Previous code waited one frame longer due to using the wrong variable.

Although the field we need does not correspond to any field to query, we
still must specify one or the call simply fails.

Fixes #46: "xsecurelock: XkbGetControls failed." error on Ctrl-Tab.

Should limit damage of the unmapping.

Also, optionally dump debug info about the first window unmapping which
helped (XSECURELOCK_DEBUG_WINDOW_INFO).

Instead of attempting to lock a Wayland session, just bail out. This prevents a false sense of security as trying to "lock" a Wayland session will by design only affect X11, not Wayland, clients.

Fixes #50.

Shouldn't need it.

We still try to reinstate grabs until we get them once per frame if we
ever get a NotifyUngrab.

NotifyUngrab is normal near startup (for releasing the L key when
locking via Ctrl-Alt-L in Xfce).

Shouldn't be needed anymore, as our events seem sufficient for that.

Also, add a signal handler for SIGTERM everywhere so killing xsecurelock
takes its children with it (and returns exit status 1).

Also, moved the datetime buffer to a local variable given it isn't used
across functions, fixed formatting, and loaded the LC_TIME locale so we
can show local time formats.

Fixes a warning.

Bring back the clamping, but instead explicitly query the root window size before building monitor structs.

The issue was that DisplayWidth()/DisplayHeight() values don't get
updated after XOpenDisplay(); the fix is querying the root window size
instead to update the auth window size.

The clamping is there to handle the (hopefully unlikely) case of a
screen being only partially in the root window (i.e. XRandR vs X11 core
inconsistency); it's no longer harmful once the bug is fixed.

Installation-wise, NetBSD works just like FreeBSD - you need to make
authproto_pam setuid root.

It's currently always based on git-describe - we may or may not want to
override that in the Debian packaging.

- Missing check for dup() return value; possible impact would be
  hard to track down authentication failures due to lack of logging.
- Uninitialized XSetWindowAttributes struct members (technically unused
  and thus a false positive, but cleaner this way nevertheless).

There are many different PAM implementations out there, which I haven't
all tested. The PAM service name is used to build a path name, typically
inside /etc/pam.d, to find a service configuration file.

There's a possibility that in some PAM implementations, the service name
is not sanitized and could be used to traverse paths; as most PAM
clients are _not_ setuid and do _not_ let the caller specify the service
name (unlike xsecurelock), this alone wouldn't be a vulnerability per se.

And successful path traversal could e.g. lead to attackers obtaining
information about existence or nonexistence of files they can't see, or
possibly even reading part of a file (e.g. a PAM implementation might
spit out syntax error messages quoting parts of a file, either over
[possibly sniffable] syslog or to stderr; the latter would then allow an
attacker to run

XSECURELOCK_PAM_SERVICE=../shadow ./authproto_pam

to dump the root password hash.

Again, I'm not aware of any system where this exploit would actually
work - but as the PAM specs I have here do not describe what happens if
a PAM service name contains a slash (Linux PAM appears to use the
basename then), I've decided to just refuse any such names.

Add an authproto_pam helper that communicates with PAM.

This is now used by auth_pam_x11 as sole backend. It can be made
setuid/setgid where necessary to authenticate local users (e.g. on
FreeBSD).

Also renames auth_pam_x11 to auth_x11, and moves auth_htpasswd and
auth_pamtester to authprotos that can be used with auth_x11.

Will fix #43.

Fixes build on OpenBSD.

Fixes build warning on FreeBSD.

A header added by IWYU does not exist on FreeBSD; turns out it's not
meant to be explicitly included anyway.

The keybind for it is Ctrl-Tab, which seems to be one of the few that:

- Don't emit a keycode usable in a password.
- Aren't selectable as Xkb modifier (as that would cause us to swich
  twice, which with 2 layouts would be a NOP).
- Are available on all layouts and keyboards I know.

Thanks to Soumya S. for an initial implementation of this, which I've
ported into auth_pam_x11!

It's no longer in master after all.