4

This is a one-liner: Is there a way/command to check if the X server is run as root or as user?

This was supposed to be a one-liner but alas... I recently upgraded my Arch Linux box. After the upgrade I was notified that X now runs rootless. I checked on the official Arch Linux page and it states:

X is now rootless with the help of systemd-logind [...] [1]

This got me interested in how to check whether X is run rootless or not. How can this be done?

Improve this question

1 Answer 1

Reset to default
6

There are a few ways to output the user ID (UID) with ps; a simple one is with -f:

ps -fC X

Will give you information for all the X servers that are running (there can be more than one).

This presumes that the executable is called X -- if there's no such process, you will have to target something else. Since it almost certainly at least has capital X in it (e.g., Xorg, X11), an alternative is to filter through grep:

ps -o uid,comm -A | grep X

This removes the column headers, but the UID is the numerical one on the left. If this is 0, then the process is running root. If nothing turns up, try ps -fA | grep X; this one involves more clutter.

Finally, if there is no process with capital X in its name, try x; you may at least find commands used to control it, such as startx or xinit. You could also try dm, since display managers usually have this in their name (gdm, etc). However, none of these is actually the X server, and although xinit starts the server, the server executable often has the setuid bit set, meaning even though xinit has a non-privileged UID, X will still run as root.

Improve this answer
10
  • Hm, ps -fC X outputs nothing; ps X and ps -fC startx do. The UID I get is my own just as I expected. But may question may have been imprecise: I'd like to know if X is run rootless or not. I will elaborate on that in my question (trying to be brief it seems I was too brief).
    – lord.garbage
    Commented Jul 30, 2014 at 11:54
  • 1
    The ps X output is unrelated (see OUTPUT FORMAT CONTROL in man ps about that). I think the X server isn't necessarily called X, which might be your problem, but it should at least contain the letter X; I've added a paragraph about using grep to get around this.
    – goldilocks
    Commented Jul 30, 2014 at 12:12
  • Yeah, I'm a bit confused too. The Arch Linux page simply states that X is now run rootless. Which to my mind seems to imply that it is run by the user. But it would be strange to declare this noteworthy news since X seems to be always run by the user. I log into my machine as user and start X with startx. If my logic is correct then this implies it is always run as a user process and hence rootless. I wonder if there is more to it though.
    – lord.garbage
    Commented Jul 30, 2014 at 12:16
  • Maybe that was my bad. It seems an odd way to put it to me, but I'll defer to the Arch docs. I use startx as well; on my system hands off to xinit, and only the later persists in the process table. The parent process of the X server is xinit, so for you it should be startx. You find this via the PPID given by ps -f once you know the name of the X server process. Take that PPID number and ps -p + the PPID should give you startx. If none of these things has UID 0, it is "running rootless".
    – goldilocks
    Commented Jul 30, 2014 at 12:27
  • Nice. I have both processes persisting, startx and xinit. I check them with ps -fC startx and ps -fC xinit. Both have a UID ≠ 0. One important sidenote: I was only able to find startx and xinit feeding grep a lowercase x. You think it advisable to include this in your answer?
    – lord.garbage
    Commented Jul 30, 2014 at 12:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .