My regular user account is, let's say, user1. I created separate user2 for some x application that i would like to run while being logged into x as user1 but in a way that will prevent it from read/write access to user1 data. I thought that i could use xauth and sudo/su to user2 from user1 to run this application. How do i do this? I'm not sure how to configure xauth.
To use xauth selectively, as user1 run:
xauth list|grep `uname -n`
This prints the hexkey authorization entries for you . You could have different displays associated with those hosts as well.
As user2 set your display (assuming default case):
DISPLAY=:0; export DISPLAY
xauth add $DISPLAY . hexkey
Note the dot after the $DISPLAY and before the hexkey.
When access is no longer needed, as user2 you can run:
xauth remove $DISPLAY
I put in my
.zshrc a line with
export XAUTHORITY=~/.Xauthority and now I am able to execute
sudo -E xcommand. After a lot of googling, for me this was the easiest way.
Assuming debian or ubuntu (should be similar on Red Hat / SUSE).
sudo apt-get install sux sux user -c 'command'
First: Don't use
xhost +, it's rather insecure (blanket allow/deny).
Rather use the X-Cookie mechanism:
su user2 cp /home/user1/.Xauthority /home/user2/.Xauthority export DISPLAY=:0
Alternatively, if you have
sux installed, use that (see ehempel's answer).
In both cases user2 will use the secret cookie in .Xauthority to authorize to the X server, and no one else will have access to it.
- Depending on your file permissions, you might have to copy .Xauthority in some other way.
- Instead of copying
.Xauthority, you can also use
xauthto extract and copy the authorization key (see Randall's answer). If you have multiple keys in the
.Xauthorityfile this is more selective; otherwise it is a matter of taste.
This will fix the problem for all users:
cat <<EOF > /etc/profile.d/xauth.sh #!/sbin/bash export XAUTHORITY=~/.Xauthority EOF
Where yourusername is your user name :)
Then do su as your user
xclock should work if it's installed
These are just hacks:
- xauth + (unsecure)
- ssh -X user2@localhost (ugly)
sleske above has, I think, the proper solution.
I found something that works great for me on KDE
kdesu -u username /path/to/program
This way made in suse/opensuse : http://www.novell.com/support/kb/doc.php?id=7003743
Simply modifying the /etc/pam.d/su, adding the option (bold) :
session optional pam_xauth.so systemuser=1
Then you can switch with su without - :
and run the app graphically.
For GNOME (and without any desktop environment really, I use it with icewm only)
gksu -u username program