GET https://kbin.spritesserver.nl/index.php/m/linux@lemmy.ml/t/29681/Wayland-running-GUI-program-as-another-user/comment/309187/favourites

Response
200 OK
IP
216.73.216.97
Profiled on
Token
0bafc3

Security

Token

There is no security token.

Firewall

main Name
Security enabled
Stateless

Configuration

Key Value
provider security.user.provider.concrete.app_user_provider
context main
entry_point App\Security\KbinAuthenticator
user_checker App\Security\UserChecker
access_denied_handler (none)
access_denied_url (none)
authenticators 
[
  "two_factor"
  "remember_me"
  "App\Security\KbinAuthenticator"
  "App\Security\FacebookAuthenticator"
  "App\Security\GoogleAuthenticator"
  "App\Security\GithubAuthenticator"
  "App\Security\KeycloakAuthenticator"
]

Listeners

Listener Duration Response 
Symfony\Component\Security\Http\Firewall\ChannelListener {#723
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
  -logger: Monolog\Logger {#783 …}
  -httpPort: 80
  -httpsPort: 443
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\ContextListener {#706
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorage {#1017 …}
  -sessionKey: "_security_main"
  -logger: Monolog\Logger {#783 …}
  -userProviders: Symfony\Component\DependencyInjection\Argument\RewindableGenerator {#705 …}
  -dispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
  -registered: false
  -trustResolver: Scheb\TwoFactorBundle\Security\Authentication\AuthenticationTrustResolver {#780 …}
  -sessionTrackerEnabler: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage::enableUsageTracking(): void {#703 …}
}
 0.75 ms (none) 
Symfony\Component\Security\Http\Firewall\AuthenticatorManagerListener {#584
  -authenticatorManager: Symfony\Component\Security\Http\Authentication\AuthenticatorManager {#595 …}
}
 0.00 ms (none) 
Scheb\TwoFactorBundle\Security\Http\Firewall\TwoFactorAccessListener {#582
  -twoFactorFirewallConfig: Scheb\TwoFactorBundle\Security\TwoFactor\TwoFactorFirewallConfig {#842 …}
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -twoFactorAccessDecider: Scheb\TwoFactorBundle\Security\Authorization\TwoFactorAccessDecider {#581 …}
}
 0.04 ms (none) 
Symfony\Component\Security\Http\Firewall\AccessListener {#579
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -accessDecisionManager: Symfony\Component\Security\Core\Authorization\TraceableAccessDecisionManager {#937 …}
  -map: Symfony\Component\Security\Http\AccessMap {#722 …}
}
 0.00 ms (none) 
Symfony\Component\Security\Http\Firewall\LogoutListener {#786
  -tokenStorage: Symfony\Component\Security\Core\Authentication\Token\Storage\UsageTrackingTokenStorage {#1018 …}
  -options: [
    "csrf_parameter" => "_csrf_token"
    "csrf_token_id" => "logout"
    "logout_path" => "app_logout"
  ]
  -httpUtils: Symfony\Component\Security\Http\HttpUtils {#841 …}
  -csrfTokenManager: Symfony\Component\Security\Csrf\CsrfTokenManager {#1015 …}
  -eventDispatcher: Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher {#747 …}
}
 0.00 ms (none)

Authenticators

No authenticators have been recorded. Check previous profiles on your authentication endpoint.

Access Decision

affirmative Strategy
# Voter class
1 
"Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter"
2 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
3 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
4 
"Symfony\Component\Security\Core\Authorization\Voter\ExpressionVoter"
5 
"App\Security\Voter\EntryCommentVoter"
6 
"App\Security\Voter\EntryVoter"
7 
"App\Security\Voter\MagazineVoter"
8 
"App\Security\Voter\MessageThreadVoter"
9 
"App\Security\Voter\MessageVoter"
10 
"App\Security\Voter\NotificationVoter"
11 
"App\Security\Voter\OAuth2UserConsentVoter"
12 
"App\Security\Voter\PostCommentVoter"
13 
"App\Security\Voter\PostVoter"
14 
"App\Security\Voter\UserVoter"

