Bug 83020

Summary:	logind wrapper should not drop privileges if switching to an other VT
Product:	xorg	Reporter:	Laurent Bigonville <bigon>
Component:	Server/General	Assignee:	Xorg Project Team <xorg-team>
Status:	RESOLVED WONTFIX	QA Contact:	Xorg Project Team <xorg-team>
Severity:	major
Priority:	medium	CC:	jwrdegoede
Version:	git
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Laurent Bigonville 2014-08-24 20:43:09 UTC

Hi,

When built with the logind wrapper and with needs_root_rights parameter set to auto, if the user is explicitly asking the server to start on a different VT (ie. startx -- vt2), the wrapper will still drop the privileges and the server will fail to start because it cannot open the virtual console.

Shouldn't the root privileges be preserved in that case?

Also, what should be done if needs_root_rights is explicitly set to no?

Comment 1 Hans de Goede 2014-08-26 07:41:57 UTC

(In reply to comment #0)
> Hi,
> 
> When built with the logind wrapper and with needs_root_rights parameter set
> to auto, if the user is explicitly asking the server to start on a different
> VT (ie. startx -- vt2), the wrapper will still drop the privileges and the
> server will fail to start because it cannot open the virtual console.
> 
> Shouldn't the root privileges be preserved in that case?

No, we don't want unprivileged users to be able to startx on any random tty. Ideally we would be able to never run as root. That is currently not possible, but special cases like this should really only be open to root. Note this might actually still work if the same user who is doing the startx already is logged in on text mode on that console, as then no root rights are necessary (I think, not sure, didn't try). If the user is not logged in and thus does not own that vt, why should X give $random_user rights to claim that vt (which may be owned by another user at that time) ? This used to work in the past as an accidental side effect of X needing root rights, not as something we want by design.

> Also, what should be done if needs_root_rights is explicitly set to no?

Then we never grant root rights (and the admin could go further and even remove /usr/libexec/Xorg.wrap completely).

I believe this should be closed as not a bug. But I'll leave this open for a while for further discussion first.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.