2

Here is my situation:

I have two (sudo) users on a machine:

  1. userA (created first on the machine. This is also where display :0 is attached)
  2. userB (created later)

Being on userA I do:

export DISPLAY=:0.0
xclock

And the clock opens on DISPLAY:0 as intended.

Now, I want the same steps to work on userB. But unfortunately, it shows:

No protocol specified
xhost:  unable to open display ":0.0"

What I tried:

  1. Creating a trusted xauth key using: xauth generate :0.0 . trusted which again shows unable to open display ":0.0"
  2. Copying the /home/userA/.Xauthority to /home/userB/.Xauthority. (Note: I did not see any key pertaining to display :0 in the userA xauth list, even though it works.)
  3. Creating trusted xauth key for :0 on userA and copying that key to userB.

None of these worked.

What worked:

  1. I log-in to userA. I export DISPLAY=:0.0 and then xhost + to enable access from all clients.
  2. I log back in to userB. I export DISPLAY=:0.0 and then xclock.

I want to eliminate Step 1. I do NOT want to log-in to userA each time. And I did try to xhost + from userB, which shows error already shown above.

How can I run xhost + from userB, while also making it think it has the DISPLAY:0 access?

Edit: As mentioned by @user414777, I was able to:

# On userA
$ xhost +si:localuser:userB

# On userB
$ export DISPLAY=:0.0 ; xclock

And make it work. But these changes don't stay post-reboot.

# After rebooting, on userB
$ export DISPLAY=:0.0 ; xclock
Invalid MIT-MAGIC-COOKIE-1 keyError: Can't open display: :0.0

I'm running Ubuntu 18.04 LTS, 4.18.0-15-generic

SOLVED

I eventually went with a slightly insecure and modified suggestion by @user414777. Instead of adding the change in ~/.xsession or Xsession.d, I added that line in /etc/profile, which applies the change for all users.

1 Answer 1

0

On most "modern" Linux systems, you can do just:

xhost +si:localuser:userB

running as userA (the one who already has access to the display), then userB will be able to connect (if she sets the correct DISPLAY environment variable or uses the correct -display or --display command line options).

That's quite insecure, but (at least on Debian) it's the only thing supported by Xwayland, and they're already forcing it even with the regular Xorg.


The regular way, already mentioned in the xauth(1) manpage, and in many answers here and elsewhere, is:

xauth extract - "$DISPLAY" | ssh userB@localhost xauth merge -

but on my system, that only works with Xorg, not with Xwayland. With the command above, you can use su or sudo instead of ssh, or you can do it in two steps, etc.

9
  • This is what I get: localuser:userB being added to access control list X Error of failed request: BadValue (integer parameter out of range for operation) Major opcode of failed request: 109 (X_ChangeHosts) Value in failed request: 0xe Serial number of failed request: 7 Current serial number in output stream: 9
    – Karan Shah
    Oct 8, 2020 at 6:09
  • Have you run the xhost +si:localuser:userB as userA? If that still doesn't work, try removing/moving away any ~/.Xauthority from userB's home directory, then try again, and also with the old xauth extract ... | xauth merge method.
    – user313992
    Oct 8, 2020 at 6:15
  • If you don't want to log in as userA to run those commands, you can put them in some initialization script (e.g. ~/.xsession, assuming that your system sources it).
    – user313992
    Oct 8, 2020 at 6:27
  • Yes, I ran that command from userA and got the error. I also tried removing old .Xauth extracting and merge keys from userA to userB, which executes, but I still get same error: Invalid MIT-MAGIC-COOKIE-1 keyError: Can't open display: :0.0 on running xclock on userB
    – Karan Shah
    Oct 8, 2020 at 6:41
  • The only thing that comes to my mind is that userAs DISPLAY is not :0 when you're running those commands. Also, add more info (edit it in your question) about your exact system, distro, etc.
    – user313992
    Oct 8, 2020 at 6:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .