsically routine engineering problematic vulnerable etc.
Personally I am staying with X Window System, as many will, for a myriad of reasons, heck, XFree86 still superlative important for many.
I don't know what the anti-action term for hairy shirt is, I'd rather be hairy than a Wayland wanker!
Did you know that wanker is the most commonly used word in the Greek language malaka.

I can use the 'find,' program, and also 'locate.'
xserver-xorg-core, two dependencies, libwayland-client0 & libwayland-server0
chromium & firefox, libwayland-cursor0 & libwaylandegl1

I'm no doctor or professor or engineer, perhaps an advanced amateur, I'm inclined to think these wayland libraries are 'stable'.

Which leaves seatd.
xserver-xorg-core depends on libseat1.
seatd can be replaced with dummy-logind.

Dumping seatd and doing dummy-logind is what I am playing around with at the moment, building refractasnapshot in console, for running in X.

My suspicion is that the State/Corporation usual suspects, presently these days are thieving through hacking seatd, although this holy shit situation came about only this last few days as the proposed-updates came down the pipe.

I'm barebones X, no Synaptics no thankyou, eudev & libinput, xserver-xorg-legacy to get Xwrapper.config,
to fuck off all this login crime.
Please do not give me your words of wisdom that Xwrapper.config is shit.

Peace be with us.

Last edited by andyp67 (2023-10-17 13:16:58)

andyp67

Member

Registered: 2022-10-30

Posts: 228  

Re: You are being hacked

I'm running Daedalus, barebones, X, startx, low-fat window manager, file manager, editor, full-fat browser.
If you don't do apt-get --no-install-recommends install, you get;
elogind libelogind-compat libelogind0 libpam-elogind libpolkit-agent-1-0 libpolkit-gobject-1-0 libpolkit-gobject-1-0 policykit-1 policykit-1-gnome pkexec polkitd polkitd-data
You can force purge all that and install libsystemd0 and your system is not broke.

My updates about this last week, proposed-updates are now coming down the pipe, for me was about a dozen programs, mainly X I think.

Something has created a serious exploit, maybe dummy-logind circumvents. Maybe.

andyp67

Member

Registered: 2022-10-30

Posts: 228  

Re: You are being hacked

created a refractasnapshot dummy-logind instead of seatd

offline ctrl_alt_bksp instant

online ctrl_alt_bksp not instant

----------------------------------------

(II) [libseat/backend/seatd.c:645] Stopped embedded seatd
..........
xinit: X server slow to shut down, sending KILL signal

waiting for server to die

----------------------------------------

SHADY

andyp67

Member

Registered: 2022-10-30

Posts: 228  

Re: You are being hacked

I have completed my analysis.
libseat1, a dependency of xserver-xorg-core in Devuan, is quite defective.
You are being hacked.
Thank you.