Package: lightdm
Version: 1.16.6-1
Severity: wishlist
Tags: security
The Xorg server no longer needs to be run as root, for security
reasons. See /usr/share/doc/xserver-xorg-core/NEWS.Debian.gz
xorg-server (2:1.17.3-1) unstable; urgency=medium
The Xorg server is no longer setuid root by default. This change reduces the
risk of privilege escalation due to X server bugs, but has some side effects:
* it relies on logind and libpam-systemd
* it relies on a kernel video driver (so the userspace component doesn't
touch the hardware directly)
* it needs X to run on the virtual console (VT) it was started from
* it changes the location for storing the Xorg log from /var/log/ to
~/.local/share/xorg/
On systems where those are not available, the new xserver-xorg-legacy package
is needed to allow X to run with elevated privileges. See the
Xwrapper.config(5) manual page for configuration details.
-- Julien Cristau <jcris...@debian.org> Tue, 27 Oct 2015 22:54:11 +0000
but lightdm still runs it as root:
UID PID PPID C STIME TTY TIME CMD
root 19600 850 1 Dec22 tty7 01:13:20 /usr/lib/xorg/Xorg :0 -seat
seat0 -auth /var/run/lightdm/root/:0 -nolisten tcp vt7 -novtswitch
-- System Information:
Debian Release: stretch/sid
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'unstable'), (500, 'testing'),
(500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 4.3.0-1-amd64 (SMP w/8 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages lightdm depends on:
ii adduser 3.113+nmu3
ii dbus 1.10.6-1
ii debconf [debconf-2.0] 1.5.58
ii libaudit1 1:2.4.5-1
ii libc6 2.21-6
ii libgcrypt20 1.6.4-4
ii libglib2.0-0 2.46.2-3
ii libpam-systemd 228-2+b1
ii libpam0g 1.1.8-3.1
ii libxcb1 1.11.1-1
ii libxdmcp6 1:1.1.2-1
ii lightdm-gtk-greeter [lightdm-greeter] 2.0.1-2+local1
Versions of packages lightdm recommends:
ii xserver-xorg 1:7.7+12
Versions of packages lightdm suggests:
pn accountsservice <none>
pn upower <none>
-- Configuration Files:
/etc/lightdm/lightdm.conf changed:
[LightDM]
[Seat:*]
greeter-hide-users=false
[XDMCPServer]
[VNCServer]
-- debconf information:
lightdm/daemon_name: /usr/sbin/lightdm
* shared/default-x-display-manager: lightdm
