rootless X

rubenvb · 2011-01-16 16:48:56

I have read that in other distro's it us possible to run X as a user and that this increases security. How can I do this in Arch?

Thanks!

cesura · 2011-01-16 17:03:10

rubenvb wrote:

I have read that in other distro's it us possible to run X as a user and that this increases security. How can I do this in Arch?
Thanks!

# adduser
# cp /root/.xinitrc /home/newuser/.xinitrc
$ su newuser
$ startx

karol · 2011-01-16 17:45:08

itsbrad212 wrote:

rubenvb wrote:
I have read that in other distro's it us possible to run X as a user and that this increases security. How can I do this in Arch?
Thanks!
# adduser
# cp /root/.xinitrc /home/newuser/.xinitrc
$ su newuser
$ startx

cp /etc/skel/.xinitrc /home/newuser/.xinitrc

+ make needed changes.

If you copy from /root, the file should still belong to root. And my root doesn't have one to begin with.

You really shouldn't run X or GUI apps as root :-) What made you think you should?

Edit: typo + grammar.

Last edited by karol (2011-01-16 17:51:29)

cesura · 2011-01-16 17:48:40

karol wrote:

itsbrad212 wrote:
rubenvb wrote:
I have read that in other distro's it us possible to run X as a user and that this increases security. How can I do this in Arch?
Thanks!
# adduser
# cp /root/.xinitrc /home/newuser/.xinitrc
$ su newuser
$ startx
cp /etc/skel/.xinitrc /home/newuser/.xinitrc
+ make needed changes.
If you copy from /root, the file should still belong to root. And I my root doesn't have one to begin with.
And you shouldn't really run X or GUI apps as root :-) What made you think you should?

I always use root just to test the X server for the first time. 'Cause I'm lazy.

Coacher · 2011-01-16 17:52:23

[coacher@Photon ~]$ ls -la /usr/bin/Xorg
-rwsr-xr-x 1 root root 1938024 Ноя 2 01:30 /usr/bin/Xorg
Anyway X will have 'root' owner when running, because of SetUID bit. And I guess this is the thing OP interested in.

fsckd · 2011-01-16 17:54:16

Seriously?

itsbrad212 and karol: give us the output of ps aux | grep X | grep root

On my system, Xorg is suid to root by installation. Is this not true for you guys?

patroclo7 · 2011-01-16 17:57:59

Yes, it is suid to root even if you use startx as a user.

To run without suid, Xorg needs to be patched and configured with a certain flag. Moreover it is possible only for KMS-enabled drivers. Thsi thread from the gentto forums has some not very up-to-date infos:
http://forums.gentoo.org/viewtopic-t-81 … art-0.html

Last edited by patroclo7 (2011-01-16 18:03:09)

Coacher · 2011-01-16 18:00:26

OP should look here for some info
http://www.phoronix.com/scan.php?page=n … &px=ODIzNQ
https://wiki.ubuntu.com/X/Rootless
http://lwn.net/Articles/341033/

Last edited by Coacher (2011-01-16 18:01:04)

karol · 2011-01-16 18:03:36

fsckd wrote:

Seriously?
itsbrad212 and karol: give us the output of ps aux | grep X | grep root
On my system, Xorg is suid to root by installation. Is this not true for you guys?

Umm, yeah, it is, sorry.

I have mixed up X and startx / .xinitrc.
<looks menacingly at Brad>

I've read headlines like "A Root-less X Server Nears Reality" but I don't know anything more so I will just shut p.

rubenvb · 2011-01-16 18:55:14

@all: yes, the phoronix and Ubuntu links are what I'm after.

I seem to have forgotten that NVIDIA proprietary drivers aren't very KMS-friendly. (note to self: must get good ATI/AMD laptop).

I take it that Arch doesn't make the whole KMS/root-less X a default in any way?

Thanks

Gusar · 2011-01-16 19:00:13

rubenvb wrote:

I seem to have forgotten that NVIDIA proprietary drivers aren't very KMS-friendly. (note to self: must get good ATI/AMD laptop)

Not a problem. The nvidia blob hasn't required root for a long time now. And getting a laptop with AMD graphics would be a mistake IMO, nvidia's driver is still by far the best.

Last edited by Gusar (2011-01-16 19:02:03)

Mr Green · 2011-01-16 19:01:53

https://wiki.archlinux.org/index.php/The_Arch_Way

Your system your rules

Nothing is done by default you are in control

Welcome to Arch

rubenvb · 2011-01-16 19:29:00

@Gusar: please explain "the nvidia binary blob has not required root for a long time". Reading the Archlinux wiki on KMS says different... and the NVIDIA page doesn't even mention KMS.

@Mr Green: I understand that, but when you step back and think about it: a lot of things have a lot of default settings and most of them are very good. (well, just speaking out of experience here , sidux/aptosid was pretty much the same, except they were more out-of-date and very scared of non-debian packages)

cesura · 2011-01-16 21:22:19

karol wrote:

fsckd wrote:
Seriously?
itsbrad212 and karol: give us the output of ps aux | grep X | grep root
On my system, Xorg is suid to root by installation. Is this not true for you guys?
Umm, yeah, it is, sorry.
I have mixed up X and startx / .xinitrc.
<looks menacingly at Brad>
I've read headlines like "A Root-less X Server Nears Reality" but I don't know anything more so I will just shut p.

Son of a....

In my own defense, the question was ambiguous.

Gusar · 2011-01-16 21:59:51

rubenvb wrote:

@Gusar: please explain "the nvidia binary blob has not required root for a long time". Reading the Archlinux wiki on KMS says different...

That page merely states that the nvidia driver doesn't use KMS (note, this doesn't mean the driver doesn't do modesetting in the kernel. it does).

The nvidia driver is a whole different animal from the open source stack. Whenever you read about implementations that the open drivers use (TTM/GEM, DRI2, KMS, AIGLX, etc, etc) is has no bearing at all on the nvidia driver. The nvidia driver needs to be evaluated completely separately, because it uses it's own implementations of pretty much everything.

Arch Linux

#1 2011-01-16 16:48:56

rootless X

#2 2011-01-16 17:03:10

Re: rootless X

#3 2011-01-16 17:45:08

Re: rootless X

#4 2011-01-16 17:48:40

Re: rootless X

#5 2011-01-16 17:52:23

Re: rootless X

#6 2011-01-16 17:54:16

Re: rootless X

#7 2011-01-16 17:57:59

Re: rootless X

#8 2011-01-16 18:00:26

Re: rootless X

#9 2011-01-16 18:03:36

Re: rootless X

#10 2011-01-16 18:55:14

Re: rootless X

#11 2011-01-16 19:00:13

Re: rootless X

#12 2011-01-16 19:01:53

Re: rootless X

#13 2011-01-16 19:29:00

Re: rootless X

#14 2011-01-16 21:22:19

Re: rootless X

#15 2011-01-16 21:59:51

Re: rootless X

Board footer