[gentoo-user] Permissions error on starting X.

[gentoo-user] Permissions error on starting X.

[Alan Mackenzie]

Hello, Gentoo.

HEADS UP!!!

If you start your X server from the command line with, e.g. startx, you
now need to set the new(?) suid USE flag for the xorg-server package.

This flag causes the binary to be installed with the setuid file flag,
which causes it to run as root.

The developers, in this instance, failed to raise the ebuild's version
number from 1.20.3 when making this change, and also didn't notify users
by a NEWS item, that I can see.

The matter was fairly intensively discussed in bug #669648 in Gentoo's
bugzilla.

So - if you get a permissions error whilst trying to start X, setting
the suid USE flag may well be the solution.

-- 
Alan Mackenzie (Nuremberg, Germany).

Re: [gentoo-user] Permissions error on starting X.

[Rich Freeman]

On Sat, Nov 3, 2018 at 10:01 AM Alan Mackenzie <acm@muc.de> wrote:
>
>
> If you start your X server from the command line with, e.g. startx, you
> now need to set the new(?) suid USE flag for the xorg-server package.
>

Sometimes. I thought this was only required if you're not using KMS.
Is this not the case?

The argument for defaulting it is that you had to both be using a
non-KMS driver, and you had to be running from the command line.  That
is a somewhat uncommon situation.

> The developers, in this instance, failed to raise the ebuild's version
> number from 1.20.3 when making this change, and also didn't notify users
> by a NEWS item, that I can see.

A news item would probably have been a good idea (it almost always
is).  I'm not sure why the ebuild wasn't revisioned.  As far as I can
tell this change does change what gets installed on-disk, and as a
result it is almost always appropriate to revision the ebuild (in this
case to -r1).  The only sorts of changes that generally don't justify
revisioning would be fixes to build systems that don't actually impact
what gets installed (assuming the old version built at all), and which
don't change any dependencies.  In that case there isn't really a
benefit to users to do a rebuild, since the new build will be
identical to the old.

> So - if you get a permissions error whilst trying to start X, setting
> the suid USE flag may well be the solution.

Yup.

-- 
Rich

Re: [gentoo-user] Permissions error on starting X.

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 436 bytes --]

On Sat, 3 Nov 2018 14:01:51 +0000, Alan Mackenzie wrote:

> So - if you get a permissions error whilst trying to start X, setting
> the suid USE flag may well be the solution.

Alternatively, create /etc/X11/X11/Xwrapper.config containing:

allowed_users = anybody
needs_root_rights = yes


-- 
Neil Bothwick

If the bank returns your cheque marked "Insufficient Funds," call them
 and ask if they mean you or them. :-)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Permissions error on starting X.

[Alarig Le Lay]

Hi,

On sam.  3 nov. 23:17:24 2018, Neil Bothwick wrote:
> On Sat, 3 Nov 2018 14:01:51 +0000, Alan Mackenzie wrote:
> 
> > So - if you get a permissions error whilst trying to start X, setting
> > the suid USE flag may well be the solution.
> 
> Alternatively, create /etc/X11/X11/Xwrapper.config containing:
> 
> allowed_users = anybody
> needs_root_rights = yes

I run the Xorg without root rights since years on my laptop, I followed
https://wiki.gentoo.org/wiki/Non_root_Xorg and it works.

-- 
Alarig

[gentoo-user] Re: Permissions error on starting X.

[Nikos Chantziaras]

On 03/11/2018 16:01, Alan Mackenzie wrote:
> The developers, in this instance, failed to raise the ebuild's version
> number from 1.20.3 when making this change, and also didn't notify users
> by a NEWS item, that I can see.

Emerge will catch this, no need for revbump. Unless you're not using -D 
(--deep) when updating world. Which you should.

Re: [gentoo-user] Re: Permissions error on starting X.

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 589 bytes --]

On Sun, 4 Nov 2018 03:11:45 +0200, Nikos Chantziaras wrote:

> > The developers, in this instance, failed to raise the ebuild's version
> > number from 1.20.3 when making this change, and also didn't notify
> > users by a NEWS item, that I can see.  
> 
> Emerge will catch this, no need for revbump. Unless you're not using -D 
> (--deep) when updating world. Which you should.

It didn't on my MythTV frontend, which runs X as the mythtv user, as
xorg-server builds with -suid by default.


-- 
Neil Bothwick

Every time I jump on the bandwagon all its wheels fall off.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Re: Permissions error on starting X.

