How can I relax the X security constraints for the jenkins daemon?

Question

It works fine on the commandline, when I do

xhost +  
su - jenkins  
emulator -avd myAVD.avd  

but

emulator -avd myAVD.avd

executed by jenkins daemon fails with

"SDL init failure: No available video device"  

How can I relax the X security constraints for the jenkins daemon,
so that it can do emulator -avd myAVD.avd without failing ?

Answer 1

The most likely reason you get the error is that emulator does not know where your display is. X11 programs use the $DISPLAY environment variable to discover the X11 server location, and the way most daemons are started they do not receive the environ variable. (Most daemons do not [and should not] need X11 to run.)

You will need to find a way to pass the current value of $DISPLAY to the daemon – note that it may change between logins.

As for security, do not ever use xhost + – it gives full access to everyone¹. Instead, give the other account access to your Xauthority data.

$ xauth extract /dev/stdout $DISPLAY | su -c "xauth merge /dev/stdin" jenkins

---

One possible way to automate all of this is to put a few commands in your ~/.xprofile... you will need ACL support enabled for the following to work:

# your .xprofile
if [ "$DISPLAY" ]; then
    touch /tmp/jenkins-display
    setfacl -m u::rw,u:jenkins:r,g::-,o::- /tmp/jenkins-display
    { echo $DISPLAY; xauth nextract /dev/stdout $DISPLAY; } > /tmp/jenkins-display
fi

and make an emulator-wrapper script for running the emulator tool:

#!/bin/sh
# a wrapper script for 'emulator'
{ read -r DISPLAY; export DISPLAY; xauth nmerge /dev/stdin; } < /tmp/jenkins-display
exec emulator "$@"

Somewhat ugly.

---

¹ "Everyone" usually means any user who can run programs on the computer – but if your X11 server is listening for TCP connections, it would mean "the whole Internet", although this is uncommon in modern distros.