Submitted by The X Windowing System is the graphical backbone of most UNIX-like operating systems (and OpenVMS) – despite lots and lots of criticism, the system has withstood the test of time. Despite its age, development on X has not slowed down – in fact, it only seems to have picked up. A few weeks ago, we had kernel-based mode setting, and today we have the X server running as user instead of root.There are a lot of problems with running X as root – mostly from a security point of view. David Airlie has succeeded in starting the X server with user rights instead of root privileges. It required only 300 lines of code in the xserver and the driver itself (Intel in this case) and some other locations. It worked – but wasn’t particularly stable.
Surprisingly it mostly seems to work, I can start the server + gnome-session + DRI2 + compiz + glxgears on a cube, granted it oopses soon afterwards but it does show we are very close to realising the dream.
In the comments, Airlie explains that applications shouldn’t need any modifications, since X client applications shouldn’t need to run as root. Drivers of course do need to be modified.
Wha…? Seemed like it had crawled to a stop before the creation of Xorg.
indeed, xfree didnt add much new for ages.
but i think it was a modified license that was the final nail.
end result, a forked xfree from before the license change and xorg picked up speed after that.
and with things like beryl, multi-input x servers (perfect for multitouch setups), and others, its fast catching up to or overtaking the tricks that osx and windows can show of.
and all this while retaining the core ability to do things over a network connection and you have one impressive package.
one can even turn a single home computer into a multi user machine with these abilities. a kind of mini-mainframe if you will.
i suspect that as kernel mode setting becomes more of a norm in the drivers, the biggest reason for running X as root goes away. makes me a bit nostalgic as i always liked the idea of pre-95 windows, that ability to drop in and out of the gui as needed.
Without wanting to sound impolite, I’d like to comment that XFree at least got things working (in “the old days”, i. e. 3 years ago) that Xorg isn’t able to do anymore. (Please see this note as an individual problem I’m having since I upgraded from FreeBSD 5 to 7, including an upgrade from XFree 4.3 to the newest version of Xorg: I can’t get my ATI Radeon 9200 RV250 with the ati driver to run at 1400×1050 anymore, only 1152×864 is possible; and switch from console to X mode now lasts almost 10 seconds, while it lasted less than 2 seconds with XFree.)
Is catching up? I think it’s already doing those tricks, and many more. 🙂
The networking abilities have always been one of the most impressive things in X. Remote desktops and similar stuff were possible years before others had an acceptable network stack. 🙂
To be precise, a home computer running UNIX / Linux is a multi user machine. It’s just about how you enable two or more users to use the same machine at the same time. This isn’t some speciality of X, but of UNIX / Linux in general.
This option will still be present, I think. At least, I hope. But well, I do use BSD, so it will take some time before the kernel mode settings developed for Linux will make their way into BSD. 🙂
sure, xfree got things working, in the same way as windows “get things working”. but in the end, would it have been worth it?
as for tricks, note my “or overtaking”…
but overall take it we agree, and its mostly my way of presenting things that your having a issue with (most of it was written based on the impression i have gotten over the years from news sources, and how i recalled things that that moment)…
I feel your pain. I do. From my personal experience, the quality of xorg server has gone way downhill since version 1.3.
For a good example, look at the status of intel driver, which incidentally is the one being mentioned in the article.
Here’s a listing of intel driver related bugs in ubuntu (127 in total):
https://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel
Here’s one that affects me:
http://bugs.gentoo.org/show_bug.cgi?id=212453
All right, maybe the bugginess of the driver is just due to the incompentency of intel programmers, and has nothing to do with xorg server.
It’s easier to take a shot at people if they’re nameless, isn’t it?
I hardly think incompetent is the correct term in any sense in the cases of keithp, anholt, jbarnes, et al.
So you are more into name calling huh? No problem. Here’s a few based on the responses (or lack of) in freedesktop bugzilla: Hong Liu, Wang Zhenyu, Gordon Jin, Xiang HaiHao.
The bottom line is that the intel driver is full of bugs, and who gotta be responsible for that if not intel programmers?
Those names you mentioned could be uber hackers for all I care.
I congratulate you as you have obviously shown how X.org is inferior to XFree.
Have you filed bug reports for these issues? The xf86-video-ati developers (Alex Deucher and Dave Airlie) are pretty responsive and helpful.
I think you misunderstood my posting. Let me make this clear: I do not own bleeding edge hardwarre, so I don’t expect something “too new” to work without problems. I have several BSD systems that run X.org on ATI hardware without problems. But this particular case affects my main desktop, so I’m a bit unhappy to see something [b[not{/b] working in “new” X.org that did work in “old” XFree86.
Ah yes, I forgot to mention that the Num Lock status LED sometimes deactivates when switching to a virtual console and back to X. The switching time is also longer with X.org than with XFree86.
I will surely do this as soon as I could do some diagnostics (doing some more tests with xorg.conf and trying a compiled version of X). Thank you for this advice.