[Daniel Frey]

On 11/04/18 02:22, Neil Bothwick wrote:
> On Sun, 4 Nov 2018 03:11:45 +0200, Nikos Chantziaras wrote:
> 
>>> The developers, in this instance, failed to raise the ebuild's version
>>> number from 1.20.3 when making this change, and also didn't notify
>>> users by a NEWS item, that I can see.  
>>
>> Emerge will catch this, no need for revbump. Unless you're not using -D 
>> (--deep) when updating world. Which you should.
> 
> It didn't on my MythTV frontend, which runs X as the mythtv user, as
> xorg-server builds with -suid by default.
> 
> 

It didn't on my MythTV frontend either, I had to manually add "suid" to
package.use for it to start working again.

Dan

[gentoo-user] Re: Permissions error on starting X.

[Grant Edwards]

On 2018-11-04, Nikos Chantziaras <realnc@gmail.com> wrote:
> On 03/11/2018 16:01, Alan Mackenzie wrote:
>> The developers, in this instance, failed to raise the ebuild's version
>> number from 1.20.3 when making this change, and also didn't notify users
>> by a NEWS item, that I can see.
>
> Emerge will catch this, no need for revbump. Unless you're not using -D 
> (--deep) when updating world. Which you should.

What do you mean "catch this"?

I always use -D, and the change broke my system.

-- 
Grant Edwards               grant.b.edwards        Yow! Why is everything made
                                  at               of Lycra Spandex?
                              gmail.com            

[gentoo-user] Re: Permissions error on starting X.

[Nikos Chantziaras]

On 05/11/2018 17:30, Grant Edwards wrote:
> On 2018-11-04, Nikos Chantziaras <realnc@gmail.com> wrote:
>> On 03/11/2018 16:01, Alan Mackenzie wrote:
>>> The developers, in this instance, failed to raise the ebuild's version
>>> number from 1.20.3 when making this change, and also didn't notify users
>>> by a NEWS item, that I can see.
>>
>> Emerge will catch this, no need for revbump. Unless you're not using -D
>> (--deep) when updating world. Which you should.
> 
> What do you mean "catch this"?
> 
> I always use -D, and the change broke my system.

I mean that a USE flag change will trigger a rebuild of the package, and 
the USE flag in question is shown by portage. So you'll know something 
has changed. If you went ahead and allowed it to rebuild, it would of 
course break xorg, but you'd know why since you've seen the USE flag 
change and know that the breakage most probably had something to do with 
that USE flag.

Re: [gentoo-user] Re: Permissions error on starting X.

[Rich Freeman]

On Mon, Nov 5, 2018 at 11:27 AM Nikos Chantziaras <realnc@gmail.com> wrote:
>
> On 05/11/2018 17:30, Grant Edwards wrote:
> > On 2018-11-04, Nikos Chantziaras <realnc@gmail.com> wrote:
> >> On 03/11/2018 16:01, Alan Mackenzie wrote:
> >>> The developers, in this instance, failed to raise the ebuild's version
> >>> number from 1.20.3 when making this change, and also didn't notify users
> >>> by a NEWS item, that I can see.
> >>
> >> Emerge will catch this, no need for revbump. Unless you're not using -D
> >> (--deep) when updating world. Which you should.
> >
> > What do you mean "catch this"?
> >
> > I always use -D, and the change broke my system.
>
> I mean that a USE flag change will trigger a rebuild of the package

-D will not cause USE flag changes to trigger a rebuild of a package.

You're thinking of --newuse in this particular case.  I'm not sure if
--changed-use would cause a rebuild if the previous flag was defaulted
to enabled and not explicitly enabled (of course, if it were
explicitly enabled you wouldn't have run into this issue).

-- 
Rich

[gentoo-user] Re: Permissions error on starting X.

[Nikos Chantziaras]

On 05/11/2018 18:35, Rich Freeman wrote:
> On Mon, Nov 5, 2018 at 11:27 AM Nikos Chantziaras <realnc@gmail.com> wrote:
>>
>> On 05/11/2018 17:30, Grant Edwards wrote:
>>> On 2018-11-04, Nikos Chantziaras <realnc@gmail.com> wrote:
>>>> On 03/11/2018 16:01, Alan Mackenzie wrote:
>>>>> The developers, in this instance, failed to raise the ebuild's version
>>>>> number from 1.20.3 when making this change, and also didn't notify users
>>>>> by a NEWS item, that I can see.
>>>>
>>>> Emerge will catch this, no need for revbump. Unless you're not using -D
>>>> (--deep) when updating world. Which you should.
>>>
>>> What do you mean "catch this"?
>>>
>>> I always use -D, and the change broke my system.
>>
>> I mean that a USE flag change will trigger a rebuild of the package
> 
> -D will not cause USE flag changes to trigger a rebuild of a package.
> 
> You're thinking of --newuse in this particular case. 

Oops, yes. I meant -N (--newuse). Not -D. Got confused. I always upgrade 
using:

emerge -auDN --changed-deps @world

The "N" was the important flag here, not the "D".

Re: [gentoo-user] Permissions error on starting X.

[Daniel Frey]

On 11/03/18 07:01, Alan Mackenzie wrote:
> Hello, Gentoo.
> 
> HEADS UP!!!
> 
> If you start your X server from the command line with, e.g. startx, you
> now need to set the new(?) suid USE flag for the xorg-server package.
> 
> This flag causes the binary to be installed with the setuid file flag,
> which causes it to run as root.
> 
> The developers, in this instance, failed to raise the ebuild's version
> number from 1.20.3 when making this change, and also didn't notify users
> by a NEWS item, that I can see.
> 
> The matter was fairly intensively discussed in bug #669648 in Gentoo's
> bugzilla.
> 
> So - if you get a permissions error whilst trying to start X, setting
> the suid USE flag may well be the solution.
> 

I just got hit by this on my mythtv backend, which I only start X to
configure the mythtv backend.

Yes, enabling the suid USE-flag fixed it (or restored original behaviour?)

Dan

Re: [gentoo-user] Permissions error on starting X.

[tuxic]

On 11/03 11:20, Daniel Frey wrote:
> On 11/03/18 07:01, Alan Mackenzie wrote:
> > Hello, Gentoo.
> > 
> > HEADS UP!!!
> > 
> > If you start your X server from the command line with, e.g. startx, you
> > now need to set the new(?) suid USE flag for the xorg-server package.
> > 
> > This flag causes the binary to be installed with the setuid file flag,
> > which causes it to run as root.
> > 
> > The developers, in this instance, failed to raise the ebuild's version
> > number from 1.20.3 when making this change, and also didn't notify users
> > by a NEWS item, that I can see.
> > 
> > The matter was fairly intensively discussed in bug #669648 in Gentoo's
> > bugzilla.
> > 
> > So - if you get a permissions error whilst trying to start X, setting
> > the suid USE flag may well be the solution.
> > 
> 
> I just got hit by this on my mythtv backend, which I only start X to
> configure the mythtv backend.
> 
> Yes, enabling the suid USE-flag fixed it (or restored original behaviour?)
> 
> Dan
> 

Hi,

is this already known?
https://twitter.com/hackerfantastic/status/1055517801224396800

Is it safe to run X.org suid set?

Cheers
Meino

Re: [gentoo-user] Permissions error on starting X.

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 320 bytes --]

On Sun, 4 Nov 2018 19:33:18 +0100, tuxic@posteo.de wrote:

> Is it safe to run X.org suid set?

Why take a chance when it is unnecessary?


-- 
Neil Bothwick

I am ready to meet my Maker. Whether my Maker is prepared for the great
ordeal of meeting me is another matter. - Sir Winston Churchill
(1874-1965)

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Permissions error on starting X.

[tuxic]

On 11/04 07:18, Neil Bothwick wrote:
> On Sun, 4 Nov 2018 19:33:18 +0100, tuxic@posteo.de wrote:
> 
> > Is it safe to run X.org suid set?
> 
> Why take a chance when it is unnecessary?
> 
> 
> -- 
> Neil Bothwick
> 
> I am ready to meet my Maker. Whether my Maker is prepared for the great
> ordeal of meeting me is another matter. - Sir Winston Churchill
> (1874-1965)

...not answering my question, sorry.

Meino

Re: [gentoo-user] Permissions error on starting X.

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 511 bytes --]

On Mon, 5 Nov 2018 05:06:13 +0100, tuxic@posteo.de wrote:

> > > Is it safe to run X.org suid set?  
> > 
> > Why take a chance when it is unnecessary?

> ...not answering my question, sorry.

It's not, it's saying that if you are concerned about using suid (and you
should always think about that) you may prefer to know that there is no
need to do it in this case, as I posted earlier.


