My regular user account is, let's say, user1. I created separate user2 for some x application that i would like to run while being logged into x as user1 but in a way that will prevent it from read/write access to user1 data. I thought that i could use xauth and sudo/su to user2 from user1 to run this application. How do i do this? I'm not sure how to configure xauth.
To use xauth selectively, as user1 run:
xauth list|grep `uname -n`
This prints the hexkey authorization entries for you . You could have different displays associated with those hosts as well.
As user2 set your display (assuming default case):
DISPLAY=:0; export DISPLAY
xauth add $DISPLAY . hexkey
Note the dot after the $DISPLAY and before the hexkey.
When access is no longer needed, as user2 you can run:
xauth remove $DISPLAY
First: Don't use
xhost +, it's rather insecure (blanket allow/deny).
Rather use the X-Cookie mechanism:
su user2 cp /home/user1/.Xauthority /home/user2/.Xauthority export DISPLAY=:0
Alternatively, if you have
sux installed, use that (see ehempel's answer).
In both cases user2 will use the secret cookie in .Xauthority to authorize to the X server, and no one else will have access to it.
- Depending on your file permissions, you might have to copy .Xauthority in some other way.
- Instead of copying
.Xauthority, you can also use
xauthto extract and copy the authorization key (see Randall's answer). If you have multiple keys in the
.Xauthorityfile this is more selective; otherwise it is a matter of taste.
This way made in suse/opensuse : http://www.novell.com/support/kb/doc.php?id=7003743
Simply modifying the /etc/pam.d/su, adding the option (bold) :
session optional pam_xauth.so systemuser=1
Then you can switch with su without - :
and run the app graphically.