Access decision log

# Result Attributes Object
1 DENIED ROLE_USER 
null
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"Symfony\Component\Security\Core\Authorization\Voter\RoleHierarchyVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
2 DENIED moderate 
App\Entity\EntryComment {#1369
  +user: Proxies\__CG__\App\Entity\User {#1370 …}
  +entry: App\Entity\Entry {#1832 …}
  +magazine: App\Entity\Magazine {#313
    +icon: Proxies\__CG__\App\Entity\Image {#294 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#321
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#285 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#281 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#270 …}
    +entries: Doctrine\ORM\PersistentCollection {#228 …}
    +posts: Doctrine\ORM\PersistentCollection {#186 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#248 …}
    +bans: Doctrine\ORM\PersistentCollection {#165 …}
    +reports: Doctrine\ORM\PersistentCollection {#151 …}
    +badges: Doctrine\ORM\PersistentCollection {#129 …}
    +logs: Doctrine\ORM\PersistentCollection {#119 …}
    +awards: Doctrine\ORM\PersistentCollection {#108 …}
    +categories: Doctrine\ORM\PersistentCollection {#95 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#322
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#316
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +parent: null
  +root: null
  +body: """
    I got interested, so I spent some time looking into what’s going on here. I’m not intimately familiar with X11 or Wayland, but I figured out some stuff.\n
    \n
    Why `sudo ip netns exec protected sudo -u user -i` doesn’t work for X11 apps\n
    ----------------------------------------------------------------------------\n
    \n
    Short answer: file permissions and abstract unix sockets (which I didn’t know were a thing before now).\n
    \n
    File permissions: when I start an X11 login session, the `DISPLAY` is `:0` and `/tmp/.X11-unix/` has only 1 file `X0`. This file has 777 access. When I start my wayland session with Xwayland, the `DISPLAY` is `:1` and `/tmp/.X11-unix/` has 2 files `X0` (777) and `X1` (755). I can’t figure out how to connect to display `:0`, so I guess I’m stuck with `:1`. When you change to a different (non-root) user, the user no longer has access to `/tmp/.X11-unix/X1`.\n
    \n
    Abstract unix sockets: When I start my wayland/xwayland session, it creates abstract unix sockets with ids `@/tmp/.X11-unix/X0` and `@/tmp/.X11-unix/X1`. See `ss -lnp | grep Xwayland`. The network namespace also sandboxes these abstract unix sockets. Compare `socat ABSTRACT-CONNECT:/tmp/.X11-unix/X1 STDIN` and `sudo ip netns exec private socat ABSTRACT-CONNECT:/tmp/.X11-unix/X1 STDIN`.\n
    \n
    When you do `sudo ip netns exec protected su - user`, you loose access to both the filesystem unix socket `/tmp/.X11-unix/X1` and the abstract unix socket `@/tmp/.X11-unix/X1`. You need access to one or the other for X11 applications to work.\n
    \n
    I tried using socat to forward X1 such that it works in the network namespace… and it kinda works. `sudo ip netns exec protected socat ABSTRACT-LISTEN:/tmp/.X11-unix/X1,fork UNIX-CONNECT:/tmp/.X11-unix/X1`. It appears having ABSTRACT-LISTEN before UNIX-CONNECT is important, I guess it would be worth it to properly learn socat. With this `sudo ip netns exec protected su - testuser -c ‘env DISPLAY=:1 xmessage hi’` works, but `sudo ip netns exec protected su - testuser -c ‘env DISPLAY=:1 QT_QPA_PLATFORM=xcb kcalc’` does not work. 😞\n
    \n
    Changing the file permissions on `/tmp/.X11-unix/X1` to give the user access seems to work better.\n
    \n
    Wayland waypipe\n
    ---------------\n
    \n
    Waypipe works as advertised. But it’s still a little bit tricky because you need to have two separate processes for the waypipe client and server, wait for the waypipe socket to be created, adjust file permissions for the waypipe socket file, and set (and probably mkdir) `XDG_RUNTIME_DIR`.\n
    \n
    ```\n
    \n
    <span style="color:#323232;">waypipe -s /tmp/mywaypipe client &amp;\n
    </span><span style="color:#323232;">sleep 0.1\n
    </span><span style="color:#323232;">chgrp shared-display /tmp/mywaypipe\n
