Debian Bug report logs - #867601
slim: should no longer run the Xorg server as root

Package: src:slim; Maintainer for src:slim is Nobuhiro Iwamatsu <[email protected]>;

Reported by: Salvatore Bonaccorso <[email protected]>

Date: Fri, 7 Jul 2017 17:27:02 UTC

Severity: wishlist

Tags: security

Found in version slim/1.3.6-5.1

Reply or subscribe to this bug.

Display info messages

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to [email protected], [email protected], [email protected], [email protected], Nobuhiro Iwamatsu <[email protected]>:
Bug#867601; Package src:slim. (Fri, 07 Jul 2017 17:27:04 GMT) (full text, mbox, link).

Acknowledgement sent to Salvatore Bonaccorso <[email protected]>:
New Bug report received and forwarded. Copy sent to [email protected], [email protected], [email protected], Nobuhiro Iwamatsu <[email protected]>. (Fri, 07 Jul 2017 17:27:04 GMT) (full text, mbox, link).

Message #5 received at [email protected] (full text, mbox, reply):

Source: slim
Version: 1.3.6-5.1
Severity: wishlist
Tags: security

Hi

Similarly as for lightdm, #809067, the Xorg server no longer needs to
be run as root. Cf. /usr/share/doc/xserver-xorg-core/NEWS.Debian.gz:

----cut---------cut---------cut---------cut---------cut---------cut-----
xorg-server (2:1.17.3-1) unstable; urgency=medium

  The Xorg server is no longer setuid root by default.  This change reduces the
  risk of privilege escalation due to X server bugs, but has some side effects:

  * it relies on logind and libpam-systemd
  * it relies on a kernel video driver (so the userspace component doesn't
    touch the hardware directly)
  * it needs X to run on the virtual console (VT) it was started from
  * it changes the ___location for storing the Xorg log from /var/log/ to
    ~/.local/share/xorg/

  On systems where those are not available, the new xserver-xorg-legacy package
  is needed to allow X to run with elevated privileges.  See the
  Xwrapper.config(5) manual page for configuration details.

 -- Julien Cristau <[email protected]>  Tue, 27 Oct 2015 22:54:11 +0000
----cut---------cut---------cut---------cut---------cut---------cut-----

Regards,
Salvatore

Send a report that this bug log contains spam.

Debian bug tracking system administrator <[email protected]>. Last modified: Thu May 15 19:30:09 2025; Machine Name: buxtehude

Debian Bug tracking system

Debbugs is free software and licensed under the terms of the GNU General Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Debian Bug report logs - #867601 slim: should no longer run the Xorg server as root

Debian Bug report logs - #867601
slim: should no longer run the Xorg server as root