startx leaks .serverauth.???? files

Bug #35758 reported by Akkana Peck on 2006-03-20
6
Affects Status Importance Assigned to Milestone
xinit (Debian)
Fix Released
Unknown
xinit (Ubuntu)
Low
Unassigned

Bug Description

If you run X from startx on any ubuntu release through the current Dapper, and normally shut down the machine from within X, you'll accumulate large numbers of files in $HOME named .serverauth.????, one for each time you ever ran startx.

The problem: /usr/bin/startx creates a file called $HOME/.serverauth.$$, runs xinit, then removes the file. If startx exits ungracefully -- for instance, if the shutdown sequence sends it a kill signal (the script doesn't catch signals) -- the file will never be removed.

It's not clear to me what this serverauth code is doing anyway. gdm, kdm and xdm don't seem to use it at all; does startx really need it?

But if it does need it, why not use the existing XAUTHORITY code to set the filename (which apparently is what it used to use)? This XAUTHORITY block of code (defaulting to $HOME/.Xauthority unless previously set) appears to be a redundant way of setting the same filename; XAUTHORITY is set in the startx script and then it isn't used, either in startx itself or in anything else in /usr/bin or /etc/X11. From man xauth and from looking at the contents of the two files, it looks like they're the same file by two different names. Having XAUTHORITY set to a filename that isn't actually created is probably wrong, isn't it?

Matt Zimmerman (mdz) on 2006-04-07
Changed in xinit:
status: Unconfirmed → Confirmed
Akkana Peck (akkzilla) wrote :

Just in case anyone's wondering, this bug is still there in feisty.
I still have to edit /usr/bin/startx on each new install if I don't want those .serverauth.???? files to pile up forever in my homedir.

Timo Aaltonen (tjaalton) on 2007-05-15
Changed in xinit:
importance: Medium → Low
Changed in xinit:
status: Unknown → Unconfirmed

Debian has this same problem. There is a solution.

Edit the file "/usr/bin/startx". Find the line that says:
xserverauthfile=$HOME/.serverauth.$$

Edit it to say:
xserverauthfile=$XAUTHORITY

Done!

I got this from "http://taosecurity.blogspot.com/2006/09/eliminating-serverauth-files.html".

-Brandon

Changed in xinit:
status: New → Fix Committed
Changed in xinit:
status: Fix Committed → Fix Released
Timo Aaltonen (tjaalton) wrote :

This is now fixed in hardy.

Changed in xinit:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.