    </span><span style="color:#323232;">chmod g+w /tmp/mywaypipe\n
    </span><span style="color:#323232;">sudo ip netns exec protected su - testuser -c 'mkdir -p -m 0700 /tmp/runtime-testuser &amp;&amp; env XDG_RUNTIME_DIR=/tmp/runtime-testuser waypipe -s /tmp/mywaypipe server -- env QT_QPA_PLATFORM=wayland kcalc'\n
    </span><span style="color:#323232;">kill -SIGINT %1\n
    </span>\n
    ```\n
    \n
    Combined\n
    --------\n
    \n
    into this script [github.com/…/run-netns-user-wayland.bash](https://github.com/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 6
  +score: 0
  +lastActive: DateTime @1725312343 {#1605
    date: 2024-09-02 23:25:43.0 +02:00
  }
  +ip: null
  +tags: [
    "323232"
  ]
  +mentions: [
    "@shadowintheday2@lemmy.world"
    "@shadowintheday2@lemmy.world"
    "@shadowintheday2@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1371 …}
  +nested: Doctrine\ORM\PersistentCollection {#1379 …}
  +votes: Doctrine\ORM\PersistentCollection {#2446 …}
  +reports: Doctrine\ORM\PersistentCollection {#1891 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2409 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2358 …}
  -id: 309187
  -bodyTs: "'/run-netns-user-wayland.bash':451 '/tmp/.x11-unix':79,103 '/tmp/.x11-unix/x0':165 '/tmp/.x11-unix/x1':148,167,187,199,220,226,268,273,338 '/tmp/mywaypipe':402,410,414,435 '/tmp/runtime-testuser':427,432 '/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)':454 '0':77,122 '0.1':405 '0700':426 '1':82,101,130,309,324,445 '2':105 '755':111 '777':88,108 'abstract':52,149,160,179,185,197,223,266,278 'abstract-connect':184,196 'abstract-listen':265,277 'access':89,146,213,229,343 'adjust':384 'advertis':353 'also':176 'answer':48 'app':46 'appear':275 'applic':237 'better':347 'bit':360 'c':306,321,422 'chang':133,333 'chgrp':406 'chmod':411 'client':373,403 'combin':446 'compar':182 'connect':119,186,198,272,283 'creat':159,383 'didn':57 'differ':136 'dir':399,431 'display':75,99,121,308,323,409 'doesn':41 'env':307,322,428,437 'exec':35,193,207,262,302,317,418 'familiar':20 'figur':27,115 'file':49,65,83,86,106,335,385,391 'filesystem':217 'fork':269 'forward':245 'g':412 'github.com':450,453 'github.com/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)':452 'give':340 'go':13 'got':2 'grep':171 'guess':125,287 'hi':311 'id':164 'import':285 'interest':3 'intim':19 'ip':33,191,205,260,300,315,416 'kcalc':329,442 'kill':443 'kinda':257 'know':59 'learn':295 'listen':267,279 'littl':359 'lnp':170 'login':72 'longer':144 'look':9 'loos':212 'm':17,127,425 'mkdir':396,423 'namespac':175,254 'need':228,364 'netn':34,192,206,261,301,316,417 'network':174,253 'non':138 'non-root':137 'one':231 'p':424 'permiss':50,66,336,386 'platform':327,440 'privat':194 'probabl':395 'process':369 'proper':294 'protect':36,208,263,303,318,419 'qpa':326,439 'qt':325,438 'root':139 'runtim':398,430 'sandbox':177 'script':449 'see':168 'seem':344 'separ':368 'server':375,436 'session':73,95,157 'set':393 'share':408 'shared-display':407 'short':47 'sigint':444 'sleep':404 'socat':183,195,243,264,296 'socket':54,151,162,181,219,225,380,390 'spent':6 'ss':169 'start':69,92,154 'stdin':188,200 'still':357 'stuck':128 'stuff':30 'su':209,304,319,420 'sudo':32,37,190,204,259,299,314,415 'testus':305,320,421 'thing':62 'time':8 'tri':241 'tricki':361 'two':367 'u':38 'unix':53,150,161,180,218,224,271,282 'unix-connect':270,281 'use':242 'user':39,140,142,210,342 'w':413 'wait':376 'wayland':24,94,348,441 'wayland/xwayland':156 'waypip':349,350,372,379,389,400,433 'work':43,239,250,258,312,332,346,351 'worth':291 'would':289 'x0':84,107 'x1':110,246 'x11':22,45,71,236 'xcb':328 'xdg':397,429 'xmessag':310 'xwayland':97,172"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6694986"
  +editedAt: DateTimeImmutable @1723633148 {#1945
    date: 2024-08-14 12:59:08.0 +02:00
  }
  +createdAt: DateTimeImmutable @1705271475 {#1368
    date: 2024-01-14 23:31:15.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
3 DENIED edit 
App\Entity\EntryComment {#1369
  +user: Proxies\__CG__\App\Entity\User {#1370 …}
  +entry: App\Entity\Entry {#1832 …}
  +magazine: App\Entity\Magazine {#313
