Re: How to use gksu to safely run a non-open-source application?

[Jack Dodds <brmdamon aci on ca>]

Hello Mart,

Thanks for your advice.  I had to modify your suggested sudoers entry 
(just as well - it forced me to read the sudoers manpage!)  so now I 
have this in sudoers:

  %realplay        ALL = (realplay) NOPASSWD: 
/home/realplay/RealPlayer/realplay

which allows anyone in the realplay group to use sudo to execute 
realplay as user realplay.

However, RealPlayer doesn't like being run by sudo.  If I enter in a 
terminal:

  sudo -u realplay /home/realplay/RealPlayer/realplay

I get:

  Xlib: connection to ":0.0" refused by server
  Xlib: No protocol specified
  ** ERROR **: Unable to open display
  aborting...
  /home/realplay/RealPlayer/realplay: line 75:  2185 
Aborted                 $REALPLAYBIN "$@"

This is much the same result that I get if I try to use su to run 
realplay - and the problem is fixed by using gksu instead. So, I looked 
for and found a gksudo command.  It appears to be recently changed, so I 
apt-get upgrade'd my Sarge system to the latest versions, and tried 
using it.  Now if I enter in a terminal:

  gksudo -u realplay /home/realplay/RealPlayer/realplay

I get:

  Xlib: connection
  ** ERROR **: Unable to open display
  aborting...
  /home/realplay/RealPlayer/realplay: line 75:  2226 
Aborted                 $REALPLAYBIN "$@"

There are some complications here: realplay is a script that runs 
realplay.bin, the actual program.  To check if this (or some other 
peculiarity of RealPlayer) is the problem, I added a line for 
/usr/bin/gedit to my sudoers file.  Then I tried:

  gksudo -u realplay /usr/bin/gedit

I get a result much like that with realplay:

  Xlib: connection
  (gedit:2770): Gtk-WARNING **: cannot open display:



SUMMARY:

My system is Debian Sarge, up-to-date as of two or three days ago.

If (as user jack) I enter in gnome-terminal the command:

gksu -u realplay /home/realplay/RealPlayer/realplay

I can run RealPlayer, complete with its graphical control on jack's 
desktop, as another user (realplay), and it works fine, BUT I have to 
enter realplay's password, which I do not want to have to do.

With appropriate entries in /etc/sudoers, I can use gksudo in 
gnome-terminal to run realplay OR gedit as realplay, but in both cases I 
get errors like:

Xlib: connection
  (gedit:2770): Gtk-WARNING **: cannot open display:


So - Am I doing something stupid, or is there a bug in gksudo?

Hopefully someone can shed some light on this!


Jack Dodds