---
name: "Xorg.wrap"
section: "1"
platform: "linux"
package: "xorg-server"
version: "21.1.25-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/Xorg.wrap"
---

# Xorg.wrap(1)

Xorg X server binary wrapper

## NAME

Xorg.wrap - Xorg X server binary wrapper

## DESCRIPTION

The Xorg X server may need root rights to function properly. To start the Xorg X server with these rights your system is using a suid root wrapper installed as /usr/libexec/Xorg.wrap which will execute the real X server which is installed as /usr/libexec/Xorg.

By default Xorg.wrap will autodetect if root rights are necessary, and if not it will drop its elevated rights before starting the real X server. By default Xorg.wrap will only allow executing the real X server from login sessions on a physical console.

## CONFIG FILE

Xorg.wrap's default behavior can be overridden from the */etc/X11/Xwrapper.config* config file. Lines starting with a **#** in Xwrapper.config are considered comments and will be ignored. Any other non empty lines must take the form of **key** = *value*.

- **allowed\_users** = *rootonly*\|*console*\|*anybody*

  Specify which users may start the X server through the wrapper. Use *rootonly* to only allow root, use *console* to only allow users logged into a physical console, and use *anybody* to allow anybody. The default is *console*.

- **needs\_root\_rights** = *yes*\|*no*\|*auto*

  Configure if the wrapper should drop its elevated (root) rights before starting the X server. Use *yes* to force execution as root, *no* to force execution with all suid rights dropped, and *auto* to let the wrapper auto-detect. The default is *auto*.

When auto-detecting the wrapper will drop rights if kms graphics are available and not drop them if no kms graphics are detected. If a system has multiple graphics cards and some are not kms capable auto-detection may fail, in this case manual configuration should be used.

## SEE ALSO

Xorg X server information: [*Xorg*(1)](/Xorg/1.md)