x11vnc: --grabkbd, -grabptr, -env, -allowedcmds, unixpw+WAIT user fred:options

1 files changed, 78 insertions, 20 deletions

diff --git a/x11vnc/help.c b/x11vnc/help.c
index 87062ce..5d8eb61 100644
--- a/x11vnc/help.c
+++ b/x11vnc/help.c
@@ -305,6 +305,7 @@ void print_help(int mode) {
 "                       option, otherwise the stderr goes to the viewer which\n"
 "                       will cause it to abort.  Specifying both -inetd and -q\n"
 "                       and no -o will automatically close the stderr.\n"
+"\n"
 "-nofilexfer            Disable the TightVNC file transfer extension.  (same as\n"
 "                       -disablefiletransfer).  Note that when the -viewonly\n"
 "                       option is supplied all file transfers are disabled.\n"
@@ -312,6 +313,7 @@ void print_help(int mode) {
 "                       However, if the remote control mechanism is used to\n"
 "                       change the global or per-client viewonly state the\n"
 "                       filetransfer permissions will NOT change.\n"
+"\n"
 "-http                  Instead of using -httpdir (see below) to specify\n"
 "                       where the Java vncviewer applet is, have x11vnc try\n"
 "                       to *guess* where the directory is by looking relative\n"
@@ -388,6 +390,23 @@ void print_help(int mode) {
 "                       a global -viewonly is in effect (all input is discarded\n"
 "                       in that case).\n"
 "\n"
+"-grabkbd               When VNC viewers are connected, attempt to the grab the\n"
+"                       keyboard so someone sitting at the physical display\n"
+"                       is not able to enter keystrokes.  This method uses\n"
+"                       XGrabKeyboard(3X11) and so it is not secure and does not\n"
+"                       rule out the person at the physical display injecting\n"
+"                       keystrokes by flooding the server with them, grabbing\n"
+"                       the keyboard himself, etc.  Some degree of cooperation\n"
+"                       from the person at the display is assumed.\n"
+"-grabptr               As -grabkbd, but for the mouse pointer using\n"
+"                       XGrabPointer(3X11).  Unfortunately due to the way the X\n"
+"                       server works, the mouse can still be moved around by the\n"
+"                       user at the physical display, but he will not be able to\n"
+"                       change window focus with it.  Also some window managers\n"
+"                       that call XGrabServer(3X11) for resizes, etc, will\n"
+"                       act on the local user's input.  Again, some degree of\n"
+"                       cooperation from the person at the display is assumed.\n"
+"\n"
 "-viewpasswd string     Supply a 2nd password for view-only logins.  The -passwd\n"
 "                       (full-access) password must also be supplied.\n"
 "\n"
@@ -587,7 +606,25 @@ void print_help(int mode) {
 "                       as the user who just authenticated via the login and\n"
 "                       password prompt.\n"
 "\n"
-"                       Thus the combination of -display WAIT:cmd=... and\n"
+"                       Also in the case of -unixpw, the user logging in can\n"
+"                       place a colon at the end of his username and supply\n"
+"                       a few options: scale=, scale_cursor=, solid, id=,\n"
+"                       clear_mods, clear_keys, repeat, or speeds= separated\n"
+"                       by commas if there is more than one.  After the user\n"
+"                       logs in successfully, these options will be applied to\n"
+"                       the VNC screen.  For example,\n"
+"\n"
+"                          login: fred:scale=3/4,repeat\n"
+"                          Password: ...\n"
+"\n"
+"                       for convenience m/n implies scale= e.g. fred:3/4\n"
+"                       To disable this set the environment variable\n"
+"                       X11VNC_NO_UNIXPW_OPTS=1.  To set any other options,\n"
+"                       the user can use the gui (x11vnc -gui connect) or the\n"
+"                       remote control method (x11vnc -R opt:val) during his\n"
+"                       VNC session.\n"
+"\n"
+"                       So the combination of -display WAIT:cmd=... and\n"
 "                       -unixpw allows automatic pairing of an unix\n"
