Bug 7342

Sorry about the phenomenal bug spam, guys.  Adding xorg-team@ to the QA contact so bugs don't get lost in future.

I've never actually known what xdmshell is for, but I finally found
this in the X11R4 release notes:

Many servers set the keyboard to do non-blocking  I/O  under
the assumption that they are the only programs attempting to
read from the keyboard.   Unfortunately,  some  versions  of
/etc/getty  (A/UX's  in  particular)  will immediately see a
continuous stream of zero-length reads which they  interpret
as  end-of-file indicators.  Eventually, /etc/init will dis-
able logins on that line until somebody types the  following
as root:

        #  kill -HUP 1

Under A/UX, one alternative is to disable logins on the con-
sole  and  always  run xdm from /etc/inittab.  However, make
sure that you save a copy of the old  /etc/inittab  in  case
something  goes  wrong  and  you have to restore logins from
over the network or from single-user mode.

Another less drastic approach is to set up an account  whose
shell  is  the  xdmshell  program found in mit/clients/xdm/.
This program is  not  installed  by  default  so  that  site
administrators  will  examine  it  to  see if it meets their
needs.  The xdmshell utility makes sure that it is being run
from the appropriate type of terminal, starts xdm, waits for
it to finish, and then resets the console if necessary.   If
the     xdm     resources    file    (specified    by    the
DisplayManager*resources entry in the xdm-config file)  con-
tains  a  binding to the abort-display action similar to the
following

        xlogin*login.translations: #override  Ctrl<Key>R: abort-display()

the console can then by restored by pressing  the  indicated
key  (Control-R  in the above example) in the xdm login win-
dow.

The xdmshell program is usually installed setuid to root but
executable  only by members of a special group, of which the
account which has xdmshell as its shell is the only member:

        %  grep xdm /etc/passwd
        x:aB9i7vhDVa82z:101:51:Account for starting up X:/tmp:/etc/xdmshell
        %  grep 51 /etc/group
        xdmgrp:*:51:
        %  ls -lg /etc/xdmshell
        -rws--x---   1 root     xdmgrp     20338 Nov  1 01:32 /etc/xdmshell


If the xdm resources have not been configured to have a  key
bound  to  the  abort-display() action, there will be no way
for general users to login to the console directly.  Whether
or not this is desirable depends on the particular site.

Fixed in git:
http://cgit.freedesktop.org/xorg/app/xdm/commit/?id=1da26b3c3128008315f83c3e47e21e66f2d40afe