On the X desktop, I ocassionally used gksudo or just sudo somegui to launch GUI applications as another user, including root. I recently discovered that this is not possible on contemporary (early 2018) Wayland desktops. All applications must launch as the current desktop user, and are limited to the privileges of that user.

Is this a permanent feature of Wayland (there by design), or is su-type usage an enhancement that has not yet been implemented?

I'm looking for a documented statement (roadmap, design page...), not preference or opinion.

5 Answers 5


Is this a permanent feature of Wayland (there by design)

No. This has nothing to do with the wayland protocol. It is rather a question of environment setup.

Wayland uses a socket, its name is stored in WAYLAND_DISPLAY. It is located in XDG_RUNTIME_DIR that is normally set up for user access only. But root can access it, too. (Some applications also regard XDG_SESSION_TYPE which can have values wayland or x11 to decide whether to use X or Wayland.)

sudo deletes most environment variables including XDG_RUNTIME_DIR and WAYLAND_DISPLAY.

You can run wayland applications as root with:


or shorter with -EH to preserve almost all environment variables (but setting HOME to /root). This will include DISPLAY and XAUTHORITY for Xwayland access, too:

sudo -EH application

Though, if the application running as root writes anything in XDG_RUNTIME_DIR, it can cause file permission issues for user applications.

However, running graphical applications as root in wayland is much less a security issue than it is in X11.

To avoid using X11 accidently, you can run without DISPLAY:

sudo -EH env DISPLAY=  waylandapplication

I'm looking for a documented statement (roadmap, design page...), not preference or opinion.

The Wayland documentation mentions WAYLAND_DISPLAY, but I do not find anything about XDG_RUNTIME_DIR. Though, all wayland compositors including the reference implementation weston depend on XDG_RUNTIME_DIR.

If WAYLAND_DISPLAY would be at another location, it would not be a problem to run applications from arbitrary users on the same wayland display. But XDG_RUNTIME_DIR ist specified to be restricted on the logged-in user and should contain user related sockets:

$XDG_RUNTIME_DIR defines the base directory relative to which user-specific non-essential runtime files and other file objects (such as sockets, named pipes, ...) should be stored. The directory MUST be owned by the user, and he MUST be the only one having read and write access to it. Its Unix access mode MUST be 0700.

The issues with running another user or root on wayland are rather related to the XDG_RUNTIME_DIR specification than to wayland itself. If you specify a custom XDG_RUNTIME_DIR in /tmp with arbitrary access (thus breaking its specification), all users can use the wayland display.

There is some hope for the future not to need XDG_RUNTIME_DIR, but it depends on the implementation: Wayland docu chap.4:

Beginning in Wayland 1.15, implementations can optionally support server socket endpoints located at arbitrary locations in the filesystem by setting WAYLAND_DISPLAY to the absolute path at which the server endpoint listens.

  • 1
    sudo -EH to keep environment but reset HOME?
    – muru
    Feb 11, 2018 at 0:45
  • @muru thanks, I've added your suggestion to the answer. I was not aware of -H.
    – mviereck
    Feb 11, 2018 at 1:27
  • sudo -EH env DISPLAY= waylandapplication works to launch apps as root, but sudo -u normal_user -EH env DISPLAY= waylandapplication fails to launch the app under a non-root user.
    – Maximko
    Jan 4, 2020 at 4:04
  • I've tried all of these with synaptic, and still get Probably you're running Synaptic on Wayland with root permission.; My next step is probably to purge wayland entirely from my system, and avoid installing distributions that use wayland until this issue is fixed.
    – MRule
    Sep 21, 2022 at 7:27
  • Edit: none of these worked for me. If you're in the same boat, please try answer unix.stackexchange.com/a/596468/134513
    – MRule
    Sep 21, 2022 at 7:29

I wrote ego (Alter Ego) for this use case. It's not a GUI app, but you can launch GUI apps from the console as another user, it automatically handles xhost and Wayland and PulseAudio socket sharing: https://github.com/intgr/ego

The trick is using Posix ACLs to grant access to the Wayland/PulseAudio sockets to another user, and setting environment variables so applications of the target user know how to connect to it.

