From 04bcb684b36e6b7462af566c0ce96ef87bb57698 Mon Sep 17 00:00:00 2001
From: Blake Ridgway <blake@blakeridgway.com>
Date: Fri, 21 Aug 2026 20:31:19 -0500
Subject: [PATCH] fix: run the live X session as an unprivileged user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The workstation ISO failed to start X with:

    (EE) unrecognized option --allow-root

Debian trixie ships Xorg 21.1.x, which removed --allow-root / -allowRoot
entirely — running the X server as root is no longer supported. The live
session now:

- creates a dedicated unprivileged `liveuser` account (in tty, video,
  input, audio groups) in build-live.sh;
- starts Xorg as `liveuser` on vt1 (no -allow-root flag at all);
- grants root display access (xhost +SI:localuser:root);
- still runs the installer itself as root, since deploy-disk.sh needs
  root. xinit is no longer used (and dropped from the package list).
---
 installer/README.md                           |  8 +++--
 .../usr/local/sbin/arcline-installer-session  | 34 +++++++++++++++----
 scripts/build-live.sh                         |  9 ++++-
 3 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/installer/README.md b/installer/README.md
index eb936ae..fea30d6 100644
--- a/installer/README.md
+++ b/installer/README.md
@@ -47,9 +47,11 @@ the live session with the installer in it.
 ## Autostart
 
 `overlays/live/etc/systemd/system/arcline-installer.service` starts
-`arcline-installer-session` on boot: it launches Xorg on vt1 (with
-`-allow-root`, since the live session runs as root) and the installer as the
-X client. When the installer exits, X and the session end.
+`arcline-installer-session` on boot. Modern Xorg (trixie 21.1.x) refuses to
+run as root, so the session script starts Xorg as the dedicated unprivileged
+`liveuser` account on vt1, grants root display access (`xhost
++SI:localuser:root`), then runs the installer as root (it needs root for
+`deploy-disk.sh`). When the installer exits, X and the session end.
 
 ## Manual run (for development / on a box without the ISO)
 
diff --git a/overlays/live/usr/local/sbin/arcline-installer-session b/overlays/live/usr/local/sbin/arcline-installer-session
index a2af0c3..3106405 100755
--- a/overlays/live/usr/local/sbin/arcline-installer-session
+++ b/overlays/live/usr/local/sbin/arcline-installer-session
@@ -1,11 +1,33 @@
 #!/usr/bin/env bash
-# Arcline OS — live session: start X on vt1 and launch the graphical installer.
-# Runs as root in the live session; Xorg needs -allow-root for that.
+# Arcline OS — live session: start X as an unprivileged user, then launch the
+# graphical installer as root on that display.
+#
+# Modern Xorg (Debian trixie 21.1.x) refuses to run as root — the
+# --allow-root / -allowRoot option was removed. So X runs as the dedicated
+# `liveuser` account, root is granted display access, and the installer (which
+# needs root to run deploy-disk.sh) connects to it.
 set -euo pipefail
 
 export DISPLAY=:0
-# clear any stale lock from a previous session in the same live boot
-rm -f /tmp/.X0-lock /tmp/.X11-unix/X0
+LXUSER=liveuser
 
-exec xinit /usr/local/bin/arcline-installer -- \
-  /usr/bin/Xorg -allow-root -nolisten tcp -keeptty :0 vt1
+# 1. start Xorg as the unprivileged user on vt1 (no -allow-root; it's gone)
+runuser -u "$LXUSER" -- /usr/bin/Xorg :0 vt1 -nolisten tcp &
+XPID=$!
+
+# 2. wait for the X socket
+for _ in $(seq 1 60); do
+  [[ -S /tmp/.X11-unix/X0 ]] && break
+  sleep 0.5
+done
+[[ -S /tmp/.X11-unix/X0 ]] || { echo "error: Xorg did not come up on :0" >&2; kill "$XPID" 2>/dev/null || true; exit 1; }
+
+# 3. let root open windows on this display
+runuser -u "$LXUSER" -- xhost +SI:localuser:root >/dev/null 2>&1 || true
+
+# 4. run the installer as root (deploy-disk.sh needs root)
+runuser -u root -- env DISPLAY=:0 /usr/local/bin/arcline-installer
+rc=$?
+
+kill "$XPID" 2>/dev/null || true
+exit "$rc"
diff --git a/scripts/build-live.sh b/scripts/build-live.sh
index 3c1648d..db3d5b0 100755
--- a/scripts/build-live.sh
+++ b/scripts/build-live.sh
@@ -59,10 +59,17 @@ chroot_run "export DEBIAN_FRONTEND=noninteractive
 apt-get update -qq
 apt-get install -y --no-install-recommends \
   live-boot live-config-systemd live-tools \
-  xserver-xorg xinit x11-xserver-utils openbox \
+  xserver-xorg x11-xserver-utils openbox \
   python3-gi gir1.2-gtk-3.0 gdisk parted dosfstools \
   | tee /tmp/live-packages.log"
 
+# Modern Xorg refuses to run as root, so the live session runs as a dedicated
+# unprivileged user. It needs the tty group for the VT and video/input for
+# DRM + input devices.
+log "[1b/4] creating unprivileged session user (liveuser)"
+chroot_run "useradd -m -s /bin/bash liveuser 2>/dev/null || true
+usermod -aG tty,video,input,audio,cdrom,plugdev,users liveuser 2>/dev/null || true"
+
 # ── 3. ship the graphical installer + deploy tooling ────────────────────────
 log "[2/4] installing installer + deploy tooling"
 install -Dm0755 "$ROOT/installer/arcline-installer" "$LIVE_ROOT/usr/local/bin/arcline-installer"