Comment 8 for bug 276357

Revision history for this message
Kees Cook (kees) wrote :

I don't have any objection to this. It seems safe if it actually works as documented. :)
Note the caveat from the end of "man Xsecurity":

              If your system supports [localuser] and you use it, be warned
              that some programs that proxy connections and are setuid or set‐
              gid may get authenticated as the uid or gid of the proxy pro‐
              cess. For instance, some versions of ssh will be authenticated
              as the user root, no matter what user is running the ssh client,
              so on systems with such software, adding access for
              localuser:root may allow wider access than intended to the X
              display.

As such, it should probably be tested with things that are known to do funny uid things, like the PolicyKit password helpers, etc. As long as those still work when the hostname changes, this seems like a reasonable addition.