remove support for running post lock command

This command was used for example to suspend-to-ram (man page example).

On Linux running this command inherits OOM killer immunity. This could be
abused by an other local user on the same machine (abusing resources).

To keep the use-case for suspend-to-ram an user could write a wrapper script
for it, outside the scope of slock.

Simplify argument handling, because the post-lock command parameter is removed.

Reported by: Acts1631 <acts1631kjv@proton.me>

LICENSE

@@ -1,5 +1,6 @@
 MIT/X Consortium License
 
+© 2016-2026 Hiltjo Posthuma <hiltjo@codemadness.org>
 © 2015-2016 Markus Teich <markus.teich@stusta.mhn.de>
 © 2014 Dimitris Papastamos <sin@2f30.org>
 © 2006-2014 Anselm R Garbe <anselm@garbe.us>

Makefile

@@ -6,56 +6,41 @@ include config.mk
 SRC = slock.c ${COMPATSRC}
 OBJ = ${SRC:.c=.o}
 
-all: options slock
+all: slock
-
-options:
-	@echo slock build options:
-	@echo "CFLAGS   = ${CFLAGS}"
-	@echo "LDFLAGS  = ${LDFLAGS}"
-	@echo "CC       = ${CC}"
 
 .c.o:
-	@echo CC $<
+	${CC} -c ${CFLAGS} $<
-	@${CC} -c ${CFLAGS} $<
 
-${OBJ}: config.h config.mk arg.h util.h
+${OBJ}: config.h config.mk util.h
 
 config.h:
-	@echo creating $@ from config.def.h
+	cp config.def.h $@
-	@cp config.def.h $@
 
 slock: ${OBJ}
-	@echo CC -o $@
+	${CC} -o $@ ${OBJ} ${LDFLAGS}
-	@${CC} -o $@ ${OBJ} ${LDFLAGS}
 
 clean:
-	@echo cleaning
+	rm -f slock ${OBJ} slock-${VERSION}.tar.gz
-	@rm -f slock ${OBJ} slock-${VERSION}.tar.gz
 
 dist: clean
-	@echo creating dist tarball
+	mkdir -p slock-${VERSION}
-	@mkdir -p slock-${VERSION}
+	cp -R LICENSE Makefile README slock.1 config.mk \
-	@cp -R LICENSE Makefile README slock.1 config.mk \
+		${SRC} config.def.h util.h slock-${VERSION}
-		${SRC} config.def.h arg.h util.h slock-${VERSION}
+	tar -cf slock-${VERSION}.tar slock-${VERSION}
-	@tar -cf slock-${VERSION}.tar slock-${VERSION}
+	gzip slock-${VERSION}.tar
-	@gzip slock-${VERSION}.tar
+	rm -rf slock-${VERSION}
-	@rm -rf slock-${VERSION}
 
 install: all
-	@echo installing executable file to ${DESTDIR}${PREFIX}/bin
+	mkdir -p ${DESTDIR}${PREFIX}/bin
-	@mkdir -p ${DESTDIR}${PREFIX}/bin
+	cp -f slock ${DESTDIR}${PREFIX}/bin
-	@cp -f slock ${DESTDIR}${PREFIX}/bin
+	chmod 755 ${DESTDIR}${PREFIX}/bin/slock
-	@chmod 755 ${DESTDIR}${PREFIX}/bin/slock
+	chmod u+s ${DESTDIR}${PREFIX}/bin/slock
-	@chmod u+s ${DESTDIR}${PREFIX}/bin/slock
+	mkdir -p ${DESTDIR}${MANPREFIX}/man1
-	@echo installing manual page to ${DESTDIR}${MANPREFIX}/man1
+	sed "s/VERSION/${VERSION}/g" <slock.1 >${DESTDIR}${MANPREFIX}/man1/slock.1
-	@mkdir -p ${DESTDIR}${MANPREFIX}/man1
+	chmod 644 ${DESTDIR}${MANPREFIX}/man1/slock.1
-	@sed "s/VERSION/${VERSION}/g" <slock.1 >${DESTDIR}${MANPREFIX}/man1/slock.1
-	@chmod 644 ${DESTDIR}${MANPREFIX}/man1/slock.1
 
 uninstall:
-	@echo removing executable file from ${DESTDIR}${PREFIX}/bin
+	rm -f ${DESTDIR}${PREFIX}/bin/slock
-	@rm -f ${DESTDIR}${PREFIX}/bin/slock
+	rm -f ${DESTDIR}${MANPREFIX}/man1/slock.1
-	@echo removing manual page from ${DESTDIR}${MANPREFIX}/man1
-	@rm -f ${DESTDIR}${MANPREFIX}/man1/slock.1
 
-.PHONY: all options clean dist install uninstall
+.PHONY: all clean dist install uninstall