-- 
Neil Bothwick

You are about to give someone a piece of your mind,
something you can ill afford...

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] Permissions error on starting X.

[Daniel Frey]

On 11/04/18 10:33, tuxic@posteo.de wrote:
> 
> 
> 
> 
> On 11/03 11:20, Daniel Frey wrote:
>> On 11/03/18 07:01, Alan Mackenzie wrote:
>>> Hello, Gentoo.
>>>
>>> HEADS UP!!!
>>>
>>> If you start your X server from the command line with, e.g. startx, you
>>> now need to set the new(?) suid USE flag for the xorg-server package.
>>>
>>> This flag causes the binary to be installed with the setuid file flag,
>>> which causes it to run as root.
>>>
>>> The developers, in this instance, failed to raise the ebuild's version
>>> number from 1.20.3 when making this change, and also didn't notify users
>>> by a NEWS item, that I can see.
>>>
>>> The matter was fairly intensively discussed in bug #669648 in Gentoo's
>>> bugzilla.
>>>
>>> So - if you get a permissions error whilst trying to start X, setting
>>> the suid USE flag may well be the solution.
>>>
>>
>> I just got hit by this on my mythtv backend, which I only start X to
>> configure the mythtv backend.
>>
>> Yes, enabling the suid USE-flag fixed it (or restored original behaviour?)
>>
>> Dan
>>
> 
> Hi,
> 
> is this already known?
> https://twitter.com/hackerfantastic/status/1055517801224396800
> 
> Is it safe to run X.org suid set?
> 
> Cheers
> Meino
> 
> 
> 
> 

Even if you run X as a non-root user it's possible to snoop on the
keyboard/mouse input of a different user. So... pick your vulnerability.

I stuck with the way it's been working for years and years. However,
these systems do not have web access or anything like that, they're
mythtv appliances.

Dan

[gentoo-user] Re: Permissions error on starting X.

[Grant Edwards]

On 2018-11-03, Alan Mackenzie <acm@muc.de> wrote:
> Hello, Gentoo.
>
> HEADS UP!!!
>
> If you start your X server from the command line with, e.g. startx, you
> now need to set the new(?) suid USE flag for the xorg-server package.

Yep, I tripped over this yesterday, when all of a sudden I couldn't
start X anymore.  Thanks for the advanced notice on that one!

> The developers, in this instance, failed to raise the ebuild's version
> number from 1.20.3 when making this change, and also didn't notify users
> by a NEWS item, that I can see.

Yea, that seems like a major foul-up to me.  I had to log in as root
so that I could start X, so that I could use google to try to figure
out what went wrong.

-- 
Grant Edwards               grant.b.edwards        Yow! My LESLIE GORE record
                                  at               is BROKEN ...
                              gmail.com            

Re: [gentoo-user] Permissions error on starting X.

[YUE Daian]

On 2018-11-03 14:01, Alan Mackenzie <acm@muc.de> wrote:
> Hello, Gentoo.
>
> HEADS UP!!!
>
> If you start your X server from the command line with, e.g. startx, you
> now need to set the new(?) suid USE flag for the xorg-server package.
>
> This flag causes the binary to be installed with the setuid file flag,
> which causes it to run as root.
>
> The developers, in this instance, failed to raise the ebuild's version
> number from 1.20.3 when making this change, and also didn't notify users
> by a NEWS item, that I can see.
>
> The matter was fairly intensively discussed in bug #669648 in Gentoo's
> bugzilla.
>
> So - if you get a permissions error whilst trying to start X, setting
> the suid USE flag may well be the solution.
>
> -- 
> Alan Mackenzie (Nuremberg, Germany).

I got the same problem yesterday.

My setup was startx + StumpWM.

I got "setblabla error: cannot open /dev/tty0 (permission denied)".

A possible solution without changing anything unnecessary is to run
startx as "startx -- vt1".

No need to change permission/ownership of anything.
It is just required that the user is in "video" group. No "tty" or
"input" needed.

I presume it is because your user does not have access to TTY other than
its login TTY. So if you log in by "tty1", just start X in "vt1".

Hope that helps somehow.

Danny

Re: [gentoo-user] Permissions error on starting X.

[Hervé Guillemet]

Le 07/11/2018 à 04:59, YUE Daian a écrit :

> 
> I got "setblabla error: cannot open /dev/tty0 (permission denied)".
> 
> A possible solution without changing anything unnecessary is to run
> startx as "startx -- vt1".
> 
> No need to change permission/ownership of anything.
> It is just required that the user is in "video" group. No "tty" or
> "input" needed.
> 
> I presume it is because your user does not have access to TTY other than
> its login TTY. So if you log in by "tty1", just start X in "vt1".
> 
> Hope that helps somehow.

