X11docker: xf86OpenConsole: Cannot open virtual console

[mviereck]

sodd wrote this in issue #4 :

thx for you tip, but it does not work for me. I get this error message :(

xf86OpenConsole: Cannot open virtual console 8 (Permission denied)

when i run

/x11docker -v -exec xeye

full log->

Distributor ID: Ubuntu
Description:    Ubuntu 16.04.1 LTS
Release:    16.04
Codename:   xenial

```
Linux ntb-sodd 4.4.0-62-generic #83-Ubuntu SMP Wed Jan 18 14:10:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

Containers: 3
Running: 1
Paused: 0
Stopped: 2
Images: 81
Server Version: 1.13.0
Storage Driver: btrfs
Build Version: Btrfs v4.4
Library Version: 101
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 03e5862ec0d8d3b3f750e19fca3ee367e13c090e
runc version: 2f7393a47307a16f8cee44a37b262e8b81021e3e
init version: 949e6fa
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 4.4.0-62-generic
Operating System: Ubuntu 16.04.1 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 15.56 GiB
Name: ntb-tejr
ID: ACEB:5UDC:2WVO:H7HV:EVH2:5CVD:DW7F:PT2J:PAV3:SW6L:RKK4:FKEV
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Experimental: false
Insecure Registries:
127.0.0.0/8
Live Restore Enabled: false

```bash
./x11docker -v -exec xeye
x11docker WARNING: could not find VirtualGL.
  It has to be installed on host to use option --virtualgl. 
  You can get in here: http://www.virtualgl.org/
  Fallback: disabling option --virtualgl

x11docker WARNING: could not find executable 'xpra'. 
  Try 'apt-get install xpra' to install xpra.
  Fallback: x11docker will try to use Xephyr (option --xephyr)

x11docker WARNING: could not find executable 'Xephyr'. 
  Try 'apt-get install xephyr' to install Xephyr.
  Fallback: x11docker will try to use core X (option --X11)

x11docker WARNING: Need a window manager, but  not found. 
  Will look for another one. Look at 'x11docker --help' to see a list
  of recommended window managers.

x11docker WARNING: Will use window manager '/usr/bin/xfwm4'

x11docker WARNING: Cannot share clipboard. Need package 'xclip' to be
  installed. Try installing xclip with command: 'apt-get install xclip'

x11docker: Found free display :1

x11docker: As X server will be used: X11

x11docker: IP of docker interface is 172.17.0.1/16

x11docker: As display for the container :1 will be used

x11docker: Created docker command:
# dontrundocker  xeye

x11docker: Created X server command:
/usr/bin/X :1 vt8  +extension Composite +extension RANDR +extension RENDER +extension GLX +extension XVideo +extension DOUBLE-BUFFER +iglx +extension X-Resource +extension SECURITY +extension DAMAGE -auth /home/sodd/.cache/x11docker/X1/Xservercookie -retro -extension MIT-SHM -nolisten tcp +extension XFree86-DRI +extension XFree86-DGA +extension XFree86-VidModeExtension -verbose -extension XTEST

x11docker: Found window manager: '/usr/bin/xfwm4'

x11docker: Created xinitrc: #! /bin/bash
set -x  # make bash verbose
BGPIDFILE=/home/sodd/.cache/x11docker/X1/backgroundpids
storepid () 
{ 
    echo $1 $2 >> $BGPIDFILE
}
# set X variables to host display
export DISPLAY=:0.0
export XAUTHORITY=/home/sodd/.Xauthority
no_xhost () 
{ 
    xhost | tail -n +2 /dev/stdin | while read LINE; do
        xhost -$LINE;
    done;
    xhost -
}
# create empty Xcookie file
:> /home/sodd/.cache/x11docker/X1/Xclientcookie
# set X variables to new display
export DISPLAY=:1
export XAUTHORITY=/home/sodd/.cache/x11docker/X1/Xclientcookie
# set background color of root window. #7F7F7F is color of xfwm4 background
xsetroot -solid "#7F7F7F"
# create new XAUTHORITY cookies
xauth generate :1 . untrusted
cp /home/sodd/.cache/x11docker/X1/Xclientcookie /home/sodd/.cache/x11docker/X1/Xservercookie
xauth list
# start window manager, if defined
/usr/bin/xfwm4 &
WINDOWMANAGERPID=$!
storepid $! xfwm4
# disable any possible access to new X server granted by xhost
no_xhost
# run host application (window manager is already running)
 xeye &
storepid $! xeye
wait $!
# clean up background jobs
# ( can already be empty, see case onlyX above. maybe window manager wasn't running at all)
XINITJOBSTOKILL="$XINITJOBSTOKILL $WINDOWMANAGERPID"
for ARGUMENT in $XINITJOBSTOKILL ; do kill $ARGUMENT ; done
# set X variables back to host display
export DISPLAY=:0.0
export XAUTHORITY=/home/sodd/.Xauthority

