Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have ssh configured on my server, and sometimes I have to run some graphical application on it. It works great when I connect with -X option. I can run e.g. google-chrome. However, if I change user by sudo -i -u other_user, I can't run GUI apps as this user.

I assume it is something with environment and DISPLAY, but don't know what to do. I tried to add -E, but then I got error message saying that I can't use it with -i. How can I run GUI apps via ssh as another user?

share|improve this question
    
Why do you have a -i? Have you tried removing that? –  Zoredache Sep 28 '10 at 20:28
    
Without -i I can only run one command as other user. I want to "become" this user and do stuff as him, and sometimes run GUI app as him. Probably I can also run this GUI app as this user without -i (didn't try), but thats not what I want. –  amorfis Sep 29 '10 at 6:46

1 Answer 1

up vote 4 down vote accepted

The easiest way is to use ssh -X to run commands as the other user. But this makes the applications run markedly slower, even locally.


The -i option tells sudo to reinitialize the environment. X applications require $DISPLAY and (on some setups) $XAUTHORITY, and may use other environment variable such as locale settings. Try without -i, or if you must use -i, run

sudo -i -u other_user \
  env DISPLAY="$DISPLAY" XAUTHORITY="${XAUTHORITY-$HOME/.Xauthority}" \
  xapplication

Even if you get rid of -i, you might have to supply XAUTHORITY explicitly: by default (if the variable is not set) it's .Xauthority in the home directory.

So far I've been assuming the other user could read your $XAUTHORITY. But that won't be the case unless you make it so (e.g. with setfacl -m user:other_user:r $XAUTHORITY).

Alternatively, rather than let the other user read your $XAUTHORITY, you could copy the right cookie to another file that the user can read.

xauth extract -f - "$DISPLAY" |
sudo -u other_user xauth -f ~other_user/.Xauthority merge -

Note that allowing another user access to your display allows him to do almost anything with it, including sending fake keypresses to applications. So if you were changing users for isolation, you won't get much.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.