What does your non-Debian desktop look like?

[ruffwoof]

Yes I use Xenodm. Someone (developer I believe) on reddit suggested that it was more secure to run X as user that way. I was tracking current (having only recently switched over to that from stable), but a late upgrade had no chromium available on the mirror I use so I reverted to 6.4 release.

The image was captured by running a tmux in X, more usually I run that on the console so the dotted lines return anyway (using TERM=pccon0 keeps the colours and seems to work well IME). Works great when you ssh into that box and tmux attach to its session. (I know you know all this but for the benefit of others) Any old low powered device - provided it can run ssh then has access to all of the tmux windows/functions. Nice for collaboration also as you both can control/see the exact same things when actions/changes are made.

[Head_on_a_Stick]

Someone (developer I believe) on reddit suggested that it was more secure to run X as user that way

Yes, I see now that X is running as the _x11 user, this means it uses a chrooted sandbox, which is a major advantage.

I can get X working without xenodm on my -current box by applying the setuid bit to the Xorg binary but then X runs as my user (which is Very Bad).

This message on cvs@ cleared things up for me:

Disable setuid on the X server. We have always known it is a trash fire
and we held out hope too long.

https://marc.info/?l=openbsd-cvs&m=154050453117246&w=2

So it looks like I should have been using xenodm all along...

Also, I used the setuid bit in my Alpine Linux box so I could run X as my normal user rather than root — how dumb is that decision looking now?

Scrot:



EDIT: to avoid bad mirrors, try the redirect service:

Code: Select all

Puffy:~$ cat /etc/installurl                                   
https://fastly.cdn.openbsd.org/pub/OpenBSD
Puffy:~$

^ That should work well anywhere in the world (theoretically).

[ruffwoof]

I was running X as user myself until it was pointed out to use Xenodm. Others are also seeing some light https://old.reddit.com/r/openbsd/comments/9rnjx7/xorg_privilege_escalation/ and one of those links to https://www.openbsd.org/errata64.html

001: SECURITY FIX: October 25, 2018 All architectures
The Xorg X server incorrectly validates certain options, allowing arbitrary files to be overwritten. As an immediate (temporary) workaround, the Xorg binary can be disabled by running: chmod u-s /usr/X11R6/bin/Xorg
A source code patch exists which remedies this problem.

[Head_on_a_Stick]

^ I was tempted to submit a patch for the webpage to correct their tagline, which will have to be changed to

Only three remote holes in the default install, in a heck of a long time!

No wonder Theo is so pissed...

[ruffwoof]

I don't have any root owned setuid's open to 'others', chmod'd them all so only owner and group have access to those. But then again I don't run any root windows/tasks under X, and 'user' isn't a member of group wheel (no su), nor have I any doas configured (no sudo type functions either). I only run root/admin tasks from within a console session (tmux/mc/dialog).

Code: Select all

# find / -user root -perm -4000 -exec chmod o-wrx {} \;

Primarily I use X only to run chromium (pledged/unveiled) and use that for playing mp4's, viewing/creating PDF's ...etc. so contained, as though X/chromium were in a sandbox/container. Data (docs etc) are owned by root (isolated from user).

[ruffwoof]

EDIT: to avoid bad mirrors, try the redirect service:

Code: Select all

Puffy:~$ cat /etc/installurl                                   
https://fastly.cdn.openbsd.org/pub/OpenBSD
Puffy:~$

^ That should work well anywhere in the world (theoretically).

Big thanks.

OpenBSD Base (-current) + mc + chromium meets most of my desktop needs

Console (captured a copy in X as I can't snap the actual console, console appearance is however very similar to this image)


X


With chromium pledged/unveiled, anything else run by chromium also falls under that umbrella (playing mp4's, creating/viewing PDF's, online email ...etc.).

[None1975]

Devuan 2.0.0 ASCII with my favorite wm-Xmonad

[HuangLao]

Is there a gui script for shutdown, reboot, suspend etc... for WM's and Debian or Devuan?

[Head_on_a_Stick]

Is there a gui script for shutdown, reboot, suspend etc... for WM's and Debian or Devuan?

I use

Code: Select all

# ln -s $(which systemctl) /usr/local/bin/{reboot,poweroff}

Then call `reboot` & `poweroff` from `dmenu`

Alternatively, try this python script:

https://gist.github.com/Head-on-a-Stick ... 4dad1b2754

^ That requires systemd though.

EDIT: scrot to stay on-topic:

[None1975]

Is there a gui script for shutdown, reboot, suspend etc... for WM's and Debian or Devuan?

In system with systemd init system, you can use this little script (it work with dmenu). Just bind this script to hot-key.

Code: Select all

#!/bin/sh

cmd=$(printf "poweroff\nreboot\nlock\n" | dmenu -p "Execute:" $*)

if [ -z "$cmd" ]; then
   exit 0
fi

case "$cmd" in
   poweroff)
      systemctl poweroff ;;
   reboot)
      systemctl reboot ;;
   lock)
      i3lock --color '#000000'  ;;
   *)
      printf "Option not recognized: %s\n" "$cmd" >&2
esac




[Nili]

Is there a gui script for shutdown, reboot, suspend etc... for WM's and Debian or Devuan?

From my Obmenu:

Code: Select all

urxvt -bl -geometry 50x1-400+450 -e sudo /sbin/reboot

Code: Select all

urxvt -bl -geometry 50x1-400+450 -e sudo /sbin/poweroff

I do not hesitate to put the password once in ten days to do reboot/shutdown. Sorry, No script from me.

[ruffwoof]

In OpenBSD, X only runs as user, I've set all root owned setuid's off for 'others', no doas/su/sudo ...etc.). For root I just ctrl-alt-F4 into a root console/terminal and do 'admin' stuff from there. I have the console set to run tmux, mostly use mc for file manager and text editor, and have a tput based 'menu' ... so it has a BBS type look and feel. Shutdown is one of those menu options.

This is a picture of the actual console

[Nili]

Openbox>Tint2>Conky>DeaDBeeF

[None1975]

As always, Nili, looks nice. Keep a good work!

[Nili]

Thank you None1975