Bug 69025 - X11 authentication fails with sudo
X11 authentication fails with sudo
Status: CLOSED DUPLICATE of bug 164671
Product: Red Hat Linux
Classification: Retired
Component: sudo (Show other bugs)
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Karel Zak
Ben Levenson
Depends On:
  Show dependency treegraph
Reported: 2002-07-17 02:45 EDT by Marko Asplund
Modified: 2007-04-18 12:44 EDT (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2005-08-03 08:25:13 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Marko Asplund 2002-07-17 02:45:30 EDT
From Bugzilla Helper:
User-Agent: Mozilla/4.79 [en] (X11; U; Linux 2.4.18-4 i686)

Description of problem:
some X11 applications like dateconfig fail to start when run with the sudo
command on a remote machine. when being logged on a remote machine
e.g. 'sudo dateconfig' command fails because of X11 authentication problems.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. log on remotely as a regular user to a machine using OpenSSH
2. run 'sudo dateconfig'

Actual Results:  []$ sudo dateconfig
X11 connection rejected because of wrong authentication.
Gdk-ERROR **: X connection to localhost:21.0 broken (explicit kill or server

Expected Results:  dateconfig should have started.

Additional info:

'sudo /usr/share/dateconfig/dateconfig' as well as 'sudo netscape' still work.

after setting XAUTHORITY environment variable for the regular user 
in $HOME/.ssh/environment dateconfig works fine.
Comment 1 Tomas Mraz 2005-02-03 10:27:26 EST
This has nothing to do with openssh. It's a sudo problem and probably
a WONTFIX as it's a security risk.
Comment 2 Jochen Wiedmann 2005-02-15 04:21:02 EST
This is possibly a duplicate of Bug 61524 (or vice versa). In other
words: The problem is possibly the same with "su". I would also like
to ask, where you see a security risk? Without any explanation, I find
this hard to believe.
Comment 3 Tomas Mraz 2005-02-15 05:18:13 EST
The security risk is that if you allow su from unprivileged user to
root user you basically give the unprivileged user full root access.
So there is no problem to allow him running X11 applications on his
The sudo on the other hand is different - most often you use it for
restricting the user to running exactly defined process (exact binary,
exact parameters...) with root privileges. However if such a process
is X11 application which uses user's display there is a high risk of
the binary being exploited through it's connection to the display
allowing the user getting full root access. Note that the code of Xlib
and X11 apps wasn't audited against this kind of attacks.
So for not exposing the system for such kind of attacks it's not
recommended to allow running x11 apps with sudo and sudo doesn't
support it anyway.
It is basically still possible to workaround this limitation of sudo
but I think this shouldn't be supported by default.
Comment 4 Karel Zak 2005-08-03 08:25:13 EDT

*** This bug has been marked as a duplicate of 164671 ***

Note You need to log in before you can comment on or make changes to this bug.