    +icon: Proxies\__CG__\App\Entity\Image {#294 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#321
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#285 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#281 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#270 …}
    +entries: Doctrine\ORM\PersistentCollection {#228 …}
    +posts: Doctrine\ORM\PersistentCollection {#186 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#248 …}
    +bans: Doctrine\ORM\PersistentCollection {#165 …}
    +reports: Doctrine\ORM\PersistentCollection {#151 …}
    +badges: Doctrine\ORM\PersistentCollection {#129 …}
    +logs: Doctrine\ORM\PersistentCollection {#119 …}
    +awards: Doctrine\ORM\PersistentCollection {#108 …}
    +categories: Doctrine\ORM\PersistentCollection {#95 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#322
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#316
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +parent: null
  +root: null
  +body: """
    I got interested, so I spent some time looking into what’s going on here. I’m not intimately familiar with X11 or Wayland, but I figured out some stuff.\n
    \n
    Why `sudo ip netns exec protected sudo -u user -i` doesn’t work for X11 apps\n
    ----------------------------------------------------------------------------\n
    \n
    Short answer: file permissions and abstract unix sockets (which I didn’t know were a thing before now).\n
    \n
    File permissions: when I start an X11 login session, the `DISPLAY` is `:0` and `/tmp/.X11-unix/` has only 1 file `X0`. This file has 777 access. When I start my wayland session with Xwayland, the `DISPLAY` is `:1` and `/tmp/.X11-unix/` has 2 files `X0` (777) and `X1` (755). I can’t figure out how to connect to display `:0`, so I guess I’m stuck with `:1`. When you change to a different (non-root) user, the user no longer has access to `/tmp/.X11-unix/X1`.\n
    \n
    Abstract unix sockets: When I start my wayland/xwayland session, it creates abstract unix sockets with ids `@/tmp/.X11-unix/X0` and `@/tmp/.X11-unix/X1`. See `ss -lnp | grep Xwayland`. The network namespace also sandboxes these abstract unix sockets. Compare `socat ABSTRACT-CONNECT:/tmp/.X11-unix/X1 STDIN` and `sudo ip netns exec private socat ABSTRACT-CONNECT:/tmp/.X11-unix/X1 STDIN`.\n
    \n
    When you do `sudo ip netns exec protected su - user`, you loose access to both the filesystem unix socket `/tmp/.X11-unix/X1` and the abstract unix socket `@/tmp/.X11-unix/X1`. You need access to one or the other for X11 applications to work.\n
    \n
    I tried using socat to forward X1 such that it works in the network namespace… and it kinda works. `sudo ip netns exec protected socat ABSTRACT-LISTEN:/tmp/.X11-unix/X1,fork UNIX-CONNECT:/tmp/.X11-unix/X1`. It appears having ABSTRACT-LISTEN before UNIX-CONNECT is important, I guess it would be worth it to properly learn socat. With this `sudo ip netns exec protected su - testuser -c ‘env DISPLAY=:1 xmessage hi’` works, but `sudo ip netns exec protected su - testuser -c ‘env DISPLAY=:1 QT_QPA_PLATFORM=xcb kcalc’` does not work. 😞\n
    \n
    Changing the file permissions on `/tmp/.X11-unix/X1` to give the user access seems to work better.\n
    \n
    Wayland waypipe\n
    ---------------\n
    \n
    Waypipe works as advertised. But it’s still a little bit tricky because you need to have two separate processes for the waypipe client and server, wait for the waypipe socket to be created, adjust file permissions for the waypipe socket file, and set (and probably mkdir) `XDG_RUNTIME_DIR`.\n
    \n
    ```\n
    \n
    <span style="color:#323232;">waypipe -s /tmp/mywaypipe client &amp;\n
    </span><span style="color:#323232;">sleep 0.1\n
    </span><span style="color:#323232;">chgrp shared-display /tmp/mywaypipe\n
    </span><span style="color:#323232;">chmod g+w /tmp/mywaypipe\n
    </span><span style="color:#323232;">sudo ip netns exec protected su - testuser -c 'mkdir -p -m 0700 /tmp/runtime-testuser &amp;&amp; env XDG_RUNTIME_DIR=/tmp/runtime-testuser waypipe -s /tmp/mywaypipe server -- env QT_QPA_PLATFORM=wayland kcalc'\n
    </span><span style="color:#323232;">kill -SIGINT %1\n
    </span>\n
