how to use xauth to run graphical application via other user on linux

Question

My regular user account is, let's say, user1. I created separate user2 for some x application that i would like to run while being logged into x as user1 but in a way that will prevent it from read/write access to user1 data. I thought that i could use xauth and sudo/su to user2 from user1 to run this application. How do i do this? I'm not sure how to configure xauth.

Answer 1

Assuming debian or ubuntu (should be similar on Red Hat / SUSE).

sudo apt-get install sux
sux user -c 'command'

Answer 2

Don't use Xauth, it's rather insecure (blanket allow/deny).

Rather use the X-Cookie mechanism. Just do:

su user2
cp /home/user1/.Xauthority /home/user2/.Xauthority 
export DISPLAY=:0

Then user2 will use the secret cookie in .Xauthority to authorize to the X server, and no one else will have access to it.

Note: Depending on your file permissions, you might have to copy .Xauthority in some other way.

Edit:

While the above works, using sux is easier if it is installed. See other answer.

Answer 3

To use xauth selectively, as user1 run:

xauth list|grep `uname -n`

This prints the hexkey authorization entries for you . You could have different displays associated with those hosts as well.

As user2 set your display (assuming default case):

DISPLAY=:0; export DISPLAY

Then run:

xauth add $DISPLAY . hexkey

Note the dot after the $DISPLAY and before the hexkey.

When access is no longer needed, as user2 you can run:

xauth remove $DISPLAY

Answer 4

I put in my .zshrc a line with export XAUTHORITY=~/.Xauthority and now I am able to execute sudo -E xcommand. After a lot of googling, for me this was the easiest way.

Answer 5

These are just hacks:

• xauth + (unsecure)
• ssh -X user2@localhost (ugly)

sleske above has, I think, the proper solution.

Answer 6

I found something that works great for me on KDE

kdesu -u username /path/to/program

Answer 7

This will fix the problem for all users:

cat <<EOF > /etc/profile.d/xauth.sh
#!/sbin/bash
export XAUTHORITY=~/.Xauthority
EOF