How to enable xhost access from second user when display:0 is on first user?

Question

Here is my situation:

I have two (sudo) users on a machine:

1. userA (created first on the machine. This is also where display :0 is attached)
2. userB (created later)

Being on userA I do:

export DISPLAY=:0.0
xclock

And the clock opens on DISPLAY:0 as intended.

Now, I want the same steps to work on userB. But unfortunately, it shows:

No protocol specified
xhost:  unable to open display ":0.0"

What I tried:

1. Creating a trusted xauth key using: xauth generate :0.0 . trusted which again shows unable to open display ":0.0"
2. Copying the /home/userA/.Xauthority to /home/userB/.Xauthority. (Note: I did not see any key pertaining to display :0 in the userA xauth list, even though it works.)
3. Creating trusted xauth key for :0 on userA and copying that key to userB.

None of these worked.

What worked:

1. I log-in to userA. I export DISPLAY=:0.0 and then xhost + to enable access from all clients.
2. I log back in to userB. I export DISPLAY=:0.0 and then xclock.

I want to eliminate Step 1. I do NOT want to log-in to userA each time. And I did try to xhost + from userB, which shows error already shown above.

How can I run xhost + from userB, while also making it think it has the DISPLAY:0 access?

Edit: As mentioned by @user414777, I was able to:

# On userA
$ xhost +si:localuser:userB

# On userB
$ export DISPLAY=:0.0 ; xclock

And make it work. But these changes don't stay post-reboot.

# After rebooting, on userB
$ export DISPLAY=:0.0 ; xclock
Invalid MIT-MAGIC-COOKIE-1 keyError: Can't open display: :0.0

I'm running Ubuntu 18.04 LTS, 4.18.0-15-generic

SOLVED

I eventually went with a slightly insecure and modified suggestion by @user414777. Instead of adding the change in ~/.xsession or Xsession.d, I added that line in /etc/profile, which applies the change for all users.

Answer 1

On most "modern" Linux systems, you can do just:

xhost +si:localuser:userB

running as userA (the one who already has access to the display), then userB will be able to connect (if she sets the correct DISPLAY environment variable or uses the correct -display or --display command line options).

That's quite insecure, but (at least on Debian) it's the only thing supported by Xwayland, and they're already forcing it even with the regular Xorg.

---

The regular way, already mentioned in the xauth(1) manpage, and in many answers here and elsewhere, is:

xauth extract - "$DISPLAY" | ssh userB@localhost xauth merge -

but on my system, that only works with Xorg, not with Xwayland. With the command above, you can use su or sudo instead of ssh, or you can do it in two steps, etc.