    ```\n
    \n
    Combined\n
    --------\n
    \n
    into this script [github.com/…/run-netns-user-wayland.bash](https://github.com/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 6
  +score: 0
  +lastActive: DateTime @1725312343 {#1605
    date: 2024-09-02 23:25:43.0 +02:00
  }
  +ip: null
  +tags: [
    "323232"
  ]
  +mentions: [
    "@shadowintheday2@lemmy.world"
    "@shadowintheday2@lemmy.world"
    "@shadowintheday2@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1371 …}
  +nested: Doctrine\ORM\PersistentCollection {#1379 …}
  +votes: Doctrine\ORM\PersistentCollection {#2446 …}
  +reports: Doctrine\ORM\PersistentCollection {#1891 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2409 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2358 …}
  -id: 309187
  -bodyTs: "'/run-netns-user-wayland.bash':451 '/tmp/.x11-unix':79,103 '/tmp/.x11-unix/x0':165 '/tmp/.x11-unix/x1':148,167,187,199,220,226,268,273,338 '/tmp/mywaypipe':402,410,414,435 '/tmp/runtime-testuser':427,432 '/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)':454 '0':77,122 '0.1':405 '0700':426 '1':82,101,130,309,324,445 '2':105 '755':111 '777':88,108 'abstract':52,149,160,179,185,197,223,266,278 'abstract-connect':184,196 'abstract-listen':265,277 'access':89,146,213,229,343 'adjust':384 'advertis':353 'also':176 'answer':48 'app':46 'appear':275 'applic':237 'better':347 'bit':360 'c':306,321,422 'chang':133,333 'chgrp':406 'chmod':411 'client':373,403 'combin':446 'compar':182 'connect':119,186,198,272,283 'creat':159,383 'didn':57 'differ':136 'dir':399,431 'display':75,99,121,308,323,409 'doesn':41 'env':307,322,428,437 'exec':35,193,207,262,302,317,418 'familiar':20 'figur':27,115 'file':49,65,83,86,106,335,385,391 'filesystem':217 'fork':269 'forward':245 'g':412 'github.com':450,453 'github.com/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)':452 'give':340 'go':13 'got':2 'grep':171 'guess':125,287 'hi':311 'id':164 'import':285 'interest':3 'intim':19 'ip':33,191,205,260,300,315,416 'kcalc':329,442 'kill':443 'kinda':257 'know':59 'learn':295 'listen':267,279 'littl':359 'lnp':170 'login':72 'longer':144 'look':9 'loos':212 'm':17,127,425 'mkdir':396,423 'namespac':175,254 'need':228,364 'netn':34,192,206,261,301,316,417 'network':174,253 'non':138 'non-root':137 'one':231 'p':424 'permiss':50,66,336,386 'platform':327,440 'privat':194 'probabl':395 'process':369 'proper':294 'protect':36,208,263,303,318,419 'qpa':326,439 'qt':325,438 'root':139 'runtim':398,430 'sandbox':177 'script':449 'see':168 'seem':344 'separ':368 'server':375,436 'session':73,95,157 'set':393 'share':408 'shared-display':407 'short':47 'sigint':444 'sleep':404 'socat':183,195,243,264,296 'socket':54,151,162,181,219,225,380,390 'spent':6 'ss':169 'start':69,92,154 'stdin':188,200 'still':357 'stuck':128 'stuff':30 'su':209,304,319,420 'sudo':32,37,190,204,259,299,314,415 'testus':305,320,421 'thing':62 'time':8 'tri':241 'tricki':361 'two':367 'u':38 'unix':53,150,161,180,218,224,271,282 'unix-connect':270,281 'use':242 'user':39,140,142,210,342 'w':413 'wait':376 'wayland':24,94,348,441 'wayland/xwayland':156 'waypip':349,350,372,379,389,400,433 'work':43,239,250,258,312,332,346,351 'worth':291 'would':289 'x0':84,107 'x1':110,246 'x11':22,45,71,236 'xcb':328 'xdg':397,429 'xmessag':310 'xwayland':97,172"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6694986"
  +editedAt: DateTimeImmutable @1723633148 {#1945
    date: 2024-08-14 12:59:08.0 +02:00
  }
  +createdAt: DateTimeImmutable @1705271475 {#1368
    date: 2024-01-14 23:31:15.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
4 DENIED moderate 
App\Entity\EntryComment {#1369
  +user: Proxies\__CG__\App\Entity\User {#1370 …}
  +entry: App\Entity\Entry {#1832 …}
  +magazine: App\Entity\Magazine {#313
    +icon: Proxies\__CG__\App\Entity\Image {#294 …}
    +name: "linux@lemmy.ml"
    +title: "linux"
    +description: """
      From Wikipedia, the free encyclopedia\n
      \n
      Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
      \n
      Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
      \n
      ### Rules\n
      \n
      - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
