4 ms·
> It is completely possible to run X as a non-privileged user. The problem is that X handles all of the hardware abstraction, so it needs direct write access to
by segfaultbuserr 5y ago
> It is completely possible to run X as a non-privileged user. The problem is that X handles all of the hardware abstraction, so it needs direct write access to hardware. For numerous reasons this is typically constrained to root.
This is no longer the case on a modern system with KMS/DRM graphics for many years, everything goes through the kernel. There are still some X drivers that directly control the I/O ports and PCI devices, but those hardware is nearly extinct today (the proprietary NVIDIA driver is the only major exception).
I've used a non-root X with Intel graphics for many years already, the desktop is fully functional. The problem, I think, is login managers. Some (many?) login managers must run as root, they need the privilege to log in as another user. To work around the problem, I decided to simply login to the command line via getty and startx by myself, works fine when I did this years ago. I'm not sure if login manager is still the problem today (update: ArchWiki says "GDM will run Xorg without root privileges by default when kernel mode setting is used.")
> You can imagine that the security concerns related to running X as root are significant. There is work to change this situation, such as the kernel mode select feature, but of course there is a substantial problem of inertia: [...]
To be fair, the author did mention the fact in the next paragraph.
- Jasper_ 5y agoYeah, user-mode X11 was being implemented around 2014 or so. I was there at Red Hat when it was happening. GDM itself doesn't need root anymore -- it can run as its own user. The way it's architected, there's what's known as a "greeter session". This is what provides the user picker, it has to be a full desktop session to provide accessibility / screen reader / OSK / all the bells and whistles, and it runs as the gdm user. Once you pick a user to start the authentication flow, it forks off a special helper that's marked setuid root so it can interact with PAM (unfortunately, arbitrary PAM modules can assume things about root credentials). It also has the job of monitoring everyone's X servers and kicking you back to the greeter if the X server crashes for any reason. One tiny thing here -- the article implies that the root X11 server launches GDM, but it's actually the other way. The DM is the one in charge of launching X11 servers, and it always has been. You can see evidence of this in the old XDMCP spec which was the standard for how remote display manager connections should work.
- joombaga 5y ago> Once you pick a user to start the authentication flow, it forks off a special helper that's marked setuid root so it can interact with PAM (unfortunately, arbitrary PAM modules can assume things about root credentials). Does this mean we could remove the helper's setuid mark if we know the PAM modules we need don't assume things about root credentials? Would we even need the helper then?
- Jasper_ 5y agoYeah, probably, but PAM modules have a habit of crashing and can load arbitrary libraries, so for such a big system component I would still keep it isolated. But if you think you can trust it...
- jcrawfordor 5y agoThanks for pointing out my error about the DM vs. X11 starting first, I was hesitant to even try to explain how that worked because I find it confusing and I just knew I would get something wrong. I will correct the article when I have a moment.