arg.h

@@ -1,65 +0,0 @@
-/*
- * Copy me if you can.
- * by 20h
- */
-
-#ifndef ARG_H__
-#define ARG_H__
-
-extern char *argv0;
-
-/* use main(int argc, char *argv[]) */
-#define ARGBEGIN	for (argv0 = *argv, argv++, argc--;\
-					argv[0] && argv[0][0] == '-'\
-					&& argv[0][1];\
-					argc--, argv++) {\
-				char argc_;\
-				char **argv_;\
-				int brk_;\
-				if (argv[0][1] == '-' && argv[0][2] == '\0') {\
-					argv++;\
-					argc--;\
-					break;\
-				}\
-				for (brk_ = 0, argv[0]++, argv_ = argv;\
-						argv[0][0] && !brk_;\
-						argv[0]++) {\
-					if (argv_ != argv)\
-						break;\
-					argc_ = argv[0][0];\
-					switch (argc_)
-
-/* Handles obsolete -NUM syntax */
-#define ARGNUM				case '0':\
-					case '1':\
-					case '2':\
-					case '3':\
-					case '4':\
-					case '5':\
-					case '6':\
-					case '7':\
-					case '8':\
-					case '9'
-
-#define ARGEND			}\
-			}
-
-#define ARGC()		argc_
-
-#define ARGNUMF()	(brk_ = 1, estrtonum(argv[0], 0, INT_MAX))
-
-#define EARGF(x)	((argv[0][1] == '\0' && argv[1] == NULL)?\
-				((x), abort(), (char *)0) :\
-				(brk_ = 1, (argv[0][1] != '\0')?\
-					(&argv[0][1]) :\
-					(argc--, argv++, argv[0])))
-
-#define ARGF()		((argv[0][1] == '\0' && argv[1] == NULL)?\
-				(char *)0 :\
-				(brk_ = 1, (argv[0][1] != '\0')?\
-					(&argv[0][1]) :\
-					(argc--, argv++, argv[0])))
-
-#define LNGARG()	&argv[0][0]
-
-#endif

config.mk

@@ -1,5 +1,5 @@
 # slock version
-VERSION = 1.5
+VERSION = 1.7
 
 # Customize below to fit your system
 
@@ -27,6 +27,3 @@ COMPATSRC = explicit_bzero.c
 #CPPFLAGS = -DVERSION=\"${VERSION}\" -D_BSD_SOURCE -D_NETBSD_SOURCE
 # On OpenBSD set COMPATSRC to empty
 #COMPATSRC =
-
-# compiler and linker
-CC = cc

slock.1

@@ -1,39 +1,36 @@
-.Dd 2016-08-23
+.Dd September 5, 2026
 .Dt SLOCK 1
+.Os
 .Sh NAME
 .Nm slock
 .Nd simple X screen locker
 .Sh SYNOPSIS
 .Nm
 .Op Fl v
-.Op Ar cmd Op Ar arg ...
 .Sh DESCRIPTION
 .Nm
-is a simple X screen locker. If provided,
+is a simple X screen locker.
-.Ar cmd Op Ar arg ...
+The options are as follows:
-is executed after the screen has been locked.
-.Sh OPTIONS
 .Bl -tag -width Ds
 .It Fl v
 Print version information to stdout and exit.
 .El
+.Sh EXIT STATUS
+.Ex -std
 .Sh SECURITY CONSIDERATIONS
 To make sure a locked screen can not be bypassed by switching VTs
 or killing the X server with Ctrl+Alt+Backspace, it is recommended
 to disable both in
 .Xr xorg.conf 5
 for maximum security:
-.Bd -literal -offset left
+.Bd -literal
 Section "ServerFlags"
 	Option "DontVTSwitch" "True"
 	Option "DontZap"      "True"
 EndSection
 .Ed
-.Sh EXAMPLES
-$
-.Nm
-/usr/sbin/s2ram
 .Sh CUSTOMIZATION
 .Nm
 can be customized by creating a custom config.h from config.def.h and
-(re)compiling the source code. This keeps it fast, secure and simple.
+(re)compiling the source code.
+This keeps it fast, secure and simple.

slock.c

@@ -19,7 +19,6 @@
 #include <X11/Xlib.h>
 #include <X11/Xutil.h>
 
-#include "arg.h"
 #include "util.h"
 
 char *argv0;
@@ -180,10 +179,13 @@ readpw(Display *dpy, struct xrandr *rr, struct lock **locks, int nscreens,
 					passwd[--len] = '\0';
 				break;
 			default:
-				if (num && !iscntrl((int)buf[0]) &&
+				if (num && !iscntrl((unsigned char)buf[0]) &&
 				    (len + num < sizeof(passwd))) {
 					memcpy(passwd + len, buf, num);
 					len += num;
+				} else if (buf[0] == '\025') { /* ctrl-u clears input */
+					explicit_bzero(&passwd, sizeof(passwd));
+					len = 0;
 				}
 				break;
 			}
@@ -300,7 +302,7 @@ lockscreen(Display *dpy, struct xrandr *rr, int screen)
 static void
 usage(void)
 {
-	die("usage: slock [-v] [cmd [arg ...]]\n");
+	die("usage: slock [-v]\n");
 }
 
 int
@@ -315,13 +317,12 @@ main(int argc, char **argv) {
 	Display *dpy;
 	int s, nlocks, nscreens;
 
-	ARGBEGIN {
+	if (argc > 1 && !strcmp(argv[1], "-v")) {
-	case 'v':
+		puts("slock-"VERSION);
-		fprintf(stderr, "slock-"VERSION"\n");
 		return 0;
-	default:
+	} else if (argc > 1) {
 		usage();
-	} ARGEND
+	}
 
 	/* validate drop-user and -group */
 	errno = 0;
@@ -374,20 +375,6 @@ main(int argc, char **argv) {
 	if (nlocks != nscreens)
 		return 1;
 
-	/* run post-lock command */
-	if (argc > 0) {
-		switch (fork()) {
-		case -1:
-			die("slock: fork failed: %s\n", strerror(errno));
-		case 0:
-			if (close(ConnectionNumber(dpy)) < 0)
-				die("slock: close: %s\n", strerror(errno));
-			execvp(argv[0], argv);
-			fprintf(stderr, "slock: execvp %s: %s\n", argv[0], strerror(errno));
-			_exit(1);
-		}
-	}
-
 	/* everything is now blank. Wait for the correct password */
 	readpw(dpy, &rr, locks, nscreens, hash);