 "                       authenticated VNC user with his desktop.  This could\n"
 "                       be very useful on SunRays and also any system where\n"
@@ -620,7 +657,7 @@ void print_help(int mode) {
 "                        5815 stream tcp nowait root /usr/sbin/tcpd .../x11vnc \\\n"
 "                          -inetd -q -http_ssl -display WAIT:cmd=HTTPONCE\n"
 "\n"
-"                       Is used in the Apache SSL-portal example (see FAQ).\n"
+"                       It is used in the Apache SSL-portal example (see FAQ).\n"
 "\n"
 "                       Finally, one can insert a geometry between colons,\n"
 "                       e.g. WAIT:1280x1024:... to set the size of the display\n"
@@ -1404,6 +1441,12 @@ void print_help(int mode) {
 "-rc filename           Use \"filename\" instead of $HOME/.x11vncrc for rc file.\n"
 "-norc                  Do not process any .x11vncrc file for options.\n"
 "\n"
+"-env VAR=VALUE         Set the environment variable 'VAR' to value 'VALUE'\n"
+"                       at x11vnc startup.  This is a convenience utility to\n"
+"                       avoid shell script wrappers, etc. to set the env. var.\n"
+"                       You may specify as many of these as needed on the\n"
+"                       command line.\n"
+"\n"
 "-h, -help              Print this help text.\n"
 "-?, -opts              Only list the x11vnc options.\n"
 "-V, -version           Print program version and last modification date.\n"
@@ -2719,6 +2762,10 @@ void print_help(int mode) {
 "                       nolookup        enable  -nolookup mode.\n"
 "                       lookup          disable -nolookup mode.\n"
 "                       input:str       set -input to \"str\", empty to disable.\n"
+"                       grabkbd         enable  -grabkbd mode.\n"
+"                       nograbkbd       disable -grabkbd mode.\n"
+"                       grabptr         enable  -grabptr mode.\n"
+"                       nograbptr       disable -grabptr mode.\n"
 "                       client_input:str set the K, M, B -input on a per-client\n"
 "                                       basis.  select which client as for\n"
 "                                       disconnect, e.g. client_input:host:MB\n"
@@ -2976,13 +3023,14 @@ void print_help(int mode) {
 "                       scr_skip scr_inc scr_keys scr_term scr_keyrepeat\n"
 "                       scr_parms scrollcopyrect scr noscrollcopyrect noscr\n"
 "                       fixscreen noxrecord xrecord reset_record pointer_mode\n"
-"                       pm input_skip input client_input speeds wmdt\n"
-"                       debug_pointer dp nodebug_pointer nodp debug_keyboard\n"
-"                       dk nodebug_keyboard nodk deferupdate defer wait_ui\n"
-"                       wait_bog nowait_bog slow_fb wait readtimeout nap nonap\n"
-"                       sb screen_blank fbpm nofbpm fs gaps grow fuzz snapfb\n"
-"                       nosnapfb rawfb progressive rfbport http nohttp httpport\n"
-"                       httpdir enablehttpproxy noenablehttpproxy alwaysshared\n"
+"                       pm input_skip input grabkbd nograbkbd grabptr\n"
+"                       nograbptr client_input speeds wmdt debug_pointer dp\n"
+"                       nodebug_pointer nodp debug_keyboard dk nodebug_keyboard\n"
+"                       nodk deferupdate defer wait_ui wait_bog nowait_bog\n"
+"                       slow_fb wait readtimeout nap nonap sb screen_blank\n"
+"                       fbpm nofbpm fs gaps grow fuzz snapfb nosnapfb rawfb\n"
+"                       progressive rfbport http nohttp httpport httpdir\n"
+"                       enablehttpproxy noenablehttpproxy alwaysshared\n"
 "                       noalwaysshared nevershared noalwaysshared dontdisconnect\n"
 "                       nodontdisconnect desktop debug_xevents nodebug_xevents\n"
 "                       debug_xevents debug_xdamage nodebug_xdamage\n"
@@ -2997,12 +3045,8 @@ void print_help(int mode) {
 "                       scale_str scaled_x scaled_y scale_numer scale_denom\n"
 "                       scale_fac scaling_blend scaling_nomult4 scaling_pad\n"
 "                       scaling_interpolate inetd privremote unsafe safer nocmds\n"
-#ifndef REL81
 "                       passwdfile unixpw unixpw_nis unixpw_list ssl ssl_pem\n"