cat: /home/sodd/.cache/x11docker/X1/xtermrc: No such file or directory
x11docker: Created xtermrc: 

x11docker: Logfiles are:
/home/sodd/.cache/x11docker/X1/xinit.log
/home/sodd/.cache/x11docker/X1/xpraserver.log
/home/sodd/.cache/x11docker/X1/xterm.log
/home/sodd/.cache/x11docker/X1/docker.log

x11docker: Running X server X11 on display :1 now ...

==> /home/sodd/.cache/x11docker/X1/xinit.log <==


X.Org X Server 1.18.4
Release Date: 2016-07-19
X Protocol Version 11, Revision 0
Build Operating System: Linux 4.4.0-45-generic x86_64 Ubuntu
Current Operating System: Linux ntb-sodd 4.4.0-62-generic #83-Ubuntu SMP Wed Jan 18 14:10:15 UTC 2017 x86_64
Kernel command line: BOOT_IMAGE=/vmlinuz-4.4.0-62-generic.efi.signed root=UUID=640c3f5a-1887-4faf-bf8f-7b72286f179f ro rootflags=subvol=@
Build Date: 02 November 2016  10:06:10PM
xorg-server 2:1.18.4-0ubuntu0.2 (For technical support please see http://www.ubuntu.com/support) 
Current version of pixman: 0.33.6
    Before reporting problems, check http://wiki.x.org
    to make sure that you have the latest version.
Markers: (--) probed, (**) from config file, (==) default setting,
    (++) from command line, (!!) notice, (II) informational,
    (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
(==) Log file: "/home/sodd/.local/share/xorg/Xorg.1.log", Time: Sat Feb 11 19:39:33 2017
(==) Using system config directory "/usr/share/X11/xorg.conf.d"
(==) No Layout section.  Using the first Screen section.
(==) No screen section available. Using defaults.
(**) |-->Screen "Default Screen Section" (0)
(**) |   |-->Monitor "<default monitor>"
(==) No monitor specified for screen "Default Screen Section".
    Using a default monitor configuration.
(==) Automatically adding devices
(==) Automatically enabling devices
(==) Automatically adding GPU devices
(==) Max clients allowed: 256, resource mask: 0x1fffff
(WW) The directory "/usr/share/fonts/X11/cyrillic" does not exist.
    Entry deleted from font path.
(WW) The directory "/usr/share/fonts/X11/100dpi/" does not exist.
    Entry deleted from font path.
(WW) The directory "/usr/share/fonts/X11/75dpi/" does not exist.
    Entry deleted from font path.
(WW) The directory "/usr/share/fonts/X11/100dpi" does not exist.
    Entry deleted from font path.
(WW) The directory "/usr/share/fonts/X11/75dpi" does not exist.
    Entry deleted from font path.
(==) FontPath set to:
    /usr/share/fonts/X11/misc,
    /usr/share/fonts/X11/Type1,
    built-ins
(==) ModulePath set to "/usr/lib/x86_64-linux-gnu/xorg/extra-modules,/usr/lib/xorg/extra-modules,/usr/lib/xorg/modules"
(II) The server relies on udev to provide the list of input devices.
    If no devices become available, reconfigure udev or disable AutoAddDevices.
(++) using VT number 8

