Ryfujk

To use xauth selectively, as user1 run:

xauth list|grep `uname -n`

This prints the hexkey authorization entries for you . You could have different displays associated with those hosts as well.

As user2 set your display (assuming default case):

DISPLAY=:0; export DISPLAY

Then run:

xauth add $DISPLAY . hexkey

Note the dot after the $DISPLAY and before the hexkey.

When access is no longer needed, as user2 you can run:

xauth remove $DISPLAY

I put in my .zshrc a line with export XAUTHORITY=~/.Xauthority and now I am able to execute sudo -E xcommand. After a lot of googling, for me this was the easiest way.

Assuming debian or ubuntu (should be similar on Red Hat / SUSE).

sudo apt-get install sux

sux user -c 'command'

First: Don't use xhost +, it's rather insecure (blanket allow/deny).

Rather use the X-Cookie mechanism:

su user2

cp /home/user1/.Xauthority /home/user2/.Xauthority 

export DISPLAY=:0

Alternatively, if you have sux installed, use that (see ehempel's answer).

In both cases user2 will use the secret cookie in .Xauthority to authorize to the X server, and no one else will have access to it.

Notes:

• Depending on your file permissions, you might have to copy .Xauthority in some other way.


• Instead of copying .Xauthority, you can also use xauth to extract and copy the authorization key (see Randall's answer). If you have multiple keys in the .Xauthority file this is more selective; otherwise it is a matter of taste.

This will fix the problem for all users:

cat <<EOF > /etc/profile.d/xauth.sh

#!/sbin/bash

export XAUTHORITY=~/.Xauthority

EOF

As root:

xhost local:yourusername

Where yourusername is your user name :)

Then do su as your user
xclock should work if it's installed

These are just hacks:

• xauth + (unsecure)


• ssh -X user2@localhost (ugly)

sleske above has, I think, the proper solution.

This way made in suse/opensuse :
http://www.novell.com/support/kb/doc.php?id=7003743

Simply modifying the /etc/pam.d/su, adding the option (bold) :

session optional pam_xauth.so systemuser=1

Then you can switch with su without - :

su user2

and run the app graphically.

Thids is WAY TOO CONVOLUTED for me who just wants to use Synaptic on Bionic Beaver.

I try one solution and that leads me to 20 other "things" that don't work as they should so all you have in the end is a bunch of half measures trying to hold the OS together with bubble gum and shoestrings.

Who are these people that work for nothing and have probably had very little formal traiing training to maintain and upgrade an OS let alone writing good software that's well tested with no knowledge or understanding of of the whole which ultimately becomes a patch to a patch for a patch. With each release it just gets worse.

Same thing happened to Firefox causing them to abandon all those years of effort to become a branch of Chrome. Even Windows isn't all that great but it works well enough to be reliable. If the government hadn't gave them a pass on liability it would be a much better system.

Time to face the fact that unpaid software will never be a good solution in a capitalist world.

For GNOME (and without any desktop environment really, I use it with icewm only) gksu:

gksu -u username program