home *** CD-ROM | disk | FTP | other *** search
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- NNNNAAAAMMMMEEEE
- Xserver - X Window System display server
-
- SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS
- XXXX [option ...]
-
- DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN
- _X is the generic name for the X Window System display
- server. It is frequently a link or a copy of the
- appropriate server binary for driving the most frequently
- used server on a given machine.
-
- SSSSTTTTAAAARRRRTTTTIIIINNNNGGGG TTTTHHHHEEEE SSSSEEEERRRRVVVVEEEERRRR
- The X server is usually started from the X Display Manager
- program _x_d_m(_1). This utility is run from the system boot
- files and takes care of keeping the server running,
- prompting for usernames and passwords, and starting up the
- user sessions.
-
- Installations that run more than one window system may need
- to use the _x_i_n_i_t(_1) utility instead of _x_d_m. However, _x_i_n_i_t
- is to be considered a tool for building startup scripts and
- is not intended for use by end users. Site administrators
- are ssssttttrrrroooonnnnggggllllyyyy urged to use _x_d_m, or build other interfaces for
- novice users.
-
- The X server may also be started directly by the user,
- though this method is usually reserved for testing and is
- not recommended for normal operation. On some platforms,
- the user must have special permission to start the X server,
- often because access to certain devices (e.g. /dev/mouse) is
- restricted.
-
- When the X server starts up, it typically takes over the
- display. If you are running on a workstation whose console
- is the display, you may not be able to log into the console
- while the server is running.
-
- OOOOPPPPTTTTIIIIOOOONNNNSSSS
- All of the X servers accept the following command line
- options:
-
- ::::_d_i_s_p_l_a_y_n_u_m_b_e_r
- the X server runs as the given _d_i_s_p_l_a_y_n_u_m_b_e_r, which
- by default is 0. If multiple X servers are to run
- simultaneously on a host, each must have a unique
- display number. See the DISPLAY NAMES section of
- the _X(_1) manual page to learn how to specify which
- display number clients should try to use.
-
- ----aaaa _n_u_m_b_e_r
- sets pointer acceleration (i.e. the ratio of how
-
-
-
- Page 1 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- much is reported to how much the user actually moved
- the pointer).
-
- ----aaaacccc disables host-based access control mechanisms.
- Enables access by any host, and permits any host to
- modify the access control list. Use with extreme
- caution. This option exists primarily for running
- test suites remotely.
-
- ----aaaauuuuddddiiiitttt _l_e_v_e_l
- Sets the audit trail level. The default level is 1,
- meaning only connection rejections are reported.
- Level 2 additionally reports all successful
- connections and disconnects. Level 4 enables
- messages from the SECURITY extension, if present,
- including generation and revocation of
- authorizations and violations of the security
- policy. Level 0 turns off the audit trail. Audit
- lines are sent as standard error output.
-
- ----aaaauuuutttthhhh _a_u_t_h_o_r_i_z_a_t_i_o_n-_f_i_l_e
- Specifies a file which contains a collection of
- authorization records used to authenticate access.
- See also the _x_d_m and _X_s_e_c_u_r_i_t_y manual pages.
-
- bbbbcccc disables certain kinds of error checking, for bug
- compatibility with previous releases (e.g., to work
- around bugs in R2 and R3 xterms and toolkits).
- Deprecated.
-
- ----bbbbssss disables backing store support on all screens.
-
- ----cccc turns off key-click.
-
- cccc _v_o_l_u_m_e
- sets key-click volume (allowable range: 0-100).
-
- ----cccccccc _c_l_a_s_s
- sets the visual class for the root window of color
- screens. The class numbers are as specified in the
- X protocol. Not obeyed by all servers.
-
- ----ccccoooo _f_i_l_e_n_a_m_e
- sets name of RGB color database. The default is
- <XRoot>/lib/X11/rgb, where <XRoot> refers to the
- root of the X11 install tree.
-
- ----ccccoooonnnnffffiiiigggg _f_i_l_e_n_a_m_e
- reads more options from the given file. Options in
- the file may be separated by newlines if desired.
- If a '#' character appears on a line, all characters
- between it and the next newline are ignored,
-
-
-
- Page 2 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- providing a simple commenting facility. The ----ccccoooonnnnffffiiiigggg
- option itself may appear in the file.
