User avatar
dotsdan
Posts: 16
Joined: Thu Feb 21, 2013 2:50 pm

Running X11 apps as root

Wed Aug 28, 2013 1:04 am

Good evening,

I currently am chasing after a problem I can not solve without using commands that are foreign to me. Anyone with experience of using X11 forwarding over SSH protocol would be a lot of help here. When using an application with sudo (i.e. sudo emacs) I get this message spit back at me "Display localhost:10.0 unavailable". Basically I can not run applications using sudo, while I can without it.

Now I did poke around a bit and found a solution where running application with and without sudo was okay. However, I just do not understand what I'm telling my raspberry pi to do. When I use this follow command at the end of my visudo file sudo begins to work and I can edit files in /var/www/ with emacs, but I do not know what I have done:

Code: Select all

Defaults env_keep += "HOME"
In the world of Linux I understand there are many solution to one problem. How about those "MIT-MAGIC-COOKIES" I see when I run this command?:

Code: Select all

xauth list
I entered the follow hash code into my SSH client under MIT-Magic-cookie field, however using sudo to get my root privileges still did not work. I am familiar with SSH public/private key pairs, is the magic cookie something similar? I want a solution that I can be confident in what I am doing is correct, secure, and efficient.

Thanks,
Daniel.

User avatar
redhawk
Posts: 3465
Joined: Sun Mar 04, 2012 2:13 pm
Location: ::1

Re: Running X11 apps as root

Wed Aug 28, 2013 9:32 am

If your computer's IP address is 192.168.1.100 then the following command should fix this (unless you reboot):
export DISPLAY=192.168.1.100:0.0

Richard S.

User avatar
AndrewS
Posts: 3625
Joined: Sun Apr 22, 2012 4:50 pm
Location: Cambridge, UK
Contact: Website

Re: Running X11 apps as root

Wed Aug 28, 2013 11:16 am

https://duckduckgo.com/html/?q=ssh+x11+forwarding+sudo has lots of info.

I've just had a play, and if I login with ssh X11 forwarding:

Code: Select all

leafpad
works fine

Code: Select all

sudo leafpad
displays an error about authentication

Code: Select all

sudo XAUTHORITY=$HOME/.Xauthority leafpad
works fine

User avatar
jojopi
Posts: 3042
Joined: Tue Oct 11, 2011 8:38 pm

Re: Running X11 apps as root

Wed Aug 28, 2013 12:24 pm

An MIT-MAGIC-COOKIE is a security token that an X11 client application must possess in order to be allowed to connect to the display server. This is to stop other users on the machine from connecting malicious clients to your display, snooping your keyboard and windows. Your cookies are stored in the file $HOME/.Xauthority.

(These days, direct X11 connections over the network are not allowed; they must be tunnelled by SSH. You do not need to copy magic cookies between machines. SSH creates a fake local display, localhost:10.0, with a fake cookie, and writes it into .Xauthority. When a client connects, SSH checks its local cookie, forwards the connection over the secure tunnel, and then connects to the real display using the real cookie.)

sudo normally starts processes with a clean environment for the target user (Defaults env_reset), instead of passing your environment variables. That means HOME=/root instead of HOME=/home/pi. An X11 client run under sudo will look in the wrong place for the .Xauthority file, and will not find the cookie necessary to connect to your ssh-tunnelled display.

Adding HOME to env_keep means that the variable will not be reset when sudo starts a privileged process. This does increase the risk that files owned by root will be written into /home/pi.

You can also override variables for individual commands:

Code: Select all

sudo HOME=~ xclient
sudo XAUTHORITY=~/.Xauthority xclient
gksu xclient
The first tells sudo to pass HOME=/home/pi. The second passes HOME=/root, but tells the client where to find the correct cookies. gksu is a front end for su and sudo that specifically supports launching GUI applications.

All of these solutions depend on the fact that root can read pi's .Xauthority file. In general if you want to start a client as another user you will have permissions problems as well.

Ideally, you should not run GUI applications as root. They are usually not intended for system administration and may not be safe when you give them write access to everything.

User avatar
AndrewS
Posts: 3625
Joined: Sun Apr 22, 2012 4:50 pm
Location: Cambridge, UK
Contact: Website

Re: Running X11 apps as root

Wed Aug 28, 2013 1:02 pm

jojopi wrote:This is to stop other users on the machine from connecting malicious clients to your display, snooping your keyboard and windows. (These days, direct X11 connections over the network are not allowed; they must be tunnelled by SSH)
Heheh, I remember when I was at Uni (mid 90s), much fun was had by popping up random X client windows on other users' $DISPLAY s :lol:

User avatar
dotsdan
Posts: 16
Joined: Thu Feb 21, 2013 2:50 pm

Re: Running X11 apps as root

Wed Aug 28, 2013 4:50 pm

I am filled with joy to know I now have root powers back in X11. The only problem now is I loose my Emacs customized theme now, how come?

Return to “Advanced users”