XOpenDisplay(NULL) Fails as ROOT

**DAFlippers** · 04-Jul-2012, 04:48

Hi,

I have a program that runs on Ubuntu (various versions and Debian Squeeze) and also on another installation SuSE 12.1 64 (miles away) but not here on SuSE 12.1 64. The program needs to run as root to access USB ports.

Initially the program failed when trying to open X display so I wrote a very simple piece of code:

#include <stdio.h>
#include<X11/Xlib.h>

int main()
{
Display *d;

if ((d = XOpenDisplay(NULL)) == NULL)
{
printf ("Error trying to open XDisplay\n");
return 1;
}

printf("XOpenDisplay(NULL) = %p\n",d);
return 0;
}

Searching pointed me at using YaST to change Security settings to allow remote access to X Server and now the above code returns a pointer when run as user but not when run using sudo.

I think it is some security issue but I haven't found what as yet so I'd appreciate any help.

TIA

David

**martin_helm** · 04-Jul-2012, 05:49

Am 04.07.2012 12:56, schrieb DAFlippers:
> Searching pointed me at using YaST to change Security settings to allow
> remote access to X Server and now the above code returns a pointer when
> run as user
when run as user your code always returns a valid pointer for me or did
you meant as root here

the most probable reason if you ran as root and did not get a pointer
back is that you used "su" instead of "su -", only with "su -" you get
access to X not with su alone.

> but not when run using sudo.
>
that simply means you did not configure sudo, to give sudo access to X
there is some configuration needed which is not default. I do not know
howto do that but you can simply look it up by showing the configuration
on an ubuntu machine with visudo because they configure it by default to
give access to the running X session.

> I think it is some security issue but I haven't found what as yet so
> I'd appreciate any help.
>
Undo that and use "su -".

--
PC: oS 12.1 x86_64 | i7-2600@3.40GHz | 16GB | KDE 4.8.4 | GeForce GT 420
ThinkPad E320: oS 12.1 x86_64 | i3@2.30GHz | 8GB | KDE 4.8.4 | HD 3000
eCAFE 800: oS 12.1 i586 | AMD Geode LX 800@500MHz | 512MB | KDE 3.5.10

**martin_helm** · 04-Jul-2012, 05:50

Am 04.07.2012 13:49, schrieb Martin Helm:
> Am 04.07.2012 12:56, schrieb DAFlippers:
>> I think it is some security issue but I haven't found what as yet so
>> I'd appreciate any help.
>>
> Undo that and use "su -".
>
or xdg-su, gnomesu, kdesu all of them are there to run a program with
gui as root.

--
PC: oS 12.1 x86_64 | i7-2600@3.40GHz | 16GB | KDE 4.8.4 | GeForce GT 420
ThinkPad E320: oS 12.1 x86_64 | i3@2.30GHz | 8GB | KDE 4.8.4 | HD 3000
eCAFE 800: oS 12.1 i586 | AMD Geode LX 800@500MHz | 512MB | KDE 3.5.10

dd@home.dk · 04-Jul-2012, 06:05

>
> The program needs to run as root to access USB ports.
>

well, i have to admit i'm confused by that statement!

since i see that Martin has answered and didn't ask about this i guess
should assume this all normal...

**but**, since i can (as a simple user) USB plug-in and _use_ a printer,
microphone, headset, speakers, video camera, external hard drive, CD/DVD
reader/writer, modem, UBS stick, scanner and a whole host of other
devices *without* being root, i find it very confusing that your program
"needs to run as root to" do what i can do without being root!!

so, what gives here?

why does your program have to run as root to access USB ports???

--
dd

**martin_helm** · 04-Jul-2012, 06:24

Am 04.07.2012 14:05, schrieb dd@home.dk:
>>
>> The program needs to run as root to access USB ports.
>>
>
> well, i have to admit i'm confused by that statement!
>
> since i see that Martin has answered and didn't ask about this i guess
> should assume this all normal...
>
Nope, I simply missed that point and forgot to ask about that looking
only at the X display part, my excuse is I answered quickly during my
lunch break.
Good you mention this now.

--
PC: oS 12.1 x86_64 | i7-2600@3.40GHz | 16GB | KDE 4.8.4 | GeForce GT 420
ThinkPad E320: oS 12.1 x86_64 | i3@2.30GHz | 8GB | KDE 4.8.4 | HD 3000
eCAFE 800: oS 12.1 i586 | AMD Geode LX 800@500MHz | 512MB | KDE 3.5.10

**hcvv** · 04-Jul-2012, 07:44

Hm, I am not sure thatthe following holds true for USB ports, but think of the next::

Normal users have no accesss permissions to disk devices/partitions, but they have permnissions to files through the layer of the file system.

Is there an analogy that normal users have no access to USB devices (ports), but can use sound devices, etc. The sound device is e.g. have e.g. sound as a group and every user that can use group sound can use the sound device. But that is not the same as directly reading/writing to an USB port ¹)

¹) You can use a USB port through library routines like usb_init(), usb_find_busses(), usb_find_devices(), usb_claim_interface() and usb_control_message()

**martin_helm** · 04-Jul-2012, 08:06

Which rights you need depends of course a lot on what you do with the
USB port. The claim was not that you can do what you want with the ports
as normal users.

As normal user for example you cannot use it for a serial connection
unless you assign yourself to the dialout group.
Some people do not know that and become root just to do such simple
things and this can easily be avoided by proper group membership.

If something like that is the case here is not clear as we have no
details so asking back and pointing to it is a good strategy.
Of course it can be that something is done which is really only possible
as root.

--
PC: oS 12.1 x86_64 | i7-2600@3.40GHz | 16GB | KDE 4.8.4 | GeForce GT 420
ThinkPad E320: oS 12.1 x86_64 | i3@2.30GHz | 8GB | KDE 4.8.4 | HD 3000
eCAFE 800: oS 12.1 i586 | AMD Geode LX 800@500MHz | 512MB | KDE 3.5.10

dd@home.dk · 04-Jul-2012, 08:18

On 07/04/2012 04:06 PM, Martin Helm wrote:
> Of course it can be that something is done which is really only possible
> as root.

i've been wrong before (but not yet today...i _think_), but my guess is
the program can and *should* be run as a non-root user....and, all the
script hacking to make it 'work' as root is not only avoidable, but also
creating a security hole big enough to drive a script-kiddie's rootkit
through (quietly).

ymmv, and i hope my guess is wrong.

--
dd

**hcvv** · 04-Jul-2012, 08:36

In any case DAFlippers, we have a nic feature hee on the forums, but as it is not easy to finf for first visitors like you (welcome, btw), I will expplain.
Please use CODE tags around any computer text that you copy/paste into a post here: http://forums.opensuse.org/english/i...ags-guide.html

**kensch** · 04-Jul-2012, 10:09

On 07/04/12 10:46, hcvv pecked at the keyboard and wrote:
> In any case DAFlippers, we have a nic feature hee on the forums, but as
> it is not easy to finf for first visitors like you (welcome, btw), I
> will expplain.
> Please use CODE tags around any computer text that you copy/paste into
> a post here: http://tinyurl.com/2wwx7l9
>
>
Does it also have a spell checker? If so do you use it? Just look at the
second part of the first line.

Some may (I do) use an email program (such as Thunderbird) to reply and
don't have the "code tag" button so your example does not apply.

Just saying.

Ken
openSUSE user since 1996 (when it was S.u.S.E.)