 "                       sslverify stunnel stunnel_pem https usepw using_shm\n"
-#else
-"                       passwdfile usepw using_shm\n"
-#endif
 "                       logfile o flag rc norc h help V version lastmod bg\n"
 "                       sigpipe threads readrate netrate netlatency pipeinput\n"
 "                       clients client_count pid ext_xtest ext_xtrap ext_xrecord\n"
@@ -3073,6 +3117,17 @@ void print_help(int mode) {
 "                       remote-control is disabled it cannot be turned back on.\n"
 "-nocmds                No external commands (e.g. system(3), popen(3), exec(3))\n"
 "                       will be run.\n"
+"-allowedcmds list      \"list\" contains a comma separated list of the only\n"
+"                       external commands that can be run.  The full list of\n"
+"                       associated options is:\n"
+"\n"
+"                        stunnel, ssl, unixpw, WAIT, id, accept, afteraccept,\n"
+"                        gone, pipeinput, v4l-info, rawfb-setup, dt, gui,\n"
+"                        storepasswd, crash.\n"
+"\n"
+"                       See each option's help to learn the associated external\n"
+"                       command.  Note that the -nocmds option takes precedence\n"
+"                       and disables all external commands.\n"
 "\n"
 "-deny_all              For use with -remote nodeny: start out denying all\n"
 "                       incoming clients until \"-remote nodeny\" is used to\n"
@@ -3247,7 +3302,7 @@ void nopassword_warning_msg(int gotloc) {
 "#@        YOU ARE RUNNING X11VNC WITHOUT A PASSWORD!!        @#\n"
 "#@                                                           @#\n"
 "#@  This means anyone with network access to this computer   @#\n"
-"#@  will be able to easily view and control your desktop.    @#\n"
+"#@  will be able to view and control your desktop.           @#\n"
 "#@                                                           @#\n"
 "#@ >>> If you did not mean to do this Press CTRL-C now!! <<< @#\n"
 "#@                                                           @#\n"
@@ -3257,16 +3312,18 @@ void nopassword_warning_msg(int gotloc) {
 "#@                                                           @#\n"
 "#@  You can create an x11vnc password file by running:       @#\n"
 "#@                                                           @#\n"
-"#@      x11vnc -storepasswd password /path/to/passfile       @#\n"
+"#@       x11vnc -storepasswd password /path/to/passfile      @#\n"
+"#@  or   x11vnc -storepasswd /path/to/passfile               @#\n"
+"#@  or   x11vnc -storepasswd                                 @#\n"
+"#@                                                           @#\n"
+"#@  (the last one will use ~/.vnc/passwd)                    @#\n"
 "#@                                                           @#\n"
 "#@  and then starting x11vnc via:                            @#\n"
 "#@                                                           @#\n"
 "#@      x11vnc -rfbauth /path/to/passfile                    @#\n"
 "#@                                                           @#\n"
-"#@  an existing ~/.vnc/passwd file will work too.            @#\n"
-"#@                                                           @#\n"
-"#@  Running \"x11vnc -storepasswd\" with no arguments          @#\n"
-"#@  will prompt for a passwd to store in ~/.vnc/passwd.      @#\n"
+"#@  an existing ~/.vnc/passwd file from another VNC          @#\n"
+"#@  application will work fine too.                          @#\n"
 "#@                                                           @#\n"
 "#@  You can also use the -passwdfile or -passwd options.     @#\n"
 "#@  (note -passwd is unsafe if local users are not trusted)  @#\n"
@@ -3277,7 +3334,8 @@ void nopassword_warning_msg(int gotloc) {
 "#@  Use x11vnc -usepw to automatically use your              @#\n"
 "#@  ~/.vnc/passwd or ~/.vnc/passwdfile password files.       @#\n"
 "#@  (and prompt you to create ~/.vnc/passwd if neither       @#\n"
-"#@  file exists.)                                            @#\n"
+"#@  file exists.)  Under -usepw, x11vnc will exit if it      @#\n"
+"#@  cannot find a password to use.                           @#\n"
 "#@                                                           @#\n"
 "#@                                                           @#\n"
 "#@  Even with a password, the subsequent VNC traffic is      @#\n"