-
- ----ccccoooorrrreeee causes the server to generate a core dump on fatal
- errors.
-
- ----ddddppppiiii _r_e_s_o_l_u_t_i_o_n
- sets the resolution of the screen, in dots per inch.
- To be used when the server cannot determine the
- screen size from the hardware.
-
- ----ddddeeeeffffeeeerrrrggggllllyyyypppphhhhssss _w_h_i_c_h_f_o_n_t_s
- specifies the types of fonts for which the server
- should attempt to use deferred glyph loading.
- _w_h_i_c_h_f_o_n_t_s can be all (all fonts), none (no fonts),
- or 16 (16 bit fonts only).
-
- ----ffff _v_o_l_u_m_e
- sets feep (bell) volume (allowable range: 0-100).
-
- ----ffffcccc _c_u_r_s_o_r_F_o_n_t
- sets default cursor font.
-
- ----ffffnnnn _f_o_n_t
- sets the default font.
-
- ----ffffpppp _f_o_n_t_P_a_t_h
- sets the search path for fonts. This path is a
- comma separated list of directories which the X
- server searches for font databases.
-
- ----hhhheeeellllpppp prints a usage message.
-
- ----IIII causes all remaining command line arguments to be
- ignored.
-
- ----kkkkbbbb disables the XKEYBOARD extension if present.
-
- ----pppp _m_i_n_u_t_e_s
- sets screen-saver pattern cycle time in minutes.
-
- ----ppppnnnn permits the server to continue running if it fails
- to establish all of its well-known sockets
- (connection points for clients), but establishes at
- least one.
-
- ----rrrr turns off auto-repeat.
-
- rrrr turns on auto-repeat.
-
- ----ssss _m_i_n_u_t_e_s
- sets screen-saver timeout time in minutes.
-
-
-
- Page 3 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- ----ssssuuuu disables save under support on all screens.
-
- ----tttt _n_u_m_b_e_r
- sets pointer acceleration threshold in pixels (i.e.
- after how many pixels pointer acceleration should
- take effect).
-
- ----tttteeeerrrrmmmmiiiinnnnaaaatttteeee
- causes the server to terminate at server reset,
- instead of continuing to run.
-
- ----ttttoooo _s_e_c_o_n_d_s
- sets default connection timeout in seconds.
-
- ----ttttsssstttt disables all testing extensions (e.g., XTEST, XTrap,
- XTestExtension1, RECORD).
-
- ttttttttyyyy_x_x ignored, for servers started the ancient way (from
- init).
-
- vvvv sets video-off screen-saver preference.
-
- ----vvvv sets video-on screen-saver preference.
-
- ----wwwwmmmm forces the default backing-store of all windows to
- be WhenMapped. This is a backdoor way of getting
- backing-store to apply to all windows. Although all
- mapped windows will have backing store, the backing
- store attribute value reported by the server for a
- window will be the last value established by a
- client. If it has never been set by a client, the
- server will report the default value, NotUseful.
- This behavior is required by the X protocol, which
- allows the server to exceed the client's backing
- store expectations but does not provide a way to
- tell the client that it is doing so.
-
- ----xxxx _e_x_t_e_n_s_i_o_n
- loads the specified extension at init. This is a
- no-op for most implementations.
-
- [[[[++++----]]]]xxxxiiiinnnneeeerrrraaaammmmaaaa
- enable(+) or disable(-) XINERAMA extension. Default
- is disabled.
-
- SSSSEEEERRRRVVVVEEEERRRR DDDDEEEEPPPPEEEENNNNDDDDEEEENNNNTTTT OOOOPPPPTTTTIIIIOOOONNNNSSSS
- Some X servers accept the following options:
-
- ----lllldddd _k_i_l_o_b_y_t_e_s
- sets the data space limit of the server to the
- specified number of kilobytes. A value of zero
- makes the data size as large as possible. The
-
-
-
- Page 4 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- default value of -1 leaves the data space limit
- unchanged.
-
- ----llllffff _f_i_l_e_s
- sets the number-of-open-files limit of the server to
- the specified number. A value of zero makes the
- limit as large as possible. The default value of -1
- leaves the limit unchanged.