      - No misinformation\n
      - No NSFW content\n
      - No hate speech, bigotry, etc\n
      \n
      ### Related Communities\n
      \n
      - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
      - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
      - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
      - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
      \n
      Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
      """
    +rules: null
    +subscriptionsCount: 1
    +entryCount: 1406
    +entryCommentCount: 28632
    +postCount: 6
    +postCommentCount: 214
    +isAdult: false
    +customCss: null
    +lastActive: DateTime @1729583542 {#321
      date: 2024-10-22 09:52:22.0 +02:00
    }
    +markedForDeletionAt: null
    +tags: null
    +moderators: Doctrine\ORM\PersistentCollection {#285 …}
    +ownershipRequests: Doctrine\ORM\PersistentCollection {#281 …}
    +moderatorRequests: Doctrine\ORM\PersistentCollection {#270 …}
    +entries: Doctrine\ORM\PersistentCollection {#228 …}
    +posts: Doctrine\ORM\PersistentCollection {#186 …}
    +subscriptions: Doctrine\ORM\PersistentCollection {#248 …}
    +bans: Doctrine\ORM\PersistentCollection {#165 …}
    +reports: Doctrine\ORM\PersistentCollection {#151 …}
    +badges: Doctrine\ORM\PersistentCollection {#129 …}
    +logs: Doctrine\ORM\PersistentCollection {#119 …}
    +awards: Doctrine\ORM\PersistentCollection {#108 …}
    +categories: Doctrine\ORM\PersistentCollection {#95 …}
    -id: 73
    +apId: "linux@lemmy.ml"
    +apProfileId: "https://lemmy.ml/c/linux"
    +apPublicUrl: "https://lemmy.ml/c/linux"
    +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
    +apInboxUrl: "https://lemmy.ml/inbox"
    +apDomain: "lemmy.ml"
    +apPreferredUsername: "linux"
    +apDiscoverable: true
    +apManuallyApprovesFollowers: null
    +privateKey: null
    +publicKey: null
    +apFetchedAt: DateTime @1729583596 {#322
      date: 2024-10-22 09:53:16.0 +02:00
    }
    +apDeletedAt: null
    +apTimeoutAt: null
    +visibility: "visible             "
    +createdAt: DateTimeImmutable @1698929468 {#316
      date: 2023-11-02 13:51:08.0 +01:00
    }
  }
  +image: null
  +parent: null
  +root: null
  +body: """
    I got interested, so I spent some time looking into what’s going on here. I’m not intimately familiar with X11 or Wayland, but I figured out some stuff.\n
    \n
    Why `sudo ip netns exec protected sudo -u user -i` doesn’t work for X11 apps\n
    ----------------------------------------------------------------------------\n
    \n
    Short answer: file permissions and abstract unix sockets (which I didn’t know were a thing before now).\n
    \n
    File permissions: when I start an X11 login session, the `DISPLAY` is `:0` and `/tmp/.X11-unix/` has only 1 file `X0`. This file has 777 access. When I start my wayland session with Xwayland, the `DISPLAY` is `:1` and `/tmp/.X11-unix/` has 2 files `X0` (777) and `X1` (755). I can’t figure out how to connect to display `:0`, so I guess I’m stuck with `:1`. When you change to a different (non-root) user, the user no longer has access to `/tmp/.X11-unix/X1`.\n
    \n
    Abstract unix sockets: When I start my wayland/xwayland session, it creates abstract unix sockets with ids `@/tmp/.X11-unix/X0` and `@/tmp/.X11-unix/X1`. See `ss -lnp | grep Xwayland`. The network namespace also sandboxes these abstract unix sockets. Compare `socat ABSTRACT-CONNECT:/tmp/.X11-unix/X1 STDIN` and `sudo ip netns exec private socat ABSTRACT-CONNECT:/tmp/.X11-unix/X1 STDIN`.\n
    \n
    When you do `sudo ip netns exec protected su - user`, you loose access to both the filesystem unix socket `/tmp/.X11-unix/X1` and the abstract unix socket `@/tmp/.X11-unix/X1`. You need access to one or the other for X11 applications to work.\n
    \n
    I tried using socat to forward X1 such that it works in the network namespace… and it kinda works. `sudo ip netns exec protected socat ABSTRACT-LISTEN:/tmp/.X11-unix/X1,fork UNIX-CONNECT:/tmp/.X11-unix/X1`. It appears having ABSTRACT-LISTEN before UNIX-CONNECT is important, I guess it would be worth it to properly learn socat. With this `sudo ip netns exec protected su - testuser -c ‘env DISPLAY=:1 xmessage hi’` works, but `sudo ip netns exec protected su - testuser -c ‘env DISPLAY=:1 QT_QPA_PLATFORM=xcb kcalc’` does not work. 😞\n