(II) systemd-logind: logind integration requires -keeptty and -keeptty was not provided, disabling logind integration
(II) xfree86: Adding drm device (/dev/dri/card0)
(EE) /dev/dri/card0: failed to set DRM interface version 1.4: Permission denied
(II) config/udev: Ignoring already known drm device (/dev/dri/card0)
(--) PCI:*(0:0:2:0) 8086:1616:1028:062c rev 9, Mem @ 0xf6000000/16777216, 0xe0000000/268435456, I/O @ 0x0000f000/64
(II) Loading /usr/lib/xorg/modules/extensions/libglx.so
(II) Module glx: vendor="X.Org Foundation"
    compiled for 1.18.4, module version = 1.0.0
(==) AIGLX enabled
(==) Matched intel as autoconfigured driver 0
(==) Matched modesetting as autoconfigured driver 1
(==) Matched fbdev as autoconfigured driver 2
(==) Matched vesa as autoconfigured driver 3
(==) Assigned the driver to the xf86ConfigLayout
(II) Loading /usr/lib/xorg/modules/drivers/intel_drv.so
(II) Module intel: vendor="X.Org Foundation"
    compiled for 1.18.4, module version = 2.99.917
(II) Loading /usr/lib/xorg/modules/drivers/modesetting_drv.so
(II) Module modesetting: vendor="X.Org Foundation"
    compiled for 1.18.4, module version = 1.18.4
(II) Loading /usr/lib/xorg/modules/drivers/fbdev_drv.so
(II) Module fbdev: vendor="X.Org Foundation"
    compiled for 1.18.1, module version = 0.4.4
(II) Loading /usr/lib/xorg/modules/drivers/vesa_drv.so
(II) Module vesa: vendor="X.Org Foundation"
    compiled for 1.18.1, module version = 2.3.4
(II) intel: Driver for Intel(R) Integrated Graphics Chipsets:
    i810, i810-dc100, i810e, i815, i830M, 845G, 854, 852GM/855GM, 865G,
    915G, E7221 (i915), 915GM, 945G, 945GM, 945GME, Pineview GM,
    Pineview G, 965G, G35, 965Q, 946GZ, 965GM, 965GME/GLE, G33, Q35, Q33,
    GM45, 4 Series, G45/G43, Q45/Q43, G41, B43
(II) intel: Driver for Intel(R) HD Graphics: 2000-6000
(II) intel: Driver for Intel(R) Iris(TM) Graphics: 5100, 6100
(II) intel: Driver for Intel(R) Iris(TM) Pro Graphics: 5200, 6200, P6300
(II) modesetting: Driver for Modesetting Kernel Drivers: kms
(II) FBDEV: driver for framebuffer: fbdev
(II) VESA: driver for VESA chipsets: vesa
(EE) 
Fatal server error:
(EE) xf86OpenConsole: Cannot open virtual console 8 (Permission denied)
(EE) 
(EE) 
Please consult the The X.Org Foundation support 
     at http://wiki.x.org
 for help. 
(EE) Please also check the log file at "/home/sodd/.local/share/xorg/Xorg.1.log" for additional information.
(EE) 
(WW) xf86CloseConsole: KDSETMODE failed: Bad file descriptor
(WW) xf86CloseConsole: VT_GETMODE failed: Bad file descriptor
(EE) Server terminated with error (1). Closing log file.
xinit: giving up
xinit: unable to connect to X server: Connection refused
xinit: server error
./x11docker: line 457:  2581 Terminated              tail --retry -n +1 -F $XTERMLOGFILE $DOCKERLOGFILE $XPRALOGFILE $XINITLOGFILE 2> /dev/null

[mviereck]

Hello sodd,

this problem seems to be specific to Ubuntu 16.04 + 16.10. See bugreport on launchpad: https://bugs.launchpad.net/ubuntu/+source/xinit/+bug/1562219

I will look through the bug report, maybe I can find a workaround.

[mviereck]

Curiously, I don't get this error with Xubuntu 16.04 in VirtualBox.

I've looked through the bugreport on launchpad, but don't have good news. Most provided workarounds need root privileges to run X, which is strongly discouraged. (Would be possible running x11docker as root).

One possible workaround: Run x11docker in verbose mode to see which virtual console will be used:
x11docker: Created X server command: /usr/bin/X :1 vt8 [...]
Most times it will be vt8. vt8 complies to /dev/tty8
Try this:
sudo setfacl -m u:$USER:rw /dev/tty8
Now x11docker respective X should be able to use vt8.

Also you can try to log in to tty1 and run x11docker there. I'm not sure if this will work as I cannot reproduce the error with Xubuntu in VirtualBox.

[sodd]

When i try your first workaround with setfacl and then xinit xterm :3 vt8 it will show me xterm but i can't move or use my mouse or keyboard.

second workaround works only for xinit command but it's not so good as run one command from primary display.
But thx anyway for your answers :+1:

EDIT: i can't run x11docker -e xterm because it will try access to same vt8. Is there any argument for x11docker for setup vt to vt1 ?

