[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: how does root run a graphical prog

* Dave Sherohman (esper@sherohman.org) [020520 10:49]:
> On Mon, May 20, 2002 at 06:39:22PM +0200, Kristian Rink wrote:
> > Something like 'xhost +' basically should
> > allow anyone (on your system) to connect to X hence to display any
> > graphical output.
> Bzzt!  'xhost +' allows anyone (on any system capable of contacting
> your system) to connect to X and display any graphical output.  Not
> good...
> If you MUST use xhost, use 'xhost + localhost'.  But using xauth or
> XAUTHORITY is the Right Way To Do It.

Thanks Dave! You just pointed out one of the many, many, MANY reasons to
NEVER USE xhost. The reason you just illustrated: "When you might want
to do 'xhost +localhost', you might accidentally enter
'xhost + localhost', which has the same as effect as 'xhost +'.

Even if you DID get it "right", 'xhost +localhost' allows anyone on
localhost to connect to your X server. Probably not what you want,
especially on a system with many users, or any system with any users you
don't fully trust (probably every system).

It's worth noting that the danger isn't just that anyone can display
apps on your display. In addition to being able to open windows on your
display, anyone else would be able to destroy any (or all) of
your windows, view the contents of your screen remotely, log your
keystrokes, or generate /any/ X event.

This horse has been beaten to death. Search google and you'll probably
come up with a kmself rant (TM) about why xhost is bad, along with info
from plenty of other enlightened individuals.

Thankfully, debian's X config has by default an option (and I won't tell
you which if you don't know, because you shouldn't remove it) that
disables the X server from listening for and accepting incoming tcp
connections, so 'xhost +' won't hurt you as much as it should.

Use su and read the originating user's ~/.Xauthority, or use ssh's X

> -- 
> When we reduce our own liberties to stop terrorism, the terrorists
> have already won. - reverius

Word. (and "too late.")

good times,
Currently seeking opportunities in the SF Bay Area
Please see http://www.doorstop.net/resume.shtml

Attachment: pgphUsbRVWvDT.pgp
Description: PGP signature

Reply to: