Slashdot Mirror

← Back to Stories (view on slashdot.org)

Moblin Will Run X Server As Logged-In User, Not Root

Posted by timothy on from the such-a-little-thing-makes-such-a-big-difference dept.

nerdyH writes "An architect of the Moblin Project has announced that Moblin 2.0 for netbooks and nettops is the first Linux distribution to run the X server as the logged-in user, rather than SUID'd to root. The fix to this decades-old security liability comes thanks to 'NRX' (No-root X) technology reportedly developed by Intel, Red Hat, and others in the X community, and the Moblin-sponsored 'Secure X' project. Besides making Linux netbooks a lot more snoop-proof, it seems like this could lead to an X-hosting renaissance of sorts, since you wouldn't be risking the whole system just to open up a specific user's account to remote X servers."

7 of 205 comments (clear)

  1. Confused article. by Timothy+Brownawell · · Score: 5, Insightful

    Linux's SUID X server problem has been kind of a "dirty little secret" for many years. Most modern distributions include a few crude workarounds, such as dimming the display and then freezing X whenever the user is asked to type in a root password. Getting rid of the SUID bit altogether ought to make netbooks powered by Moblin technology much more difficult to snoop on over the network.

    This does not make sense. Graphical sudo wrappers have nothing to do with X being suid, and neither does anything to do with network traffic.

    It seems likely that with NRX technology, you could run X apps over a network with much less risk to the app server (the system that runs the "X client" component, in the backwards terminology of X).

    This is actually backwards, the only place there's less risk is for the system that the X server is running on.

  2. Re:frost nixon by msuarezalvarez · · Score: 4, Insightful

    It doesn't?

  3. Graphics drivers by Chemisor · · Score: 5, Insightful

    If graphics drivers were implemented in the kernel instead of the X server, this problem wouldn't have existed in the first place.

    1. Re:Graphics drivers by TheRaven64 · · Score: 4, Insightful

      KGI was a massively-complicated API which failed to actually expose the useful features of the hardware, while KMS allows the same userspace device drivers (with a small amount of kernel-mode validation, for example of DMA requests) that X11 already uses but removes the need for X11 to be run as root and makes virtual terminals and power saving play nicely with X11.

      --
      I am TheRaven on Soylent News
  4. Re:Have you used Moblin? by Freetardo+Jones · · Score: 4, Insightful

    Its very flashy and friendly if all you do is check your email and browse the web though.

    Almost like that was the entire point of the distro in the first place!

  5. Re:frost nixon by Zero__Kelvin · · Score: 4, Insightful

    No, it doesn't. It runs most everything as the "Administrator" user, which is a lot like a root account, but without even the level of security that logging into Linux/Unix as root provides ;-)

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  6. Re:Remote X servers? by TerranFury · · Score: 4, Insightful

    The problem is that we use the words "client" and "server" to refer both to the programs and to the machines they run on. Usually server machines run server programs, but not always (and consider true P2P stuff where programs are both clients and servers). Maybe we need to throw out all the words and replace them with alternatives like "listener" and "caller" for the programs and... "big machine" and "little machine" for the computers? :-)