Circumventing Ubuntu Snap confinement | Hacker News Reader

Circumventing Ubuntu Snap confinement

mjg59.dreamwidth.org

36 pointszdw13 comments

Before anyone suggests the X SECURITY extension (as in SSH's "untrusted" X forwarding): That only provides one level of confinement. Everything running behind the SECURITY extension trusts each other. So if I run ssh -X somehost emacs, an "untrusted" XEvilTeddy won't be able to snoop on the terminal where I ran SSH, but it can snoop on my entire emacs window.

In college I spent a bit of time trying to write what's effectively a NATing proxy for the X protocol: clients get their own XIDs in their own namespace, and can't refer to other clients' resources. They see a virtual root window that only has their own windows. If X is going to stick around and people are going to attempt to care about security, it'd be worth implementing something like that.

The subuser project is using Xpra to isolate and bridge the untrusted code into the trusted space. http://subuser.org/news/0.3.html

Now thats interesting.

XACE is probably a better solution:

http://www.x.org/releases/X11R7.5/doc/security/XACE-Spec.htm...

Could do you release it ?

I didn't get far enough to do anything past writing some X protocol parsing code in Haskell (for type etc. safety, since writing an X protocol parser in C sounded like a mistake), and there are better language choices today.

Maybe I'm missing something, but I haven't see Canonical make the claim that Snap provides confinement on Ubuntu desktop, the blog post linked to by this post doesnt seem to?

The security mechanisms in snap packages allow for much faster iteration across all versions of Ubuntu and Ubuntu derivatives, as snap applications are isolated from the rest of the system. Users can install a snap without having to worry whether it will have an impact on their other apps or their system.

https://insights.ubuntu.com/2016/04/20/canonical-unveils-6th...

If I avoid using/installing Snap packages, do I avoid the security issues the author is alluding to in his post?

No. It was already possible for any X11 application to do this. Some people interpreted snap as providing additional protection against this, but it does not. Fixing it requires switching from X11 to another display server with a better security model, such as Wayland or Mir.

From elsewhere i have learned that there are a couple of ways to "harden" X.

http://www.x.org/wiki/Development/Documentation/Security/ is one.

Another is to run each program inside their own "server", via xnest, xephyr or similar.

And, IIRC, Wayland isn't ready for primetime yet. Thanks for replying. I guess I'll stick to updates through good old apt then.

Snap!

Reply on news.ycombinator.com