Non root Xorg

From Gentoo Wiki
Jump to: navigation, search

This page describes how an unprivileged user can run Xorg without using suid.

Important
The logind provider does not provide the same level of access as the legacy SUID-enabled Xorg does. The elogind provider allows a locally seated user to be granted access to $TTY and input devices. Users who wish to start X remotely will need to take extra steps to ensure that a seat is given to the user from which they start X, or stay with the legacy behaviour of X with suid.

Requisites

The logind provider

Currently there are two logind providers in Gentoo, systemd and elogind. Users of systemd profile and users of desktop profiles (both systemd and non-systemd ones) will already have a logind interface provided; users of OpenRC with default profile will be required to globally enable the elogind USE flag and update the system with emerge -N @world. It is also required to re-login after elogind has been enabled, to activate it. If either the systemd or elogind USE flag is enabled on x11-base/xorg-server together with the suid USE flag, instead of installing with suid enabled, x11-base/xorg-server will be installed with suid-wrapper, which will only preserve suid if the graphics driver in use really requires root.

The elogind users are recommended to add elogind to the boot runlevel. While it is not strictly necessary, since elogind can be started upon receiving an event over dbus, it will clash with other services that depend on elogind, like fwupd, resulting in OpenRC trying to start already started elogind and thus failing to do so.

dbus service running

It is required to have dbus started so that pam_elogind can start or attach to already started elogind daemon.

Security issues with running xorg-server as root

Several vulnerabilities have been discovered in the X.Org X server. Missing input sanitising in X server extensions may result in local privilege escalation if the X server is configured to run with root privileges.[1] These vulnerabilities can result in an attacker accessing confidential information[2] as well as potentially bypassing protections provided by ASLR.[3]

Note
Debian documentation and other online publications released after January 25, 2012 are under the MIT (Expat) License. [4][5]

Troubleshooting

Cannot start Xorg as regular user

The majority of problems with running Xorg as a user other than root after switching to elogind come down to issues with PAM. One can confirm that elogind is working by running loginctl user-status. If it does not work (or if startx still fails), then one should check:

  • Have the configuration files in /etc been updated after updating the system with the new USE flags? (dispatch-conf)
  • (systemd users) Is there any trace of pam_elogind.so in /etc/pam.d/system-auth?
  • Is the dbus service running?
  • (elogind users) Is the elogind service running? (you probably want to rc-update add elogind default too)

See also

References

  1. "DSA-4758-1 xorg-server -- security update" Archived from "the original".
  2. "CVE-2020-14345". Archived from "the original".
  3. "CVE-2020-14347". Archived from "the original".
  4. The license information for Debian WWW Pages can be found "here". Archived from "the original".
  5. The MIT (Expat) License can be found "here". Archived from "the original".