2

I want to start an Xorg server (which should only feature a minimal xterm terminal emulator from a newly created "pristine" tty). I have thought this to be as simple as issuing a xinit or maybe a startx however both have failed me. Therefore the question:

How to manually run/init/start a Xorg server on a different VT/TTY?

here the

Longer background story to the question at hand:

This is the backgroud and what I have tried already:

Looking at man openvt I was able to run a shell on a newly created tty (or vt, cannot tell precisly the different vt<>tty) like this:

 $> sudo openvt -s /bin/bash

the -s of causes the direct switch to that new tty/vt on that new tty I wanted to manually start a Xorg server which according to man xinit should start with a minimal xterm application. On the new shell on the switched to tty I (created via openvt) I hence issues this command:

 $> su -c 'xinit xterm -display :4 -- :4' - mahr &>/tmp/output

and I receive this output

$> cat /tmp/output
X.Org X Server 1.19.6
Release Date: 2017-12-20
X Protocol Version 11, Revision 0
Build Operating System: Linux 4.4.0-148-generic x86_64 Ubuntu
Current Operating System: Linux scitech 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64
Kernel command line: BOOT_IMAGE=/vmlinuz-4.15.0-70-generic root=/dev/mapper/ubuntu--vg-root ro
Build Date: 03 June 2019  08:10:35AM
xorg-server 2:1.19.6-1ubuntu4.3 (For technical support please see http://www.ubuntu.com/support) 
Current version of pixman: 0.34.0
    Before reporting problems, check http://wiki.x.org
    to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
    (++) from command line, (!!) notice, (II) informational,
    (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/home/mahr/.local/share/xorg/Xorg.4.log", Time: Thu Nov 28 10:57:53 2019
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
(EE) 
Fatal server error:
(EE) parse_vt_settings: Cannot open /dev/tty0 (Permission denied)
(EE) 
(EE) 
Please consult the The X.Org Foundation support 
     at http://wiki.x.org
 for help. 
(EE) Please also check the log file at "/home/mahr/.local/share/xorg/Xorg.4.log" for additional information.
(EE) 
(EE) Server terminated with error (1). Closing log file.

Session terminated, terminating shell...xinit: giving up
xinit: unable to connect to X server: Connection refused
xinit: unexpected signal 2
 ...terminated.
  • If memory serves, adding your user to the tty group should help with your issue. – schaiba Nov 28 '19 at 10:20
  • I'm not sure I'm getting what you're after (won't a new Xserver start in a new/free vt by default? there's no relationship between the vt and the display number), but you should use the vtN Xorg arg (where N is the tty number) if you want it to run in a particular tty. Try something like openvt -s -- sh -c 'tty=$(tty); startx xterm -- :2 vt${tty#*tty}'. – mosvy Nov 28 '19 at 10:44
  • notice that xinit won't set up any auth by default, so any program running in the Xorg server is completely open to any user. Don't use it. – mosvy Nov 28 '19 at 10:48
  • thank you @mosvy I will attempt to move along with the things you suggested :) Any idea why there is a tty group and what a membership entails? is there a quick thing to know about it, some history? – fraleone Nov 28 '19 at 10:56
  • note it may not be possible to start a server on a "different" VT than the currently active one (there's probably a way if you don't mind switching the VT though). unix.stackexchange.com/questions/539071/… – sourcejedi Nov 28 '19 at 11:22
1

Do not use xinit, because it is vulnerable. Use startx. xinit appears to be written to accept X connections from any user ID, without warning or documentation. startx appears to fix this. I do not know why this situation is tolerated, or how it happened in the first place.

The way X works has changed "recently". X used to rely on being set-uid root, and switch to a new VT. Note, even then, X might only have worked if you started it from a text VT. E.g. a non-root user might not be able to start X from inside another X session. In other words, I'm not sure whether this would do what you want anyway.

X has now been changed so that it can use the current VT instead. Some tools such as startx have changed their behaviour, to use the new design.

The design is you do not need to start any program as root (in order to improve security). This works by using logind instead, a smaller background service (which is started with root privileges).

If you went back to running X as root, you would not need permission from logind. I think X will probably remain compatible with this.

You appear to have been trying to run X without forcing it to run as full root. In that case you need permission from logind. logind gives you permission to do stuff on the VT you logged in on. I worked out a trick to spoof a login.

user=mahr
sudo systemd-run \
    --property PAMName=login \
    --property User="$user" \
    --property StandardInput=tty \
    --property TTYPath=/dev/tty8 \
    sh -c 'chvt 8 && exec startx /usr/bin/xterm'

It feels like it should be possible to allocate the tty dynamically as well (using openvt -s, and a script using the tty command). However, I have just frozen my screen a couple of times trying to do that :-).

(logind intended to reduce how much damage non-root programs like this X server can do to the system. AIUI the implementation of this is quite limited. It does not provide a recovery key. logind even gets killed horribly if you use the kernel System Attention Key.)

Even after using the kernel command SysRQ + R, I could not recover the screen. I think something broke, probably logind or gdm :-).

| improve this answer | |
  • I have tried your command, and it started a xinit process on the specified tty8 which then sadly shows the same error message as I have shown in my question above. Thanks stilll – fraleone Nov 28 '19 at 12:07
  • @fraleone thanks for your specific feedback! Please can you edit your question, to show the name and version of the operating system(s) that produces this result. – sourcejedi Nov 28 '19 at 13:26
  • @fraleone If it's a rolling distro, include the version of the package that provides xinit. – sourcejedi Nov 28 '19 at 13:30
  • @fraleone ok! someone says startx might work. If you just ran xinit in a logged-in text VT, does it fail with the same error? Does my command work if you replace xinit xterm -- :8 with sh -c 'chvt 8 && exec startx /usr/bin/xterm' ? – sourcejedi Nov 28 '19 at 17:17
0

by my test, your commands will work well if you put this 2 lines in /etc/X11/Xwrapper.config :

allowed_users=anybody
needs_root_rights=yes

it seems that X server starting is by default allowed only to user that is the owner of target virtual terminal and physically (keyboard) connected to it. (your case: root is vt-owner, and x tried to run as 'mahr').

This two lines overrides that request, and makes even possible starting all from one command, one terminal (useful for init scripts or remote x starting with ssh).

sudo openvt -c15 -- su user -c 'xinit /usr/bin/xterm -display :15 -- :15 vt15'
| improve this answer | |
  • 1
    this one did work – fraleone Nov 29 '19 at 8:57
0

Here is my version of @sourcejedi's answer (sorry, it wouldn't go in a comment):

#!/bin/sh                     
# login-spoof

# Pretend that we're running a command after having logged into a
# given virtual terminal as us. Example:

# $ ./login-spoof 8 startx /usr/bin/xterm -- :1
# Running as unit: run-r3cc564bee3134c789c09c21faee9e710.service
# (opens xterm on /dev/tty8)

TTYNUM=$1; shift
sudo systemd-run \
    --property PAMName=login \
    --property User="$USER" \
    --property StandardInput=tty \
    --property TTYPath=/dev/tty$TTYNUM \
    sh -c 'export PATH="'$PATH'"; chvt '$TTYNUM' && exec "$@"' x "$@"
| improve this answer | |
  • Instead of jumping around quoting like that, you could use env: env "PATH=$PATH" "TTYNUM=$TTYNUM" sh -c 'chvt $TTYNUM && exec "$@"' x "$@". – muru Dec 10 '19 at 6:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.