xserver-xorg-legacy in ascii

fsmithred · 2017-09-12 11:18:07

To get X to work in ascii and beyond...

1. Install xserver-xorg-legacy (This might be all you need to do.)

2. (maybe)
If you don't use a display manager (like slim or lightdm) and want to use 'startx' to get a graphical session, you'll need to run this command once (or edit the file manually)

echo "needs_root_rights=yes" >> /etc/X11/Xwrapper.config

3. (you tell me. I predict there will be more needed in the future.)

hunger · 2017-09-12 12:05:59

The second step will cause the X server to be started as root, which is a really bad idea(TM). The first step might already do that (since Xwrapper defaults to "auto").

https://media.ccc.de/v/30C3_-_5499_-_en … n_sprundel has an introduction to X server security.

korgull · 2017-09-14 08:20:16

Well, the display manager also launches Xorg as root:

root      2109  1.7  1.2 469952 99548 tty7     Ssl+ 07:52   2:31 /usr/lib/xorg/Xorg -nolisten tcp -auth /var/run/slim.auth vt07

Or am I wrong?

Btw: Is it intrinsic to systemd to run Xorg as user?

Is there any other solution as of now?

Last edited by korgull (2017-09-14 08:22:10)

fsmithred · 2017-09-14 11:46:15

Yes, X has been running as root forever, and that only changed with stretch. I don't know the details of how systemd works with that, but the dependence of xorg on systemd also appeared with stretch. According to the linked video, the solution is to switch to wayland. (That's an over-simplified explanation. In fact, a lot of bugs have been fixed as a result of that guy's work.)

miroR · 2017-09-18 23:08:50

fsmithred wrote:

Yes, X has been running as root forever, and that only changed with stretch. I don't know the details of how systemd works with that, but the dependence of xorg on systemd also appeared with stretch.
...

The one and the other change not be of the kind to put together as similar (not saying that you are doing so).
The change with Xorg is praisewothy (but probably came to be because the exploits went mad on Xorg...), the other change is sad as can be...
fsmithred, I just sent an email to dng mailing list (and to a few Devauners of the thread on Xorg, one of them being you).
And then I see this documentation post...
Good! Let's wait and see if my email to DNG ML appears at:
...
Gosh! It appeared! Phew! Feeling muuuch better now !
Here:

Subject: Re: [DNG] upgrade from Debian stretch to Devuan ascii?
https://lists.dyne.org/lurker/message/2 … f1.en.html

Readers here, take note that it is absolutely best for security of your Devuan boxen if you manage to use Xorg the new way, not as root!

Happy !

Last edited by miroR (2017-09-18 23:09:23)

thierrybo · 2018-01-25 22:36:42

Yes,

as I came also myself in xinit not running on a minimal install without systemd, policykit and consolekit, it turns out that xserver-xorg-legacy was build specifically for "legacy" debian setups without systemd :

xorg-server (2:1.17.3-1) unstable; urgency=medium
The Xorg server is no longer setuid root by default. This change reduces the
risk of privilege escalation due to X server bugs, but has some side effects:
* it relies on logind and libpam-systemd
* it relies on a kernel video driver (so the userspace component doesn't
touch the hardware directly) -> kernel mode setting (KMS)
* it needs X to run on the virtual console (VT) it was started from
* it changes the location for storing the Xorg log from /var/log/ to
~/.local/share/xorg/
On systems where those are not available, the new xserver-xorg-legacy package
is needed to allow X to run with elevated privileges. See the
Xwrapper.config(5) manual page for configuration details.
-- Julien Cristau <jcristau@debian.org> Tue, 27 Oct 2015 22:54:11 +0000

mmaglis · 2018-03-16 18:55:38

I am running Devuan ASCII. I had the xserver-xorg-legacy installed so far, but decided to remove it and see if things work without it.

They do! I startx from console as normal user. xinit & Xorg run as normal user.
No elogind, no polkit, no dbus here.
No issue.

I have not tried it with a display manager (e.g. slim) yet.
Have things changed recently?

fsmithred · 2018-03-17 13:17:12

Obviously, something has changed. I can confirm that it now works. I had to do a few things to get it to work...

- removed xserver-xorg-legacy
- disbled my display manager (lxdm)
- tried startx, it wouldn't start.

- added elogind
- still wouldn't start.

-tried it with lxdm. xorg and lxdm are running as root.

- added libpolkit-gobject-1-0-elogind and libpolkit-backend-1-0-elogind, which also pulled in libpam-elogind.
- startx works, and everything is running as user.

- tried it with lxdm again. xorg and lxdm run as root.
- tried it with lightdm. xorg and lightdm run as root.

fsmithred · 2018-03-17 20:41:57

- tried it again after removing the packages I installed. It stopped working.
- tried if after removing dbus. Didn't work.

- installed libpam-elogind, which pulled in elogind, dbus, and something else, but not the libpolkit libraries. It works again.

mmaglis · 2018-03-18 08:26:32

I cannot recall in which order I have purged various packages.
I do know xserver-xorg-legacy was purged last.
I do not think the order is important though.

I startx from console as a normal user.
xinit and Xorg processes run with that normal user.
I have currently the below packages installed; no polkit, no logind, only libdbus:

- libpam0g
- libpam-runtime
- libpam-modules
- libpam-modules-bin
- xorg
- xserver-xorg
- xserver-xorg-core
- xserver-xorg-input-libinput
- xserver-xorg-input-void
- xserver-xorg-video-dummy
- xserver-xorg-video-intel
- xserver-xorg-video-vesa
- x11-xserver-utils
- xserver-common
- login
- eudev
- libdbus-1-3

My apt sources.list point to ASCII:

# Devuan repositories
deb https://pkgmaster.devuan.org/merged ascii main
deb https://pkgmaster.devuan.org/merged ascii-updates main
deb https://pkgmaster.devuan.org/merged ascii-security main
deb https://pkgmaster.devuan.org/merged ascii-backports main

devuser · 2018-05-01 12:05:50

Oh, so there is already a post concerning this mess. So i guess the best way to deal with this is to follow the steps fsmithred posted?

By the way there is this interesting snipped i stumbled upon at https://bugs.debian.org/cgi-bin/bugrepo … bug=814394

Julien Cristau on 2016/02/13 +0100 @11:30:30:
> > startx does not longer work after upgrade; `grep EE
> > Xorg.log' shows:
> >
> > [ 1463.840] (EE) systemd-logind: failed to get
> > session: The name org.freedesktop.login1 was not
> > provided by any .service files
>
> X requires logind ...
It's not supposed to, when using the X wrapper and
needs_root_rights=yes. There used to be an upstream patch that
even allowed X to start without this, and skip the ioperm check
(it's not actually needed with KMS), which Debian dropped,
because I guess they want to require everyone to use systemd.

The officially official Devuan Forum!

#1 2017-09-12 11:18:07

xserver-xorg-legacy in ascii

#2 2017-09-12 12:05:59

Re: xserver-xorg-legacy in ascii

#3 2017-09-14 08:20:16

Re: xserver-xorg-legacy in ascii

#4 2017-09-14 11:46:15

Re: xserver-xorg-legacy in ascii

#5 2017-09-18 23:08:50

Re: xserver-xorg-legacy in ascii

#6 2018-01-25 22:36:42

Re: xserver-xorg-legacy in ascii

#7 2018-03-16 18:55:38

Re: xserver-xorg-legacy in ascii

#8 2018-03-17 13:17:12

Re: xserver-xorg-legacy in ascii

#9 2018-03-17 20:41:57

Re: xserver-xorg-legacy in ascii

#10 2018-03-18 08:26:32

Re: xserver-xorg-legacy in ascii

#11 2018-05-01 12:05:50

Re: xserver-xorg-legacy in ascii

Board footer