    \n
    Changing the file permissions on `/tmp/.X11-unix/X1` to give the user access seems to work better.\n
    \n
    Wayland waypipe\n
    ---------------\n
    \n
    Waypipe works as advertised. But it’s still a little bit tricky because you need to have two separate processes for the waypipe client and server, wait for the waypipe socket to be created, adjust file permissions for the waypipe socket file, and set (and probably mkdir) `XDG_RUNTIME_DIR`.\n
    \n
    ```\n
    \n
    <span style="color:#323232;">waypipe -s /tmp/mywaypipe client &amp;\n
    </span><span style="color:#323232;">sleep 0.1\n
    </span><span style="color:#323232;">chgrp shared-display /tmp/mywaypipe\n
    </span><span style="color:#323232;">chmod g+w /tmp/mywaypipe\n
    </span><span style="color:#323232;">sudo ip netns exec protected su - testuser -c 'mkdir -p -m 0700 /tmp/runtime-testuser &amp;&amp; env XDG_RUNTIME_DIR=/tmp/runtime-testuser waypipe -s /tmp/mywaypipe server -- env QT_QPA_PLATFORM=wayland kcalc'\n
    </span><span style="color:#323232;">kill -SIGINT %1\n
    </span>\n
    ```\n
    \n
    Combined\n
    --------\n
    \n
    into this script [github.com/…/run-netns-user-wayland.bash](https://github.com/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)
    """
  +lang: "en"
  +isAdult: false
  +favouriteCount: 6
  +score: 0
  +lastActive: DateTime @1725312343 {#1605
    date: 2024-09-02 23:25:43.0 +02:00
  }
  +ip: null
  +tags: [
    "323232"
  ]
  +mentions: [
    "@shadowintheday2@lemmy.world"
    "@shadowintheday2@lemmy.world"
    "@shadowintheday2@lemmy.world"
  ]
  +children: Doctrine\ORM\PersistentCollection {#1371 …}
  +nested: Doctrine\ORM\PersistentCollection {#1379 …}
  +votes: Doctrine\ORM\PersistentCollection {#2446 …}
  +reports: Doctrine\ORM\PersistentCollection {#1891 …}
  +favourites: Doctrine\ORM\PersistentCollection {#2409 …}
  +notifications: Doctrine\ORM\PersistentCollection {#2358 …}
  -id: 309187
  -bodyTs: "'/run-netns-user-wayland.bash':451 '/tmp/.x11-unix':79,103 '/tmp/.x11-unix/x0':165 '/tmp/.x11-unix/x1':148,167,187,199,220,226,268,273,338 '/tmp/mywaypipe':402,410,414,435 '/tmp/runtime-testuser':427,432 '/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)':454 '0':77,122 '0.1':405 '0700':426 '1':82,101,130,309,324,445 '2':105 '755':111 '777':88,108 'abstract':52,149,160,179,185,197,223,266,278 'abstract-connect':184,196 'abstract-listen':265,277 'access':89,146,213,229,343 'adjust':384 'advertis':353 'also':176 'answer':48 'app':46 'appear':275 'applic':237 'better':347 'bit':360 'c':306,321,422 'chang':133,333 'chgrp':406 'chmod':411 'client':373,403 'combin':446 'compar':182 'connect':119,186,198,272,283 'creat':159,383 'didn':57 'differ':136 'dir':399,431 'display':75,99,121,308,323,409 'doesn':41 'env':307,322,428,437 'exec':35,193,207,262,302,317,418 'familiar':20 'figur':27,115 'file':49,65,83,86,106,335,385,391 'filesystem':217 'fork':269 'forward':245 'g':412 'github.com':450,453 'github.com/vole-dev/grabbag/blob/main/run-netns-user-wayland.bash)':452 'give':340 'go':13 'got':2 'grep':171 'guess':125,287 'hi':311 'id':164 'import':285 'interest':3 'intim':19 'ip':33,191,205,260,300,315,416 'kcalc':329,442 'kill':443 'kinda':257 'know':59 'learn':295 'listen':267,279 'littl':359 'lnp':170 'login':72 'longer':144 'look':9 'loos':212 'm':17,127,425 'mkdir':396,423 'namespac':175,254 'need':228,364 'netn':34,192,206,261,301,316,417 'network':174,253 'non':138 'non-root':137 'one':231 'p':424 'permiss':50,66,336,386 'platform':327,440 'privat':194 'probabl':395 'process':369 'proper':294 'protect':36,208,263,303,318,419 'qpa':326,439 'qt':325,438 'root':139 'runtim':398,430 'sandbox':177 'script':449 'see':168 'seem':344 'separ':368 'server':375,436 'session':73,95,157 'set':393 'share':408 'shared-display':407 'short':47 'sigint':444 'sleep':404 'socat':183,195,243,264,296 'socket':54,151,162,181,219,225,380,390 'spent':6 'ss':169 'start':69,92,154 'stdin':188,200 'still':357 'stuck':128 'stuff':30 'su':209,304,319,420 'sudo':32,37,190,204,259,299,314,415 'testus':305,320,421 'thing':62 'time':8 'tri':241 'tricki':361 'two':367 'u':38 'unix':53,150,161,180,218,224,271,282 'unix-connect':270,281 'use':242 'user':39,140,142,210,342 'w':413 'wait':376 'wayland':24,94,348,441 'wayland/xwayland':156 'waypip':349,350,372,379,389,400,433 'work':43,239,250,258,312,332,346,351 'worth':291 'would':289 'x0':84,107 'x1':110,246 'x11':22,45,71,236 'xcb':328 'xdg':397,429 'xmessag':310 'xwayland':97,172"
