On Tue, Jul 21, 2020 at 09:30:07PM -0400, Walter Dnes wrote: > According to news item > https://www.gentoo.org/support/news-items/2020-06-24-xorg-server-dropping-default-suid.html > > * xorg-server will no longer be "suid" *BY DEFAULT* > * that means *THE DEFAULT* is to require a logind server like systemd > or elogind > > The news item also says... > > > Users who do not wish to use logind interface or have rare hardware > > that does not use KMS and because of that, require root privileges > > to operate, can manually re-enable 'suid' and disable 'elogind' USE > > flags in order to preserve the previous behavior. However, please > > note that this is heavily discouraged to run X server as root due > > to security reasons. The 'suid' USE flag will remain as optional > > opt-in for the need of legacy hardware. > > I've set "x11-base/xorg-server glamor suid udev xorg" in package.use > and "-elogind" in make.conf, and no additional packages are required. I > used to start with USE="-*" but I don't do that anymore. Instead I use > > USE="10bit X apng ffmpeg jpeg opengl png szip truetype x264 x265 xorg threads > webp -acl -arping -berkdb -bindist -caps -cracklib -crypt -elogind -filecaps > -gallium -gdbm -graphite -iconv -introspection -ipc -iptables -ipv6 -libav > -libglvnd -llvm -manpager -nls -openmp -pam -pch -sendmail -tcpd -udev -udisks > -unicode -xinerama"
There was a big argument about it over on Gentoo-Dev. It essentially reduced to the point that although most Gentoo users are still going to want "suid" (in the absence of systemd/elogind or another fancy login manager), Portage should provide good, non-anti-pattern, secure defaults for _new_ users, however much of an inconvenience it may be for existing users who run X with `startx`. I generally agree with them on this point; "suid" is horribly outdated, however ubiquitous (especially for minimalist systems). https://www.mail-archive.com/gentoo-dev@lists.gentoo.org/msg89536.html -- Ashley Dixon suugaku.co.uk 2A9A 4117 DA96 D18A 8A7B B0D2 A30E BF25 F290 A8AA
signature.asc
Description: PGP signature
