Distributions
A setuid wrapper for X.org
X11 has long been a source of anxiety for the security-conscious, and understandably so: the X.org codebase is complicated, several decades old, and when there are security problems they can be massive in scope (such as in the May 2013 X client vulnerability disclosure). But despite the fact that most Linux distributions are working toward replacing the X server, the X.org project itself is still making incremental improvements. One such improvement is the ability to automatically run the X server as an unprivileged user for most GPUs, a change that looks like it could ship in Fedora 21.
With the availability of kernel mode setting (KMS) for the majority of graphics cards, it has been possible to run the X server as a non-root UID for quite some time. Intel's Moblin project did so (for Intel GPUs) in 2009; Ubuntu made it an option in 2010, and several other distributions have followed suit. But it has never been the default on a desktop distribution, perhaps because proprietary, binary-only drivers have remained too popular with users.
Let's wrap about X
On March 5, Hans de Goede posted a patch to the Xorg development list that offered a viable solution: a small "setuid wrapper" for the X server binary. If the wrapper detects that only KMS-supporting hardware and drivers are in use, it can launch the X server as a non-root UID. If KMS cannot be used, the wrapper can launch the X server as root.
In more detail, the patch starts with a shell script that looks for the wrapper; if there is no wrapper, the script launches the X server directly. But when the wrapper gets started instead, it first checks to see if all of the video adapters in use have KMS support and if the KMS drivers are loaded and working. There is, after all, the possibility that one KMS-supported card and one non-KMS card will both be in use, as well as the chance that the user wants to run a binary-only driver on a KMS-supported card. If the KMS conditions are met, then the wrapper drops the root privileges and launches the X server binary. If there are non-KMS components (or if there are no graphics cards present at all), then the wrapper starts the X server as root just as has traditionally been done in years past.
De Goede asked for feedback, which several other X.org developers supplied. Alan Coopersmith pointed out that Debian already has a utility called Xwrapper that is used to control the X server's execution environment. De Goede replied that he had not heard of it before, took a look, then pointed out what he saw as the good and bad points about it.
On the plus side, he said, it has a configuration file, supports a setting in which only local console users can start X, checks to see if the real X server is executable by the chosen UID, and performs some checks on /tmp/.X11. On the down side, he said, it installs the wrapper executable at /usr/bin/X rather than /usr/bin/Xorg, checks to see that the real X server is not just a symlink back to the wrapper, and is released under the GPL, which De Goede noted was unsuitable for X.org. Thus, he decided to duplicate the features he liked from Xwrapper, implement an Xwrapper-compatible configuration file, and hoped that Debian would switch over to his wrapper in the future.
Mark Kettenis from OpenBSD replied
that OpenBSD's Xenocara X server
has had its own approach to privilege separation from quite some time,
and questioned the wrapper approach. The Xenocara server, he said,
still runs with the setuid bit set, but it drops as many privileges as
it can. " De Goede responded that the log
file issue was not particularly important, and that with binary-only
drivers, it is simply not possible to know which rights the driver
needs and which can be dropped. " De Goede has also proposed adopting the wrapper as a change
for Fedora 21. The Fedora Engineering Steering Committee (FESCo) has
yet to decide on the proposal, but, if Fedora successfully implements the
feature and includes it, that would be the first mainstream desktop
distribution to offer a non-root X server by default.
Implementing the change will require alterations to
display managers like GNOME's GDM and KDE's SDDM, since the display
manager is the process responsible for starting X. Specifically, the
display manager must start the X server inside a user session;
fortunately Wayland also needs to be started inside a user session, so
display managers also interested in offering Wayland support can
handle both servers in the same fashion.
The feature tracking page notes that GDM and SDDM developers have
both started working on the required change; the XFCE, LXDE, and Mate
teams have been contacted, but so far there is no indication of
whether or not they plan to implement the change. De Goede's wrapper
is anticipated to land in X.org's xserver 1.16 release, which is
expected in July.
The benefits of such a change are, of course, provisory: if a
security bug is found in the X server, having the server run with
minimal permissions limits the scope of the potential damage. But it
is always good policy to grant the least possible set of privileges to
a component, so the change is still welcome—even if the X server
is due to be replaced in its entirety before too long. Then again,
when it comes to replacing components, one rarely gets in trouble for
overestimating how long X will continue to live on.
What you care about is dropping as many access
rights as possible, and being setuid you might actually be able to
drop more of them
", he said, adding also that this approach
allowed the server to use the traditional log files.
From the Linux POV the wrapper
is a workaround for these drivers; I hope that in the future we can
stop shipping the wrapper by default.
"
The Fedora change
Brief items
Distribution quotes of the week
Distribution News
Debian GNU/Linux
Bits from the Security Team
The Debian Security Team presents a summary of last month's team meeting. Topics include the Debian Security Tracker, security release workflow, security archive, and more. "At the moment it seems likely that an extended security support timespan for squeeze is possible. The plan is to go ahead, sort out the details as as it happens, and see how this works out and whether it is going to be continued with wheezy."
Newsletters and articles of interest
Distribution newsletters
- DistroWatch Weekly, Issue 549 (March 10)
- Tails report (February)
- Ubuntu Weekly Newsletter, Issue 358 (March 9)
Peppermint introduces cloud-based open source desktop to Africa (opensource.com)
Opensource.com talks with Kendall Weaver and Shane Remington about Peppermint Linux and how it's being used in Cameroon and elsewhere. "Remington: One of the key areas that we wanted to address with Peppermint, as a cornerstone, was that we had to be the absolute best Linux distribution when it came to inclusion. Everything we would do--community, social, support--would have to have a much different tone than the Linux that I grew up learning. And I mean having to prove your worth in the forums, even to ask simple questions, and being made to feel inadequate frequently. Kendall and I both agreed that those elements needed to be buried forever and I feel we've done a great job of that. Nowadays, the distance to the other side of the globe doesn't exist anymore with the Internet that's always on no matter where you are. We also had to attract the properly tempered support administrators and moderators who saw our vision clearly and would vow to maintain the positive and open vibe to the entire world. I can't say enough about how lucky we are for these guys who have been with us from the beginning. Its amazing what these guys can do."
Page editor: Rebecca Sobol
Next page:
Development>>