why is xauth needed?

[sewnie]

The xauth program is used to edit and display the authorization information used in connecting to the X server.

if removing this from the sx program still makes X function, why is it required as a dependency? is the XAUTHORITY and authentication for security purposes for Xorg applications?

[Earnestly]

Yes, see Xsecurity(7) and X(7). X11 is a network protocol that often happens to run on localhost (Xorg used to use a tcp connection in the past but now defaults to a local connection), and without either xauth or xhost based authorisation any user on the system can access your xserver.

If no other authorization mechanism is being used, this list initially consists of the host on which the server is running as well as any machines listed in the file /etc/Xn.hosts, where n is the display number of the server.

It might be nice to use xhost with the Server Interpreted but it has been awhile since I've thought about it and recall some issue with this approach not working out.

Another option, which would have been nice, is using xauth generate as it could remove the dependency on /dev/urandom. The problem then is that xauth generate requires an already running Xserver (DISPLAY) in order to generate an Xauthority entry, but the Xauthority is needed for the -auth flag when starting the server, making this a catch-22 problem.

If you can go through all of the documentation and find a way to reduce sx further, you're more than welcome to have a go. Ultimately wayland will probably replace all of this eventually, so you may want to spend your time in other ways.

[sewnie]

Ultimately wayland will probably replace all of this eventually

yeah unfortunately...

i want to run wayland as well but i'm going to pull in the X server dependencies anyway (Xwayland) so whats the point?

[Earnestly]

It may dissipate over a long enough time peroid, one can hope.

[sewnie]

still tho, having the 'con' of any program being able to access the Xserver can mean i no longer need xauth, libXmu, xhost.

alternatively, sx can be re-written in C for native X startup or management along other things.

[Baerbeisser]

Another option, which would have been nice, is using xauth generate as it could remove the dependency on /dev/urandom. The problem then is that xauth generate requires an already running Xserver (DISPLAY) in order to generate an Xauthority entry, but the Xauthority is needed for the -auth flag when starting the server, making this a catch-22 problem.

I have currently this running. Don't know anymore which traps are important though, it was a while ago i made this. I think the EXIT trap was to avoid X being stuck on failure.

...
tty=${tty#/dev/tty}

cfg_file="${XDG_CONFIG_HOME:-"$HOME"/.config}"/sxrc
state_dir=${XDG_STATE_HOME:-$HOME/.local/state}/X11
mkdir -p -- "$state_dir"

export XAUTHORITY="${XAUTHORITY:-$state_dir/Xauthority}"
touch -- "$XAUTHORITY"

#random="$(od -An -N16 -tx /dev/urandom | tr -d ' ')"
#xauth add :"$tty" MIT-MAGIC-COOKIE-1 "$random"
xauth generate :"$tty" MIT-MAGIC-COOKIE-1 trusted

trap 'cleanup; trap - INT; kill -INT "$$"' INT
trap 'cleanup exit' EXIT HUP TERM QUIT
trap 'DISPLAY=:$tty exec "${@:-$cfg_file}" & wait "$!"' USR1

(trap '' USR1 && exec Xorg :"$tty" -keeptty vt"$tty" -noreset -auth "$XAUTHORITY") & pid=$!
wait "$pid"

Ultimately wayland will probably replace all of this eventually, so you may want to spend your time in other ways.

Wayland is currently either with super-heavy (Gnome & KDE) or super-lightweight (Sway & co.), nothing inbetween. Some stacking compositors are currently underway but the tooling is still Sway & co. Still waiting for xfwm to finish.

[Earnestly]

xauth generate :"$tty" MIT-MAGIC-COOKIE-1 trusted

The only way this works is if you already have a server running on :"$tty", as per the manual:

This command is similar to add. The main difference is that instead of requiring the user to supply the key data, it connects to the server specified in displayname and uses the SECURITY extension in order to get the key data to store in the authorization file.

% xauth generate :99 MIT-MAGIC-COOKIE-1 trusted
xauth: (argv):1:  unable to open display ":99".