-
- ----llllssss _k_i_l_o_b_y_t_e_s
- sets the stack space limit of the server to the
- specified number of kilobytes. A value of zero
- makes the stack size as large as possible. The
- default value of -1 leaves the stack space limit
- unchanged.
-
- ----llllooooggggoooo turns on the X Window System logo display in the
- screen-saver. There is currently no way to change
- this from a client.
-
- nnnnoooollllooooggggoooo turns off the X Window System logo display in the
- screen-saver. There is currently no way to change
- this from a client.
-
- XXXXDDDDMMMMCCCCPPPP OOOOPPPPTTTTIIIIOOOONNNNSSSS
- X servers that support XDMCP have the following options.
- See the _X _D_i_s_p_l_a_y _M_a_n_a_g_e_r _C_o_n_t_r_o_l _P_r_o_t_o_c_o_l specification for
- more information.
-
- ----qqqquuuueeeerrrryyyy _h_o_s_t-_n_a_m_e
- Enable XDMCP and send Query packets to the specified
- host.
-
- ----bbbbrrrrooooaaaaddddccccaaaasssstttt
- Enable XDMCP and broadcast BroadcastQuery packets to
- the network. The first responding display manager
- will be chosen for the session.
-
- ----iiiinnnnddddiiiirrrreeeecccctttt _h_o_s_t-_n_a_m_e
- Enable XDMCP and send IndirectQuery packets to the
- specified host.
-
- ----ppppoooorrrrtttt _p_o_r_t-_n_u_m
- Use an alternate port number for XDMCP packets.
- Must be specified before any -query, -broadcast or
- -indirect options.
-
- ----ccccllllaaaassssssss _d_i_s_p_l_a_y-_c_l_a_s_s
- XDMCP has an additional display qualifier used in
- resource lookup for display-specific options. This
- option sets that value, by default it is "MIT-
- Unspecified" (not a very useful value).
-
-
-
- Page 5 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- ----ccccooooooookkkkiiiieeee _x_d_m-_a_u_t_h-_b_i_t_s
- When testing XDM-AUTHENTICATION-1, a private key is
- shared between the server and the manager. This
- option sets the value of that private data (not that
- it is very private, being on the command line!).
-
- ----ddddiiiissssppppllllaaaayyyyIIIIDDDD _d_i_s_p_l_a_y-_i_d
- Yet another XDMCP specific value, this one allows
- the display manager to identify each display so that
- it can locate the shared key.
-
- XXXXKKKKEEEEYYYYBBBBOOOOAAAARRRRDDDD OOOOPPPPTTTTIIIIOOOONNNNSSSS
- X servers that support the XKEYBOARD extension accept the
- following options:
-
- ----xxxxkkkkbbbbddddiiiirrrr _d_i_r_e_c_t_o_r_y
- base directory for keyboard layout files
-
- ----xxxxkkkkbbbbmmmmaaaapppp _f_i_l_e_n_a_m_e
- keyboard description to load on startup
-
- [[[[++++----]]]]aaaacccccccceeeessssssssxxxx
- enable(+) or disable(-) AccessX key sequences
-
- ----aaaarrrr1111 _m_i_l_l_i_s_e_c_o_n_d_s
- sets the length of time in milliseconds that a key
- must be depressed before autorepeat starts
-
- ----aaaarrrr2222 _m_i_l_l_i_s_e_c_o_n_d_s
- sets the length of time in milliseconds that should
- elapse between autorepeat-generated keystrokes
-
- Many servers also have device-specific command line options.
- See the manual pages for the individual servers for more
- details.
-
- SSSSEEEECCCCUUUURRRRIIIITTTTYYYY EEEEXXXXTTTTEEEENNNNSSSSIIIIOOOONNNN OOOOPPPPTTTTIIIIOOOONNNNSSSS
- X servers that support the SECURITY extension accept the
- following option:
-
- ----sssspppp _f_i_l_e_n_a_m_e
- causes the server to attempt to read and interpret
- filename as a security policy file with the format
- described below. The file is read at server startup
- and reread at each server reset.
-
- The syntax of the security policy file is as follows.
