For years the xorg-server in Gentoo was defaulting to be running with
suid, even those that does not really require it, like systemd users and
those who runs elogind still end up with X as uid 0 because of +suid

Times has changed, we now have +elogind in desktop profile, xorg-server
can no longer work without udev (due to input drivers), so there's no
real benefit for defaulting to suid.

There are 3 common ways the xorg-server is started:

- via XDM of some sort, usually forked as root, does not require suid,
systemd or elogind.
- via better XDM that can into logind interface, started as regular user
thanks to logind interface provided by either systemd or elogind.
- via `startx`, if systemd or elogind are present, can work without
suid, without them, suid is required.

Flipping current '+suid (-)elogind' as *default* USE flags on ebuild
level into '+elogind (-)suid' will not affect first two use cases, and
affect only 3rd one if neither systemd is used, or elogind is enabled.

What I'd like to go with is to enable elogind and disable suid on ebuild
level. The systemd profiles have use.mask for elogind, meaning it's not
a problem for them. and those who do not want to use any logind provider
can still opt-out out of it and go back to use suid. It shouldn't really
affect most of the users in any negative way, if anything, it will make
more users to not run Xorg as root, which is a positive aspect.

The alternative way would be to enable elogind on default profile,
however it would also affect those who run headless Gentoo, of which a
lot refuse to use any login manager.

So, dear people of Gentoo, what do you think about turning the current
possible opt-out of Xorg as root into possible opt-in for running Xorg
as root? People still will have a choice, just the defaults will be more

-- Piotr.

Attachment: signature.asc
Description: OpenPGP digital signature

Reply via email to