Maybe you ask yourself: “Why didn’t this strange guy file a bug report just after noticing that something didn’t work as expected?” First of all, I try to solve problems on my own first – before I do bother someone. And up to this point (update on main machine from FreeBSD 5.4 to 7.0 including all applications), I did not have any (!) issue – everything worked as intended.
I’m just a bit disappointed. The speed gains from the system update are more than eaten by the slowlyness of the X startup… 🙁
well stability comes with stagnation, the XFree86 tree just reimported a lot of the ati driver so it probably broke as well.
The thing is X.org drivers didn’t support a lot of features, and you can’t add features to a driver like dynamic monitor plugging and better detection code without causing some regressions. We trust that users report these regression so we can fix them instead of claiming that their one regression is the end of the universe.
… http://dictionary.reference.com/browse/present%20tense
I’m a bit rusty on this, but don’t you mean “past participle”?
Now that you mention it, I think it’s “present perfect.” Which, amusingly enough, is a bit of both – the present tense of “has” used with a past participle.
OpenBSD has had Xorg privsep for years, wake up and smell the truth.
BSD > You.
End of discussion.
not quite the same but still, thanks for the heads up.
No, BSDfan. Not “End of discussion”. Until we in the POSIX domain recognize the fallacy of treating each other as enemies rather than as allies it will never be “end of discussion”. You wake up, look at the reality, and (please) start being nice. We will all be better off for it.
Edited 2008-05-12 21:50 UTC
Sounds like a hack around a design flaw in X, rather than a real solution. What Dave Airlie has done is a real solution based on a solid re-architecting of how X works.
we had that in 1998 – it was called KGI (together with GGI and XGGI, which provided the X server). just that back then the linux crowd was too ignorant to merge it.
So, finally the design has the acceptance it deserves.
First of all, let’s dispense with the loaded terms, like “ignorant”. (Yes, it’s loaded.)
But that aside, you bring up a valid point. We did have GGI and KGI back then. I remember Zoid Kirsch, writing about a GGI version of Quake back when Quake 1 was still hot. (Quake 1 is still hot to me, though the RedHat 5.0 that I played it on has cooled some.) The original Linux version, “squake”, used svgalib. (This left open some intriguing possibilities. Ever play quake on a Wyse60 at 38400 baud in ascii art? I have!)
My recollection is that the first attempt to get the video drivers into the kernel was summarily rejected by Linus in no uncertain terms, to the extent that “over my dead body” can be considered definite. The *GI guys, lacking either access to, or the willingness to employ, assassins instead decided to put minimal functionality into the kernel, leaving the rest in user space. Linus was receptive to that… and then *GI just faded away.
My how 10 years flies! Seems like only yesterday. This move does seem like the sort of thing that should have gone in 10 years ago. I wonder why it did not?
Edited 2008-05-13 18:36 UTC
Privilege separation is good. We do that all the time with various technologies even in X (SELinux, PolicyKit, D-Bus etc) but the real problem here is the underlying software itself has security risks because of the architecture. A fundamental change is needed and that is what is happening now. Some Unix system or distributions papering over the real problem and playing in a sandbox does not really solve it for the rest of the world.
Maybe it is just me not getting the point but shouldn’t the title read: “Running X Without Root Privileges” or perhaps “Running X Without Super-user Privileges”?
I’m absolutely thrilled at the possibility of running X as non-root.
Does this gentleman present the best means of realizing this dream? I really wouldn’t know. I do hope his discovery will ripple through the linux community and this issue will receive the attention it is due.
Oh, X-server. Why does your history bring up so many bad memories? I’m glad to hear things are looking up for you…
… and then maybe one day mesa-solo will come and finally save us from you for good.
“the best solution” is a utopic dream, there will always be room for refinement of some sort.
but yes, this do get the proof of concept out there, for others to continue on with.
now if it had been some corp that figured this out, i wonder how much copyright and patent it would have been wrapped in…
well Red Hat does pay the wages 🙂
and funds most of these X.org changes.
Maybe OT but just yesterday I saw this link, it contains a lot of pdf worth reading:
http://www.x.org/docs/
Hu! Why aren’t you guys as giddy as I am? This is amazing work!
For years the X developers have tried so pry X away from the hardware. Finally this comes to fruition! This is not “a hack” to work around the shortcomings of X. This is groundbreaking work for the graphic sublayer of Linux. Finally we can have an X server running /completely/ in user space. Hey, I for one am blown away. Sure, FreeBSD might have had that for years. But my Ubuntu comes with a Linux kernel and for me that is fantastic news.
Along with a flicker free boot process comes now a hassle-free user switching and even multiple X processes, maybe per user. No more “tearing down the whole world just because the X-Server sucks”!
Pardon, what are you getting at? X-Server has always run in user space – user, meaning, executed in a user account with user privileges. what that means, rather than having to execute the server in root, in the future the X-Server can run as its own user, just as one can do with the various daemons – and segregate them off from each other.