  +ranking: 0
  +commentCount: 0
  +upVotes: 0
  +downVotes: 0
  +visibility: "visible             "
  +apId: "https://lemmy.world/comment/6694986"
  +editedAt: DateTimeImmutable @1723633148 {#1945
    date: 2024-08-14 12:59:08.0 +02:00
  }
  +createdAt: DateTimeImmutable @1705271475 {#1368
    date: 2024-01-14 23:31:15.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS DENIED 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details
5 DENIED edit 
App\Entity\Magazine {#313
  +icon: Proxies\__CG__\App\Entity\Image {#294 …}
  +name: "linux@lemmy.ml"
  +title: "linux"
  +description: """
    From Wikipedia, the free encyclopedia\n
    \n
    Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).\n
    \n
    Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word “Linux” in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.\n
    \n
    ### Rules\n
    \n
    - Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.\n
    - No misinformation\n
    - No NSFW content\n
    - No hate speech, bigotry, etc\n
    \n
    ### Related Communities\n
    \n
    - [!opensource@lemmy.ml](https://lemmy.ml/c/opensource)\n
    - [!libre_culture@lemmy.ml](https://lemmy.ml/c/libre_culture)\n
    - [!technology@lemmy.ml](https://lemmy.ml/c/technology)\n
    - [!libre_hardware@lemmy.ml](https://lemmy.ml/c/libre_hardware)\n
    \n
    Community icon by [Alpár-Etele Méder](https://www.iconfinder.com/pocike), licensed under [CC BY 3.0](https://creativecommons.org/licenses/by/3.0/)
    """
  +rules: null
  +subscriptionsCount: 1
  +entryCount: 1406
  +entryCommentCount: 28632
  +postCount: 6
  +postCommentCount: 214
  +isAdult: false
  +customCss: null
  +lastActive: DateTime @1729583542 {#321
    date: 2024-10-22 09:52:22.0 +02:00
  }
  +markedForDeletionAt: null
  +tags: null
  +moderators: Doctrine\ORM\PersistentCollection {#285 …}
  +ownershipRequests: Doctrine\ORM\PersistentCollection {#281 …}
  +moderatorRequests: Doctrine\ORM\PersistentCollection {#270 …}
  +entries: Doctrine\ORM\PersistentCollection {#228 …}
  +posts: Doctrine\ORM\PersistentCollection {#186 …}
  +subscriptions: Doctrine\ORM\PersistentCollection {#248 …}
  +bans: Doctrine\ORM\PersistentCollection {#165 …}
  +reports: Doctrine\ORM\PersistentCollection {#151 …}
  +badges: Doctrine\ORM\PersistentCollection {#129 …}
  +logs: Doctrine\ORM\PersistentCollection {#119 …}
  +awards: Doctrine\ORM\PersistentCollection {#108 …}
  +categories: Doctrine\ORM\PersistentCollection {#95 …}
  -id: 73
  +apId: "linux@lemmy.ml"
  +apProfileId: "https://lemmy.ml/c/linux"
  +apPublicUrl: "https://lemmy.ml/c/linux"
  +apFollowersUrl: "https://lemmy.ml/c/linux/followers"
  +apInboxUrl: "https://lemmy.ml/inbox"
  +apDomain: "lemmy.ml"
  +apPreferredUsername: "linux"
  +apDiscoverable: true
  +apManuallyApprovesFollowers: null
  +privateKey: null
  +publicKey: null
  +apFetchedAt: DateTime @1729583596 {#322
    date: 2024-10-22 09:53:16.0 +02:00
  }
  +apDeletedAt: null
  +apTimeoutAt: null
  +visibility: "visible             "
  +createdAt: DateTimeImmutable @1698929468 {#316
    date: 2023-11-02 13:51:08.0 +01:00
  }
}
 
"Scheb\TwoFactorBundle\Security\Authorization\Voter\TwoFactorInProgressVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\EntryVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MagazineVoter"
 ACCESS DENIED 
"App\Security\Voter\MessageThreadVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\MessageVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\NotificationVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\OAuth2UserConsentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostCommentVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\PostVoter"
 ACCESS ABSTAIN 
"App\Security\Voter\UserVoter"
 ACCESS ABSTAIN
Show voter details