Red Hat Bugzilla – Bug 69025
X11 authentication fails with sudo
Last modified: 2007-04-18 12:44:14 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.79 [en] (X11; U; Linux 2.4.18-4 i686)
Description of problem:
some X11 applications like dateconfig fail to start when run with the sudo
command on a remote machine. when being logged on a remote machine
e.g. 'sudo dateconfig' command fails because of X11 authentication problems.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. log on remotely as a regular user to a machine using OpenSSH
2. run 'sudo dateconfig'
Actual Results: $ sudo dateconfig
X11 connection rejected because of wrong authentication.
Gdk-ERROR **: X connection to localhost:21.0 broken (explicit kill or server
Expected Results: dateconfig should have started.
'sudo /usr/share/dateconfig/dateconfig' as well as 'sudo netscape' still work.
after setting XAUTHORITY environment variable for the regular user
in $HOME/.ssh/environment dateconfig works fine.
This has nothing to do with openssh. It's a sudo problem and probably
a WONTFIX as it's a security risk.
This is possibly a duplicate of Bug 61524 (or vice versa). In other
words: The problem is possibly the same with "su". I would also like
to ask, where you see a security risk? Without any explanation, I find
this hard to believe.
The security risk is that if you allow su from unprivileged user to
root user you basically give the unprivileged user full root access.
So there is no problem to allow him running X11 applications on his
The sudo on the other hand is different - most often you use it for
restricting the user to running exactly defined process (exact binary,
exact parameters...) with root privileges. However if such a process
is X11 application which uses user's display there is a high risk of
the binary being exploited through it's connection to the display
allowing the user getting full root access. Note that the code of Xlib
and X11 apps wasn't audited against this kind of attacks.
So for not exposing the system for such kind of attacks it's not
recommended to allow running x11 apps with sudo and sudo doesn't
support it anyway.
It is basically still possible to workaround this limitation of sudo
but I think this shouldn't be supported by default.
*** This bug has been marked as a duplicate of 164671 ***