unkillable roque window with no pid - Xwindows

This is a discussion on unkillable roque window with no pid - Xwindows ; Hi, This is the first time I've seen this behavior, and wonder what you think of it. I tried compiling lfhex http://stoopidsimple.com/lfhex on my linux system, using ICEWM for the window manager. It is a Qt 4 app. After compiling, ...

+ Reply to Thread
Results 1 to 3 of 3

Thread: unkillable roque window with no pid

  1. unkillable roque window with no pid

    Hi,

    This is the first time I've seen this behavior, and wonder what
    you think of it.

    I tried compiling lfhex
    http://stoopidsimple.com/lfhex

    on my linux system, using ICEWM for the window manager.
    It is a Qt 4 app.

    After compiling, I try running lfhex, and it seems to run fine,
    BUT when I close the program, I get a tiny window left over,
    with no pid. I cannot kill it with xkill, nor can I close it with any
    WM menu.

    A WindowManager restart does not remove it.

    Only a restart of X will remove it.

    My question is how can a window like this exist, and what
    can I do to kill it without restarting X?

    Is this a security hole?

    Thanks,
    zentara

    --
    I'm not really a human, but I play one on earth.
    http://zentara.net/japh.html

  2. Re: unkillable roque window with no pid

    zentara writes:

    > Hi,
    >
    > This is the first time I've seen this behavior, and wonder what
    > you think of it.
    >
    > I tried compiling lfhex
    > http://stoopidsimple.com/lfhex
    >
    > on my linux system, using ICEWM for the window manager.
    > It is a Qt 4 app.
    >
    > After compiling, I try running lfhex, and it seems to run fine,
    > BUT when I close the program, I get a tiny window left over,
    > with no pid. I cannot kill it with xkill, nor can I close it with any
    > WM menu.
    >
    > A WindowManager restart does not remove it.
    >
    > Only a restart of X will remove it.
    >
    > My question is how can a window like this exist, and what
    > can I do to kill it without restarting X?


    Probably an override redirect window.
    Such a window won't have borders and the window
    manager will avoid it.

    Try using xprop to find out more about the window.

    Windows don't have pids and associating a window
    with a pid is hit or miss.

    > Is this a security hole?


    I can't see how.

    For hex editing, I find XEmacs (or emacs) does
    well enough. It has a hex mode (hexl-mode).

  3. Re: unkillable roque window with no pid

    On Thu, 01 Mar 2007 13:28:20 -0500, Dan Espen
    wrote:

    >zentara writes:


    >> After compiling, I try running lfhex, and it seems to run fine,
    >> BUT when I close the program, I get a tiny window left over,
    >> with no pid. I cannot kill it with xkill, nor can I close it with any
    >> WM menu.
    >>
    >> A WindowManager restart does not remove it.
    >>
    >> Only a restart of X will remove it.
    >>
    >> My question is how can a window like this exist, and what
    >> can I do to kill it without restarting X?

    >
    >Probably an override redirect window.
    >Such a window won't have borders and the window
    >manager will avoid it.


    No this window has borders, a toolbar, and WM controls,
    but the controls don't work.
    The window is miniscule, but I can drag it open, and
    it is solid black. It is transparent to the mouse, meaning
    if I position it over another window; trying to drag it
    with the mouse, will drag the underlying window. I can drag
    it by the title bar, however.

    >Try using xprop to find out more about the window.


    xprop gives me:
    WM_PROTOCOLS(ATOM): protocols WM_DELETE_WINDOW

    >Windows don't have pids and associating a window
    >with a pid is hit or miss.
    >
    >> Is this a security hole?

    >
    >I can't see how.
    >
    >For hex editing, I find XEmacs (or emacs) does
    >well enough. It has a hex mode (hexl-mode).


    I looked at it further.
    When I tried to logout from the WindowManager, it would
    hang, and I was forced to use a Cntrl-Alt-Backspace to kill X.
    THEN, when doing a ps, I find that my icewm-session file
    did not close and I needed to manually kill it's pid.

    So it appears that somehow, the lfhex is attaching itself to
    my icewm-session and making it unkillable.

    It's no problem, I have other hex editors, but was curious as
    why the type of window can get created by closing another
    app. It's probably a weird bug in lfhex.

    When I run strace on it, and watch it's close, I get:

    read(11, "#\t$XdotOrg: xc/nls/locale.dir,v "..., 131072) = 30113
    close(11) = 0
    munmap(0xb708b000, 131072) = 0
    write(5, "\0", 1) = 1
    write(10, "\2\7\4\0H\0\0\0\0\10\0\0000@@\0\231\7\2\0\331\0\20 0\2\4"...,
    380) = 380
    2) = 32
    read(10, "\21T8\t\330\0\200\2\330\0\200\2\300\177\277\10\364 \37\353"...,
    32) = 32
    reread(10, "\22\0108\t\330\0\200\2\330\0\200\2\0$\32\10\210zo\ 10\0"...,
    3ad(10, "\22\200:\t!\0\200\2!\0\200\2\0\200\277\10\364\37\3 53\267"...,
    32) = 32
    read(10, "\21T:\t!\0\200\2!\0\200\2\260\205\305\10\364\37\35 3\267"...,
    32) = 32
    read(10, "\21T<\t\22\0\200\2\22\0\200\2X5\316\10\364\37\353\267\2 00"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\"\0\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2#\1\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2D\1\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\37\1\0\0e\r\23\0\1\366\302\10\270\24 2"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\356\0\0\0e\r\23\0\1\366\302\10\270"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\360\0\0\0e\r\23\0\1\366\302\10\270"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2 \1\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\33\1\0\0e\r\23\0\1\366\302\10\270\24 2"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\363\0\0\0e\r\23\0\1\366\302\10\270"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\351\0\0\0e\r\23\0\1\366\302\10\270"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2\'\0\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\0026\1\0\0e\r\23\0\1\366\302\10\270\24 2"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2C\0\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2#\0\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2(\0\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\0348<\t\22\0\200\2$\0\0\0e\r\23\0\1\366\302\10\270\242"...,
    32) = 32
    read(10, "\1\0d\t\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\34\0\0\000 8\304"...,
    32) = 32
    shutdown(10, 2 /* send and receive */) = 0
    close(10) = 0
    close(3) = 0
    close(5) = 0
    write(9, "@", 1) = 1
    close(9) = 0
    close(7) = 0
    exit_group(0) = ?




    Thanks.
    zentara

    --
    I'm not really a human, but I play one on earth.
    http://zentara.net/japh.html

+ Reply to Thread