If you run into problems, please open an issue on GitHub.


There are two fairly easy workarounds. The examples below start synaptic but any other command should do.

  1. Using ssh X-Forwarding to the root user (you may have to enable root login in /etc/ssh/sshd_config or configure key auth):
$ ssh -Y root@:: synaptic
  1. Using socat & sudo, as proposed by bober on RedHat Bug #1274451. The example below assumes we're on display #0 and #1 is free...
socat UNIX-LISTEN:/tmp/.X11-unix/X1 UNIX-CONNECT:/tmp/.X11-unix/X0 & sudo DISPLAY=:1 synaptic

I believe either way the workaround is to have a user-owned process to connect to X11 socket and provide tunneling .

  • Thank you! Option 2 is the ONLY solution that's worked for me so far; It seems to me entirely unacceptable that Ubuntu would ship a "stable" release where running GUI apps with sudo requires hacks like this.
    – MRule
    Sep 21, 2022 at 7:29
  • I've created a little shell script named wlsudo with this command; It seems to work similarly to gksudo: #!/usr/bin/env bash socat UNIX-LISTEN:/tmp/.X11-unix/X1 UNIX-CONNECT:/tmp/.X11-unix/X0 & sudo DISPLAY=:1 $1; Solves everything.
    – MRule
    Sep 21, 2022 at 7:32
  • This does not answer the question but shows a way to access Xwayland as root.
    – mviereck
    Sep 22, 2022 at 5:00

This extends Thomas Guyot-Sionnest's answer.

I feel like this deserves its own answer, since it cleaned up so many issues for me. Create a shell script called wlsudo with the following contents:

#!/usr/bin/env bash
socat UNIX-LISTEN:/tmp/.X11-unix/X1 UNIX-CONNECT:/tmp/.X11-unix/X0 & sudo DISPLAY=:1 "$@"

Save it in a directory on your $PATH, and give it executable permissions (chmod +x ./wlsudo). You should then be able to launch GUI apps using wlsudo in place of sudo in Wayland, e.g. wlsudo synaptic just works.


Although I'm not answering your question directly, I think there are people who may have ended up here because of the same problem.

This is a script that I have made is a workaround for people who need to run graphical application (like Gedit, Synaptic or GParted) as root via sudo in a Wayland session:


Imported here:

#!/usr/bin/env bash

# Enable root access to x-windows system.
# Motivation: Trying to run a graphical application as root via su, sudo in a 
# Wayland session (e.g. GParted or Gedit), will fail. Apps which use polkit to
# request administrator permissions for just certain operations and only when 
# needed are not affected (they are not started as root right away). 
# [1] https://bugzilla.redhat.com/show_bug.cgi?id=1274451
# Based on a Reddit comment.
# [2] https://www.reddit.com/r/Fedora/comments/5eb633/solution_running_graphical_app_with_sudo_in/

if (( $# != 1 )); then
    echo "Illegal number of parameters."
    echo "Usage: wsudo [command]"
    exit 1

for cmd in sudo xhost; do
    if ! type -P $cmd &>/dev/null; then
        echo "$cmd it's not installed. Aborting." >&2
        exit 1

xhost +SI:localuser:root
sudo $1
#disable root access after application terminates
xhost -SI:localuser:root
#print access status to allow verification that root access was removed
  • this is great, but I think better posed as a separate Q&A, with a link to this question, it will then come up as a related question - I'm also happy to link to the new question
    – lofidevops
    Oct 10, 2018 at 6:01
  • This is a great hint, but it does not work on SSH connections - only on the local console.
    – Kalle
    Jan 28, 2020 at 11:42
  • @Kalle With ssh X forwarding you can just run the command - in fact you can run them "locally" too by ssh'ing to the root user; i.e. ssh -Y root@::. Jul 3, 2020 at 6:39
  • 2
    Sorry, but it is out of question to enable ssh:ing into system as root user. This is for security reasons - commands executed throuh sudo can be limited, and they leave a trace on logs.
    – Kalle
    Jul 4, 2020 at 13:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .