Why is our xorg-server setuid, again?

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

Split off What really is changing in these xorg releases?
_________________
Quis separabit? Quo animo?

EasterParade · l33t Joined: 26 Jul 2003 Posts: 938

I´ m not certain if this is related. Apologies if this is the wrong thread.
The recent upgrade to x11-base/xorg-server-1.20.3 caused X not to start here
on a openrc system with the following error message:
parse_vt_settings Cannot open /dev/tty0 Permission denied.
Had to mask xorg-server-1.20.3 and downgrade to xorg-server-1.19.5-r2 .
Now X starts again.

May be it is about time I switch to systemd. There are a few other issues
where openrc collides with stuff i.e. plasma.

asturm · Developer Joined: 05 Apr 2007 Posts: 8935

Yes it is related, because the default is now non-suid.

Naib · Posted: Sun Nov 04, 2018 10:42 am Post subject:

asturm · Developer Joined: 05 Apr 2007 Posts: 8935

Naib · Posted: Sun Nov 04, 2018 10:57 am Post subject:

asturm · Developer Joined: 05 Apr 2007 Posts: 8935

consolekit predates systemd and only gained logind-style capabilities recently (I have no idea to what extent this is functional, at least it is not drop-in support meaning packages need to get patched), elogind is basically standalone logind ripped out of systemd, for use with traditional init systems. Packages need to be built with either consolekit or elogind or systemd support globally. If you mix, you will run into undefined behavior (which makes the recent addition of elogind/systemd as a dependency of skypeforlinux especially bad).

So yes, in theory if suid-wrapper just needs logind, elogind should be an easy alternative to systemd.

Anon-E-moose · Posted: Sun Nov 04, 2018 11:21 am Post subject:

Naib · Posted: Sun Nov 04, 2018 11:23 am Post subject:

dmpogo · Advocate Joined: 02 Sep 2004 Posts: 3267 Location: Canada

EasterParade · l33t Joined: 26 Jul 2003 Posts: 938

So.... I tried to fix this following the guide Naib pointed me at.
But X would not like to start; error same as before.
I put the new xorg-server back into package.mask and wanted to downgrade when I saw
that even x11-base/xorg-server-1.19.5-r2 had the suid USE flag set as well.

With all due respect but this behaviour is dubious.

I set xorg-server-1.19.5-r2 into package.use as -suid and reemrged stuff yet
X still wouldn´t start because.... reasons.

Is it possible that I have to remove changes for udev and .xinitrc too to get X back up again?

Hu · Moderator Joined: 06 Mar 2007 Posts: 21607

If you use Xorg with USE=+suid, then everything should work, albeit with the security risks associated with running a large and complicated program as root. If you use Xorg with USE=-suid, or install one of the versions that does not have IUSE=suid, then you must complete one of the guides for granting unprivileged Xorg access to the required devices. If you need help, I suggest opening a separate thread (and mentioning it here), showing the specific errors you get, showing the output of emerge -pv x11-base/xorg-server, and describing exactly which steps from which guide(s) you have performed. I also suggest that you upgrade back to the 1.20 series until we determine that it has a relevant regression.

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

Do we know what "turned on" +suid? I haven't touched the suid setting one way or another, it appears to be disabled.

Ah, never mind. It was one of those changes which are allowed without an ebuild revision.

*sigh*

Is there a way to mask that kind of thing?

asturm · Developer Joined: 05 Apr 2007 Posts: 8935

It's a USE flag, just disable it? PS: It was enabled all the way up to the recent 1.20 release, then re-added because of too many bug reports.

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

I was thinking "changes to ebuilds which don't get a revision bump."

Masking the USE flag doesn't seem to help. If I make no changes:

asturm · Developer Joined: 05 Apr 2007 Posts: 8935

Pardon my ignorance, but `emerge -vp xorg-server` will always make you rebuild. But if it is bumped... you'll have to "re-" build as well?

EasterParade · l33t Joined: 26 Jul 2003 Posts: 938

Gonna start what Dr. Hu recommended tomorrow. This is really annoying.
I mean really really annoying.

Ant P. · Watchman Joined: 18 Apr 2009 Posts: 6920

Maybe instead of a USE flag it should be a pkg_config. Ask the user if they want a plain unprivileged binary for service managers, setgid tty for startx users, or a setuid root for... whatever. People who refuse to give their account input device access at all?

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

asturm · Developer Joined: 05 Apr 2007 Posts: 8935

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

I'll have to assume it was -N. With or without -N now, it doesn't show up. I had updated zlib, libxml2, and harfbuzz for unrelated USE flags changes (icu & minizip), so maybe they were also somehow triggering a rebuld of xorg-server. I've been trying to break an old habit of using -N. Thanks for the help.
_________________
Quis separabit? Quo animo?

EasterParade · l33t Joined: 26 Jul 2003 Posts: 938

I used the wiki. Got it working now after rolled everything back and repeated the changes.
I also used startx -- vt1 and got X back up.

Gonna keep OpenRC for now. Thanks.

Marcih · Apprentice Joined: 19 Feb 2018 Posts: 213

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

Anon-E-moose · Posted: Sun Nov 11, 2018 9:53 pm Post subject:

They should have left the whole suid thing alone, those who didn't want to run it suid, already knew how to do it or could find out easily.

If they had to do anything, then a news item triggered off on having xorg-server emerged would have sufficed, or put a warning at the beginning or end of the ebuild.

They created more trouble than it's worth, with the hokey-pokey, put it in, take it out, shake it all about, and then to top it off not changing the ebuild with an -rN.
_________________
PRIME x570-pro, 3700x, 6.1 zen kernel
gcc 13, profile 17.0 (custom bare multilib), openrc, wayland