[mviereck]

Is there any argument for x11docker for setup vt to vt1

I've created a new developer option --vt N to set the virtual console N to use in V1.6.0. You can see it with x11docker-gui -d.
Strange enough, it works for tty1-tty6 regardless if I'm logged in into there or not (debian 8).

If this works for you from your primary display, it may be a reasonable workaround until Canonical fixes the bug.

i can't run x11docker -e xterm because it will try access to same vt8.

This should not happen as X should create a file /tmp/.X11-unix/X1 for vt8 (X0 for vt7). x11docker checks this files. Is this file missing in Ubuntu? Do you have /tmp/.X0-lock and /tmp/.X1-lock while running x11docker ?

[sodd]

X should create a file /tmp/.X11-unix/X1 for vt8
Is this file missing in Ubuntu? Do you have /tmp/.X0-lock and /tmp/.X1-lock while running x11docker ?

When i run xinit xterm -- :5 vt1 on first virtual terminal, everything works and i see /tmp/.X11-unix/X5 and /tmp/.X5-lock

But when i try:
./x11docker -v --cache --vt 1 -e xterm

I'll get:

(EE) xf86OpenConsole: Cannot open virtual console 1 (Permission denied)

and there is no file in /tmp/.X11-unix except X0 and no .X0-lock or anything similar
I'm little confused

[mviereck]

I'm little confused

Me too ;-). And I still have no way to check if a vt is in use or not - I just assume it based on the files in /tmp/.X11-unix, but that's not reliable.

But when i try: ./x11docker -v --cache --vt 1 -e xterm

Just to clarify: You tried this on tty1? And it didn't work, while xinit on tty1 works?

I've searched around a bit - as Ubuntu bases on debian testing instead of debian stable (afaik), this bug report for debian sid in 2015 may be related: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801605
There are several workarounds you could try.

The least invasive one is to edit /etc/X11/Xwrapper.config adding a line needs_root_rights=yes.

Are packages libpam-systemd and systemd-shim installed on your system? Installing these solved the problem for someone.

debian 9 testing will become debian 9 stable soon. I'm curious if this bug will affect debian 9 stable (and then me, too ...).

Other possible workarounds that could allow starting x11docker -X11 from primary display:
Check which vt will be used (or set it with --vt) like mentioned above: x11docker: Created X server command: /usr/bin/X :1 vt8 [...]
Change ownership or permissions for the complying tty:
Either
sudo chmod 0600 /dev/tty8
or
sudo chown $USER /dev/tty8
could do the trick.
After a reboot this changes will be lost.

Another possible workaround could be getting member of group tty. I'm not sure whether this is a security risc, but seems to be harmless. Found on https://wiki.debian.org/SystemGroups :

tty: TTY devices are owned by this group. This is used by write and wall to enable them to write to other people's TTYs, but it is not intended to be used directly.

Just to be sure: You have already reconfigured x11-common respective xserver-xorg-legacy to anybody?

[mviereck]

I've installed Ubuntu 16.04 in VirtualBox and tested the workarounds mentioned above. None of them works except one:

Edit /etc/X11/Xwrapper.config and add line needs_root_rights=yes

This line is explained here: https://www.mankier.com/1/Xorg.wrap
I'm not sure about security risks concerning this setting. X will be executed with root privileges.

Edit 1:
Related this bug report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=801401
As a legacy solution X worked with setuid. Nowadays it should get its privileges by systemd-logind, but here is a bug to be fixed. As far as I understand, a systemd service file has to be created. This would be a better solution than using xserver-xorg-legacy.

Edit 2:
debian 9 needs xserver-xorg-legacy to be installed and reconfigured, too, if I want to use --X11 from within X. But running from tty1-tty6 works fine, contrary to Ubuntu 16.04.

[sodd]

Thx for your research and my apologies for too late response.

If i set needs_root_rights=yes it will start work but as you said X is executed with root privileges.

[mviereck]

If i set needs_root_rights=yes it will start work but as you said X is executed with root privileges.

Yes, I'm not happy with this. But (and that was not clear to me), X running as root was default until debian 8 and Ubuntu 14.04. This changed with debian 9 which will become stable soon.

Ubuntu 16.04 bases on debian 9 unstable and has some bugs due to basing on unstable. Therefore the problems running x11docker from console in 16.04.

To avoid running X as root, I recommend to use debian 9 (instead of Ubuntu) as soon as it become stable. Then it is possible to run unprivileged X from console.

I've just posted a related question on stackexchange: Run second X server from within X as a systemd service