Thanks for this tip. This worked for me but adding the user to "input" 
group was also necessary.

-- 
Hervé

Re: [gentoo-user] Permissions error on starting X.

[gevisz]

пт, 9 нояб. 2018 г. в 2:20, Hervé Guillemet <hg@apteryx.fr>:
>
> Le 07/11/2018 à 04:59, YUE Daian a écrit :
>
> >
> > I got "setblabla error: cannot open /dev/tty0 (permission denied)".
> >
> > A possible solution without changing anything unnecessary is to run
> > startx as "startx -- vt1".
> >
> > No need to change permission/ownership of anything.
> > It is just required that the user is in "video" group. No "tty" or
> > "input" needed.
> >
> > I presume it is because your user does not have access to TTY other than
> > its login TTY. So if you log in by "tty1", just start X in "vt1".
> >
> > Hope that helps somehow.
>
> Thanks for this tip. This worked for me but adding the user to "input"
> group was also necessary.

Have you tried the alternative method described here:
https://wiki.gentoo.org/wiki/Non_root_Xorg

Re: [gentoo-user] Permissions error on starting X.

[YUE Daian]

On 2018-11-09 10:49, gevisz <gevisz@gmail.com> wrote:
> пт, 9 нояб. 2018 г. в 2:20, Hervé Guillemet <hg@apteryx.fr>:
>>
>> Le 07/11/2018 à 04:59, YUE Daian a écrit :
>>
>> >
>> > I got "setblabla error: cannot open /dev/tty0 (permission denied)".
>> >
>> > A possible solution without changing anything unnecessary is to run
>> > startx as "startx -- vt1".
>> >
>> > No need to change permission/ownership of anything.
>> > It is just required that the user is in "video" group. No "tty" or
>> > "input" needed.
>> >
>> > I presume it is because your user does not have access to TTY other than
>> > its login TTY. So if you log in by "tty1", just start X in "vt1".
>> >
>> > Hope that helps somehow.
>>
>> Thanks for this tip. This worked for me but adding the user to "input"
>> group was also necessary.
>
> Have you tried the alternative method described here:
> https://wiki.gentoo.org/wiki/Non_root_Xorg

Nope. It seems that the method I mentioned was somehow the first method
described in the Wiki.

I am wondering what are the differences between the two? Which one is
better?

Re: [gentoo-user] Permissions error on starting X.

[Hervé Guillemet]

>> Have you tried the alternative method described here:
>> https://wiki.gentoo.org/wiki/Non_root_Xorg
> 
> Nope. It seems that the method I mentioned was somehow the first method
> described in the Wiki.
> 
> I am wondering what are the differences between the two? Which one is
> better?
> 

The alternative method is definitly more secure for systems with 
multiple user accounts. I believe the xorg ebuild should install the 
binary with this sgid bit set, or provide a use flag for it.
In the meantime, since my system is mono-user and I don't want to bother 
remembering to change the flag when xorg is reinstalled, I keep my user 
in the input group.

-- 
Hervé

Re: [gentoo-user] Permissions error on starting X.

[gevisz]

сб, 3 нояб. 2018 г. в 16:02, Alan Mackenzie <acm@muc.de>:
>
> If you start your X server from the command line with, e.g. startx, you
> now need to set the new(?) suid USE flag for the xorg-server package.

I was hit today by this after updating my system.

Thanks to God, I have noticed the use flag change in xorg-server
ebuild, which helped me to figure out how to fix it.

> The developers ... failed to notify users by a NEWS item
>
> The matter was fairly intensively discussed in bug #669648
> in Gentoo's bugzilla.

Can you give a link, please.

Re: [gentoo-user] Permissions error on starting X.

[gevisz]

чт, 8 нояб. 2018 г. в 22:47, gevisz <gevisz@gmail.com>:
>
> сб, 3 нояб. 2018 г. в 16:02, Alan Mackenzie <acm@muc.de>:
> >
> > The matter was fairly intensively discussed in bug #669648
> > in Gentoo's bugzilla.
>
> Can you give a link, please.
Found it myself: https://bugs.gentoo.org/669648
See also: https://wiki.gentoo.org/wiki/Non_root_Xorg