| 1 |
On Tue, Jul 21, 2020 at 09:30:07PM -0400, Walter Dnes wrote: |
| 2 |
> According to news item https://www.gentoo.org/support/news-items/2020-06-24-xorg-server-dropping-default-suid.html |
| 3 |
> |
| 4 |
> * xorg-server will no longer be "suid" *BY DEFAULT* |
| 5 |
> * that means *THE DEFAULT* is to require a logind server like systemd |
| 6 |
> or elogind |
| 7 |
> |
| 8 |
> The news item also says... |
| 9 |
> |
| 10 |
> > Users who do not wish to use logind interface or have rare hardware |
| 11 |
> > that does not use KMS and because of that, require root privileges |
| 12 |
> > to operate, can manually re-enable 'suid' and disable 'elogind' USE |
| 13 |
> > flags in order to preserve the previous behavior. However, please |
| 14 |
> > note that this is heavily discouraged to run X server as root due |
| 15 |
> > to security reasons. The 'suid' USE flag will remain as optional |
| 16 |
> > opt-in for the need of legacy hardware. |
| 17 |
> |
| 18 |
> I've set "x11-base/xorg-server glamor suid udev xorg" in package.use |
| 19 |
> and "-elogind" in make.conf, and no additional packages are required. I |
| 20 |
> used to start with USE="-*" but I don't do that anymore. Instead I use |
| 21 |
> |
| 22 |
> USE="10bit X apng ffmpeg jpeg opengl png szip truetype x264 x265 xorg threads |
| 23 |
> webp -acl -arping -berkdb -bindist -caps -cracklib -crypt -elogind -filecaps |
| 24 |
> -gallium -gdbm -graphite -iconv -introspection -ipc -iptables -ipv6 -libav |
| 25 |
> -libglvnd -llvm -manpager -nls -openmp -pam -pch -sendmail -tcpd -udev -udisks |
| 26 |
> -unicode -xinerama" |
| 27 |
|
| 28 |
There was a big argument about it over on Gentoo-Dev. It essentially reduced to |
| 29 |
the point that although most Gentoo users are still going to want "suid" (in the |
| 30 |
absence of systemd/elogind or another fancy login manager), Portage should |
| 31 |
provide good, non-anti-pattern, secure defaults for _new_ users, however much |
| 32 |
of an inconvenience it may be for existing users who run X with `startx`. I |
| 33 |
generally agree with them on this point; "suid" is horribly outdated, however |
| 34 |
ubiquitous (especially for minimalist systems). |
| 35 |
|
| 36 |
https://www.mail-archive.com/gentoo-dev@l.g.o/msg89536.html |
| 37 |
|
| 38 |
-- |
| 39 |
|
| 40 |
Ashley Dixon |
| 41 |
suugaku.co.uk |
| 42 |
|
| 43 |
2A9A 4117 |
| 44 |
DA96 D18A |
| 45 |
8A7B B0D2 |
| 46 |
A30E BF25 |
| 47 |
F290 A8AA |
Archives