Add a section on security considerations

[slock.git] / slock.1

diff --git a/slock.1 b/slock.1
index 467194da367209c6a9877440ef54f4580959ae62..82cdcd62064166a75975997e7901f1df7e5bea97 100644 (file)
--- a/slock.1
+++ b/slock.1
@@ -1,19 +1,39 @@
-.TH SLOCK 1 slock\-VERSION
-.SH NAME
-slock \- simple X screen locker
-.SH SYNOPSIS
-.B slock
-.RB [
-.IR cmd
-]
-.SH DESCRIPTION
-.B slock
-is an X screen locker. If provided,
-.IR cmd
+.Dd 2016-08-23
+.Dt SLOCK 1
+.Sh NAME
+.Nm slock
+.Nd simple X screen locker
+.Sh SYNOPSIS
+.Nm
+.Op Fl v
+.Op Ar cmd Op Ar arg ...
+.Sh DESCRIPTION
+.Nm
+is a simple X screen locker. If provided,
+.Ar cmd Op Ar arg ...
 is executed after the screen has been locked.
-.SH EXAMPLES
-$ slock /usr/sbin/s2ram
-.SH CUSTOMIZATION
-.B slock
-can be customized by creating a custom config.h and (re)compiling the source
-code. This keeps it fast, secure and simple.
+.Sh OPTIONS
+.Bl -tag -width Ds
+.It Fl v
+Print version information to stdout and exit.
+.El
+.Sh SECURITY CONSIDERATIONS
+To make sure a locked screen can not be bypassed by switching VTs
+or killing the X server with Ctrl+Alt+Backspace, it is recommended
+to disable both in
+.Xr xorg.conf 5
+for maximum security:
+.Bd -literal -offset left
+Section "ServerFlags"
+       Option "DontVTSwitch" "True"
+       Option "DontZap"      "True"
+EndSection
+.Ed
+.Sh EXAMPLES
+$
+.Nm
+/usr/sbin/s2ram
+.Sh CUSTOMIZATION
+.Nm
+can be customized by creating a custom config.h from config.def.h and
+(re)compiling the source code. This keeps it fast, secure and simple.