How do you cross-over to secondary user accounts on your desktop?

Zare

Zare

If you have a number of isolated or 'emulated' desktop applications, do you have a way to launch them on click, preferably without intervention of fully open sudo/doas?

My current setup is that I add my main user to the secondary user's groups so I can have access to the data, but since the other way around is not granted (ofc security), I still have issues when moving a file to scope of the limited account. This problem probably can be resolved with more grained UNIX permissions.

Bigger issue are the Linux chroots. Without any privilege mechanism it requires two su's and one typing of root password to get where I want to be.

So has anyone tackled this with MAC or some other mechanism?
I thought of writing my own suid binary. Simplest, define a group like 'auxusers', binary allows wheel users to impersonate anyone from that group. To cover both cases, it would need to have jail/chroot support too.
 
MG It's simpler, built in and easier to set up but sudo and doas are probably more flexible. With that flexibility comes more chances of something going wrong and security issues. For smaller situations it's great but sudo and doas still have their place.
 
I got rid of sudo; the config file syntax is just too evil to live. Instead I use doas, both to become root, and to work in other accounts (of which I have few, mostly www for the web server). One nice thing about doas is that I can install it on all machines where I need it (Linux and FreeBSD). Looking forward to trying mdo instead once I've upgraded to the required 14.x version (I'm a few months behind on upgrading).
 
On freebsd you can just run 'login' in a terminal to log in as another user. Or, the other way is 'su - username'. You have to supply the user's password, in both cases. I prefer using the 'login' command.

If you are using X11 and you want the second user to be able to run X programs on the same display, you will need to give them access to the display by running (as the user whose X11 session it is):-
$ xhost +si:localuser:<second username>

So if you start the X desktop as user 'foo', and you want user 'bar' to be able to run X applications on the same X server, then 'foo' needs to run the command:-
$ xhost +si:localuser:bar
- which tells the X server to allow username 'bar' to run clients on it
...
and then in any terminal, user 'foo' runs
$ login bar
- which gives you a login shell for 'bar', and provided 'bar' has DISPLAY set correctly (typically, ":0"), 'bar' will be able to launch X clients on the same desktop; so if 'bar' now runs 'xterm', it should appear on the desktop, showing a shell for 'bar'.

Now... what you can do, once you are logged in as the second user and are able to lauch X clients as that user, is run a complete nested X server to give that user his own complete desktop, using Xnest or Xephyr, running a lightweight window manager like fvwm. Then the second user effectively has his own complete, isolated desktop on the display. You can reserve one of the virtual desktops on the host user's desktop, to be the nested desktop of the second user (run the nested display full-screen). I find that works well, and emphasises the isolation between the userids; effectively your second user has his own isolated desktop on one of the host user's virtual desktops.

Which probably doesn't fully answer your question, Zare, but that's how I do it.

As an aside, I don't know how you would do this kind of thing on wayland, or even if it's possible with wayland.
 
I guess if you're going to try making it work with 'doas', you still need to run the xhost command to allow the second user to connect to the server (but you only need to do that once, say at desktop startup time). And the second user will need to have the correct value of the DISPLAY variable set in his environment. That is, assuming an X11 desktop. I don't know how it works in wayland.

Maybe you can say something like:-
$ doas -u bar 'DISPLAY=:0 xterm'
 
I just tried it, in fact simply saying:-
$ doas -u bar xterm
works; the value of DISPLAY is picked up from the invoking user's environment.
Which is useful because it obviates the interactive login stage.
 
blackbird9 said:
I guess if you're going to try making it work with 'doas', you still need to run the xhost command to allow the second user to connect to the server (but you only need to do that once, say at desktop startup time). And the second user will need to have the correct value of the DISPLAY variable set in his environment. That is, assuming an X11 desktop. I don't know how it works in wayland.

Maybe you can say something like:-
$ doas -u bar 'DISPLAY=:0 xterm
Click to expand...
xhost is the heavy handed approach to X11 access. There is also xauth, which allows you to use a hash key on the server to determine what clients can access the display.
 
Blackbird I took care of X11, already am using xhost, the nested X server is out of the question because this is for graphical applications.
Like I said, steam, windows, linux programs that require GUI access and are used via "secondary" users due to their closed source nature.

Here's what I think about stuff.

sudo/doas are rarely vulnerable, but I feel like using such tools just for one clear, straight thing is overkill. I don't like their existence on my machine.

mdo, MAC were not designed for interactive usage but for services and such. They can be, but all the cons people attribute (no escalation log) is something drawn from this fact, you don't need escalation log for services done by a elevation mechanism/tool, the service can log it.

User chroot takes care of one half of "Linux" problem.

Maybe my "problem" is too niche and it really belongs to gaming/multimedia stuff because that's where the most of these situations occur.

The way I see it, a custom setuid binary taliored for this should be highly secure as it actually needs no configuration parsing and setup like sudo or doas.
 
Hmm, I don't like setuid binaries. Still, its probably the only thing that's going to work in the way you want. You can do something like a double fork to create an orphan child process, then in the child setuid to the new uid and then exec the program you want to run. I've had to write similar things in the past, but it's not something I liked doing.
answers.securityscientist.net

Why are these bits a security risk? — Setuid and Setgid | Security Scientist

A terminal window flickers with green text. You notice a specific file has the setuid bit active. To an attacker, that little 's' looks like a golden…
answers.securityscientist.net answers.securityscientist.net

Would it be easier to just run those progams in emulators (eg wine) or VMs? But then you have other problems. I guess there's no easy answer.
 
ralphbsz said:
Instead I use doas
Click to expand...
There is a major barrier to doas compared to sudo. It's the typing. Typing sudo is very easy on the fingers. Typing doas much more tedious on the fingers...I think it's probably the pinky use that's unacceptable for typing something a million types a day. Does FreeBSD have a Generating Ergonomic Frequently Used Binary Names Compliance department?
 
