0

I am running Debian 9.5 on my machine and when I run the command xhost there is the following output:

access control enabled, only authorized clients can connect
SI:localuser:username

So in my understanding root should not be allowed to access the x-server but when I switch to root with su and run a GUI application from the terminal, everything runs fine although it shouldn't.

So can someone explain why my x-server ignores the entries in the access control list?

  • 1
    The clients it's referring to are X application clients. Root on a system can do an and see anything. Can you elaborate on your Q? – slm Aug 3 '18 at 2:41
  • 1
    @sim I know that root can do anything but after searching through the internet root shouldn't be allowed to access my x-server if not especially allowed to do so. There are a lot of people on the internet that have problems because root cannot access the x-server. – idlmn89 Aug 3 '18 at 3:39
  • 1
    Those anecdotal comments are from ppl that just don't know the lower level bits and how they work, and they're assuming, incorrectly, that it's the user root not being able to do X, when it's really just the Xauthoriy file + env vars that are causing it to appear that root cannot do it. – slm Aug 3 '18 at 3:43
  • 1
    The point is that even if root is "not allowed to do something" via some configuration files, root has rights to alter all files, so any kind of attempt to prevent root from doing anything is useless. – dirkt Aug 3 '18 at 3:44
  • 1
    @slm @dirkt The problem was my lack of knowledge concerning the existence of the Xauthority file and the XAUTHORITY env variable. Maybe using the word "not allowed" has been a bit distracting. Of course I know that root can do anything but I knew that there was some kind of configuration so that root can access the x-server although there was no permission shown by xhost. The missing link was the env variable. However, thanks for answering. – idlmn89 Aug 3 '18 at 4:05
7

If you used su to switch to root, the XAUTHORITY environment variable is available in the root shell started by su. And since root can read your files, it has access to the Xauthority file. On my system:

root@host# medit   

starts fine, whereas emptying XAUTHORITY causes it to fail:

root@host# XAUTHORITY= medit
No protocol specified

(medit:25388): Gtk-WARNING **: 12:35:31.963: cannot open display: :1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.