- Notation: "*" means zero or more occurrences of the
- preceding element, and "+" means one or more occurrences.
- To interpret <foo/bar>, ignore the text after the /; it is
- used to distinguish between instances of <foo> in the next
- section.
-
-
-
- Page 6 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- <policy file> ::= <version line> <other line>*
-
- <version line> ::= <string/v> '\n'
-
- <other line > ::= <comment> | <access rule> | <site policy> | <blank line>
-
- <comment> ::= # <not newline>* '\n'
-
- <blank line> ::= <space> '\n'
-
- <site policy> ::= sitepolicy <string/sp> '\n'
-
- <access rule> ::= property <property/ar> <window> <perms> '\n'
-
- <property> ::= <string>
-
- <window> ::= any | root | <required property>
-
- <required property> ::= <property/rp> | <property with value>
-
- <property with value> ::= <property/rpv> = <string/rv>
-
- <perms> ::= [ <operation> | <action> | <space> ]*
-
- <operation> ::= r | w | d
-
- <action> ::= a | i | e
-
- <string> ::= <dbl quoted string> | <single quoted string> | <unqouted string>
-
- <dbl quoted string> ::= <space> " <not dqoute>* " <space>
-
- <single quoted string> ::= <space> ' <not squote>* ' <space>
-
- <unquoted string> ::= <space> <not space>+ <space>
-
- <space> ::= [ ' ' | '\t' ]*
-
- Character sets:
-
- <not newline> ::= any character except '\n'
- <not dqoute> ::= any character except "
- <not squote> ::= any character except '
- <not space> ::= any character except those in <space>
-
- The semantics associated with the above syntax are as
- follows.
-
- <version line>, the first line in the file, specifies the
- file format version. If the server does not recognize the
- version <string/v>, it ignores the rest of the file. The
- version string for the file format described here is
-
-
-
- Page 7 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- "version-1" .
-
- Once past the <version line>, lines that do not match the
- above syntax are ignored.
-
- <comment> lines are ignored.
-
- <sitepolicy> lines are currently ignored. They are intended
- to specify the site policies used by the XC-QUERY-SECURITY-1
- authorization method.
-
- <access rule> lines specify how the server should react to
- untrusted client requests that affect the X Window property
- named <property/ar>. The rest of this section describes the
- interpretation of an <access rule>.
-
- For an <access rule> to apply to a given instance of
- <property/ar>, <property/ar> must be on a window that is in
- the set of windows specified by <window>. If <window> is
- any, the rule applies to <property/ar> on any window. If
- <window> is root, the rule applies to <property/ar> only on
- root windows.
-
- If <window> is <required property>, the following apply. If
- <required property> is a <property/rp>, the rule applies
- when the window also has that <property/rp>, regardless of
- its value. If <required property> is a <property with
- value>, <property/rpv> must also have the value specified by
- <string/rv>. In this case, the property must have type
- STRING and format 8, and should contain one or more null-
- terminated strings. If any of the strings match
- <string/rv>, the rule applies.
-
- The definition of string matching is simple case-sensitive
- string comparison with one elaboration: the occurence of the
- character '*' in <string/rv> is a wildcard meaning "any
- string." A <string/rv> can contain multiple wildcards
- anywhere in the string. For example, "x*" matches strings
- that begin with x, "*x" matches strings that end with x,
- "*x*" matches strings containing x, and "x*y*" matches
- strings that start with x and subsequently contain y.
-
- There may be multiple <access rule> lines for a given
- <property/ar>. The rules are tested in the order that they
- appear in the file. The first rule that applies is used.
-
- <perms> specify operations that untrusted clients may
- attempt, and the actions that the server should take in
- response to those operations.
-
- <operation> can be r (read), w (write), or d (delete). The
- following table shows how X Protocol property requests map
-
-
-
- Page 8 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- to these operations in The Open Group server implementation.
-
- GetProperty r, or r and d if delete = True
- ChangeProperty w
- RotateProperties r and w
- DeleteProperty d
- ListProperties none, untrusted clients can always list all properties
-
- <action> can be a (allow), i (ignore), or e (error). Allow
- means execute the request as if it had been issued by a
- trusted client. Ignore means treat the request as a no-op.
- In the case of GetProperty, ignore means return an empty
- property value if the property exists, regardless of its
- actual value. Error means do not execute the request and
- return a BadAtom error with the atom set to the property
- name. Error is the default action for all properties,
- including those not listed in the security policy file.
-
- An <action> applies to all <operation>s that follow it,
- until the next <action> is encountered. Thus, irwad means
- ignore read and write, allow delete.
-
- GetProperty and RotateProperties may do multiple operations
- (r and d, or r and w). If different actions apply to the
- operations, the most severe action is applied to the whole
- request; there is no partial request execution. The
- severity ordering is: allow < ignore < error. Thus, if the
- <perms> for a property are ired (ignore read, error delete),
- and an untrusted client attempts GetProperty on that
- property with delete = True, an error is returned, but the
- property value is not. Similarly, if any of the properties
- in a RotateProperties do not allow both read and write, an
- error is returned without changing any property values.
-
- Here is an example security policy file.
-
- version-1
-
- # Allow reading of application resources, but not writing.
- property RESOURCE_MANAGER root ar iw
- property SCREEN_RESOURCES root ar iw
-
- # Ignore attempts to use cut buffers. Giving errors causes apps to crash,
- # and allowing access may give away too much information.
- property CUT_BUFFER0 root irw
- property CUT_BUFFER1 root irw
- property CUT_BUFFER2 root irw
- property CUT_BUFFER3 root irw
- property CUT_BUFFER4 root irw
- property CUT_BUFFER5 root irw
- property CUT_BUFFER6 root irw
- property CUT_BUFFER7 root irw
-
-
-
- Page 9 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- # If you are using Motif, you probably want these.
- property _MOTIF_DEFAULT_BINDINGS rootar iw
- property _MOTIF_DRAG_WINDOW root ar iw
- property _MOTIF_DRAG_TARGETS any ar iw
- property _MOTIF_DRAG_ATOMS any ar iw
- property _MOTIF_DRAG_ATOM_PAIRS any ar iw
-
- # The next two rules let xwininfo -tree work when untrusted.
- property WM_NAME any ar
-
- # Allow read of WM_CLASS, but only for windows with WM_NAME.
- # This might be more restrictive than necessary, but demonstrates
- # the <required property> facility, and is also an attempt to
- # say "top level windows only."
- property WM_CLASS WM_NAME ar
-
- # These next three let xlsclients work untrusted. Think carefully
- # before including these; giving away the client machine name and command
- # may be exposing too much.
- property WM_STATE WM_NAME ar
- property WM_CLIENT_MACHINE WM_NAME ar
- property WM_COMMAND WM_NAME ar
-
- # To let untrusted clients use the standard colormaps created by
- # xstdcmap, include these lines.
- property RGB_DEFAULT_MAP root ar
- property RGB_BEST_MAP root ar
- property RGB_RED_MAP root ar
- property RGB_GREEN_MAP root ar
- property RGB_BLUE_MAP root ar
- property RGB_GRAY_MAP root ar
-
- # To let untrusted clients use the color management database created
- # by xcmsdb, include these lines.
- property XDCCC_LINEAR_RGB_CORRECTION rootar
- property XDCCC_LINEAR_RGB_MATRICES rootar
- property XDCCC_GRAY_SCREENWHITEPOINT rootar
- property XDCCC_GRAY_CORRECTION rootar
-
- # To let untrusted clients use the overlay visuals that many vendors
- # support, include this line.
- property SERVER_OVERLAY_VISUALS rootar
-
- # Dumb examples to show other capabilities.
-
- # oddball property names and explicit specification of error conditions
- property "property with spaces" 'property with "'aw er ed
-
- # Allow deletion of Woo-Hoo if window also has property OhBoy with value
- # ending in "son". Reads and writes will cause an error.
- property Woo-Hoo OhBoy = "*son"ad
-
-
-
-
- Page 10 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- NNNNEEEETTTTWWWWOOOORRRRKKKK CCCCOOOONNNNNNNNEEEECCCCTTTTIIIIOOOONNNNSSSS
- The X server supports client connections via a platform-
- dependent subset of the following transport types: TCP/IP,
- Unix Domain sockets, DECnet, and several varieties of SVR4
- local connections. See the DISPLAY NAMES section of the
- _X(_1) manual page to learn how to specify which transport
- type clients should try to use.