Zare said:
Maybe my "problem" is too niche and it really belongs to gaming/multimedia stuff because that's where the most of these situations occur.
Click to expand...
For managing a bunch of graphical sandbox sessions, I tend to setup xdm and inetd with e.g. Xvnc -inetd -query localhost. Perhaps make it listen on 127.0.0.1 rather than 0.0.0.0 unless you do want remote access (although then I would recommend SSH tunnel).

That way I can simply run:

$ vncviewer localhost

And it will spawn a new vncsession for that connection, pop open the xdm login screen and I can select the user I want.

I have a personal solution for OpenGL to avoid LLVMpipe but I believe tigervnc's server now also supports 3D acceleration too (about time!).

You could also use Xephyr -query but although Xephyr is faster than Xnest, its not accelerated (LLVMpipe).
 
It was a funny post, but really typing doas is pretty easy, the 'd' and 'as' are right next to each other, you only need to hit the 'o' with third finger of the right hand... 😂
 
Here is a little manual dexterity exercise you can try. Start with your fingers at the position shown in the left hand photo, which you will recognise as Mr Spock's "live long and prosper" hand sign, from Star Trek. Then, under voluntary control alone, move your two inner fingers together, and the two outer fingers outwards, to form the position shown in the second photo; so you go from one 'V', to two 'V''s. Then move them back to the "live long and prosper" one-V position again. Do that a few times, until you can move backwards and forewards between the two positions smoothly using one hand. You are not allowed to use the other hand to hold the fingers, or move them!

Then, do it with both hands, simultaneously. When you can do it with both hands in-phase... try doing it with both hands, but 180 degrees out of phase. Meaning one hand starts at the 1-V position and the other starts at the 2-V position, and you then perform the alternation with both hands simultaneously over a number of cycles while retaining the out-of-phase relationship. 😁

livelongandprosper1.jpeglivelongandprosper2.jpeg

Even I find doing the two hands 180 deg. out of phase a bit tricky, I have to concentrate pretty hard to keep them fully out of phase over a number of cycles. 😂
What it's doing is training your brain to do independent voluntary control of both hands, simultaneusly.
 
ralphbsz said:
I suggest you practice half hour of Rachmaninoff and Scriabin on the piano every day. That will make typing doas easier.
Click to expand...
No, that's why we have emoji: 🤟🤙🖖🖐️

It's not just the pinky use, it's also the issue of non-alternating characters between the left and right hand involving the pinky - the 'a' and 's' (especially clustering of pinky and ring finger presses). It's as if FreeBSD is trying to discourage use of a native tool.

The pinky + the non-hand-alternating characters in sequence with the pinky are the. biggest. slowdown. for. typing. ever.

Humans are the most pinky non-dexterous species. Go on, hold your hand level with your palm down, and try to wiggle just your pinky and ring fingers out of sync, alternating up and down between each, right now.

Which is why some alternative keyboard layouts were designed - to reduce the pinky strain. Colemak-DH has the best overall pinky strain reduction. It brings pinky use from about 20% in QWERTY layout to about 8% in Colemak-DH layout.

Who here still types with their index fingers? And who switched to alternative keyboard layouts?

My favorite typist of all times was this:

images.jpg


Am I the only one who watched Little Britain here?
 
loveydovey said:
No, that's why we have emoji: 🤟🤙🖖🖐️

It's not just the pinky use, it's also the issue of non-alternating characters between the left and right hand involving the pinky - the 'a' and 's' (especially clustering of pinky and ring finger presses). It's as if FreeBSD is trying to discourage use of a native tool.

The pinky + the non-hand-alternating characters in sequence with the pinky are the. biggest. slowdown. for. typing. ever.

Humans are the most pinky non-dexterous species. Go on, hold your hand level with your palm down, and try to wiggle just your pinky and ring fingers out of sync, alternating up and down between each, right now.

Which is why some alternative keyboard layouts were designed - to reduce the pinky strain. Colemak-DH has the best overall pinky strain reduction. It brings pinky use from about 20% in QWERTY layout to about 8% in Colemak-DH layout.

Who here still types with their index fingers? And who switched to alternative keyboard layouts?

My favorite typist of all times was this:

View attachment 26870

Am I the only one who watched Little Britain here?
Click to expand...
With your fingers on the home row, with your two forefingers on the 'f' and 'j' keys that have the tactile position idents, your right pinky hits the "p"; it's your right hand third finger that hits the "o" in 'doas'. The typing sequence is:-

left middle finger hits 'd'
right third finger hits 'o'
left pinky hits 'a' (the only pinky hit)
left third finger his 's'

1785661824761.png


If you watch the receptionist in the "computer says no" sketches, she types like a classic "2-finger plonker", like the first time you see kids playing a piano.

Yes, they're very funny, although it might be hard for people in other countries to understand the humour. I always remember this one. :-)
View: https://www.youtube.com/watch?v=0n_Ty_72Qds

It's not like that nowadays, but "customer service" like that used to be legendary if you went back to the 60s and 70s. In fact I don't think we had even heard of "customer service" until the 80's, it was one of those new-fangled American ideas that came over here.
 
You must log in or register to reply here.
Back
Top