-
- GGGGRRRRAAAANNNNTTTTIIIINNNNGGGG AAAACCCCCCCCEEEESSSSSSSS
- The X server implements a platform-dependent subset of the
- following authorization protocols: MIT-MAGIC-COOKIE-1, XDM-
- AUTHORIZATION-1, SUN-DES-1, and MIT-KERBEROS-5. See the
- _X_s_e_c_u_r_i_t_y(_1) manual page for information on the operation of
- these protocols.
-
- Authorization data required by the above protocols is passed
- to the server in a private file named with the ----aaaauuuutttthhhh command
- line option. Each time the server is about to accept the
- first connection after a reset (or when the server is
- starting), it reads this file. If this file contains any
- authorization records, the local host is not automatically
- allowed access to the server, and only clients which send
- one of the authorization records contained in the file in
- the connection setup information will be allowed access.
- See the _X_a_u manual page for a description of the binary
- format of this file. See _x_a_u_t_h(_1) for maintenance of this
- file, and distribution of its contents to remote hosts.
-
- The X server also uses a host-based access control list for
- deciding whether or not to accept connections from clients
- on a particular machine. If no other authorization
- mechanism is being used, this list initially consists of the
- host on which the server is running as well as any machines
- listed in the file /_e_t_c/_Xnnnn._h_o_s_t_s, where nnnn is the display
- number of the server. Each line of the file should contain
- either an Internet hostname (e.g. expo.lcs.mit.edu) or a
- DECnet hostname in double colon format (e.g. hydra::).
- There should be no leading or trailing spaces on any lines.
- For example:
-
- joesworkstation
- corporate.company.com
- star::
- bigcpu::
-
- Users can add or remove hosts from this list and enable or
- disable access control using the _x_h_o_s_t command from the same
- machine as the server.
-
- If the X FireWall Proxy (_x_f_w_p) is being used without a
- sitepolicy, host-based authorization must be turned on for
- clients to be able to connect to the X server via the _x_f_w_p.
-
-
-
- Page 11 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- If _x_f_w_p is run without a configuration file and thus no
- sitepolicy is defined, if _x_f_w_p is using an X server where
- xhost + has been run to turn off host-based authorization
- checks, when a client tries to connect to this X server via
- _x_f_w_p, the X server will deny the connection. See _x_f_w_p(_1)
- for more information about this proxy.
-
- The X protocol intrinsically does not have any notion of
- window operation permissions or place any restrictions on
- what a client can do; if a program can connect to a display,
- it has full run of the screen. X servers that support the
- SECURITY extension fare better because clients can be
- designated untrusted via the authorization they use to
- connect; see the _x_a_u_t_h(_1) manual page for details.
- Restrictions are imposed on untrusted clients that curtail
- the mischief they can do. See the SECURITY extension
- specification for a complete list of these restrictions.
-
- Sites that have better authentication and authorization
- systems might wish to make use of the hooks in the libraries
- and the server to provide additional security models.
-
- SSSSIIIIGGGGNNNNAAAALLLLSSSS
- The X server attaches special meaning to the following
- signals:
-
- _S_I_G_H_U_P This signal causes the server to close all existing
- connections, free all resources, and restore all
- defaults. It is sent by the display manager
- whenever the main user's main application (usually
- an _x_t_e_r_m or window manager) exits to force the
- server to clean up and prepare for the next user.
-
- _S_I_G_T_E_R_M This signal causes the server to exit cleanly.
-
- _S_I_G_U_S_R_1 This signal is used quite differently from either of
- the above. When the server starts, it checks to see
- if it has inherited SIGUSR1 as SIG_IGN instead of
- the usual SIG_DFL. In this case, the server sends a
- SIGUSR1 to its parent process after it has set up
- the various connection schemes. _X_d_m uses this
- feature to recognize when connecting to the server
- is possible.
-
- FFFFOOOONNNNTTTTSSSS
- The X server can obtain fonts from directories and/or from
- font servers. The list of directories and font servers the
- X server uses when trying to open a font is controlled by
- the _f_o_n_t _p_a_t_h.
-
- The default font path is "<XRoot>/lib/X11/fonts/misc/,
- <XRoot>/lib/X11/fonts/Speedo/, <XRoot>/lib/X11/fonts/Type1/,
-
-
-
- Page 12 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- <XRoot>/lib/X11/fonts/75dpi/, <XRoot>/lib/X11/fonts/100dpi/"
- . where <XRoot> refers to the root of the X11 install tree.
-
- The font path can be set with the ----ffffpppp option or by _x_s_e_t(_1)
- after the server has started.
-
- FFFFIIIILLLLEEEESSSS
- /etc/Xnnnn.hosts Initial access control list
- for display number nnnn
-
- <XRoot>/lib/X11/fonts/100dpi
- <XRoot>/lib/X11/fonts/misc, <XRoot>/lib/X11/fonts/75dpi,
- Bitmap font directories
-
- <XRoot>/lib/X11/fonts/Speedo, <XRoot>/lib/X11/fonts/Type1
- Outline font directories
-
- <XRoot>/lib/X11/fonts/PEX PEX font directories
-
- <XRoot>/lib/X11/rgb.txt Color database
-
- /tmp/.X11-unix/Xnnnn Unix domain socket for display
- number nnnn
-
- /tmp/rcXnnnn Kerberos 5 replay cache for
- display number nnnn
-
- /usr/adm/Xnnnnmsgs Error log file for display
- number nnnn if run from _i_n_i_t(_8)
-
- <XRoot>/lib/X11/xdm/xdm-errors
- Default error log file if the
- server is run from _x_d_m(_1)
-
- Note: <XRoot> refers to the root of the X11 install tree.
-
- SSSSEEEEEEEE AAAALLLLSSSSOOOO
- General information: X(1)
-
- Protocols: _X _W_i_n_d_o_w _S_y_s_t_e_m _P_r_o_t_o_c_o_l, _T_h_e _X _F_o_n_t _S_e_r_v_i_c_e
- _P_r_o_t_o_c_o_l, _X _D_i_s_p_l_a_y _M_a_n_a_g_e_r _C_o_n_t_r_o_l _P_r_o_t_o_c_o_l
-
- Fonts: bdftopcf(1), mkfontdir(1), xfs(1), xlsfonts(1),
- xfontsel(1), xfd(1), _X _L_o_g_i_c_a_l _F_o_n_t _D_e_s_c_r_i_p_t_i_o_n _C_o_n_v_e_n_t_i_o_n_s
-
- Security: Xsecurity(1), xauth(1), Xau(1), xdm(1), xhost(1),
- xfwp(1) _S_e_c_u_r_i_t_y _E_x_t_e_n_s_i_o_n _S_p_e_c_i_f_i_c_a_t_i_o_n
-
- Starting the server: xdm(1), xinit(1)
-
- Controlling the server once started: xset(1), xsetroot(1),
- xhost(1)
-
-
-
- Page 13 (printed 10/3/02)
-
-
-
-
-
-
- XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111)))) XXXX VVVVeeeerrrrssssiiiioooonnnn 11111111 ((((RRRReeeelllleeeeaaaasssseeee 6666....6666)))) XXXXSSSSEEEERRRRVVVVEEEERRRR((((1111))))
-
-
-
- Server-specific man pages: Xsgi(1), Xnest(1), Xvfb(1)
-
- Server internal documentation: _D_e_f_i_n_i_t_i_o_n _o_f _t_h_e _P_o_r_t_i_n_g
- _L_a_y_e_r _f_o_r _t_h_e _X _v_1_1 _S_a_m_p_l_e _S_e_r_v_e_r
-
- AAAAUUUUTTTTHHHHOOOORRRRSSSS
- The sample server was originally written by Susan
- Angebranndt, Raymond Drewry, Philip Karlton, and Todd
- Newman, from Digital Equipment Corporation, with support
- from a large cast. It has since been extensively rewritten
- by Keith Packard and Bob Scheifler, from MIT. Dave Wiggins
- took over post-R5 and made substantial improvements.
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- Page 14 (printed 10/3/02)
-
-
-
-