Hacker News Reader

Comment by DoctorNick | Hacker News Reader

X11 is a security nightmare. It is absolutely broken enough to justify a huge change.

Installing random software off the internet or from a market that developers have direct access to poison is a security nightmare that isn't much fixed by wayland.

Allowing smoking between barrels of gunpowder is different than in an open space.

Wayland is a necessary part of security, but not sufficient.

Unless you are using different vms for isolation it's all open barrels of gunpowder all the time.

I agree with you in general, but even if you use jailed apps in X, they can keylog. It can be solved with nested X sessions, but that would only add yet another hacky patch.

It's security theater. If I can run a process on your machine under your user account, you can bet I can keylog you, X11 or no.

Try it. You can’t unless you’ve found some exploit in a given wayland compositor.

Linux only grants permission to keyboard/mouse events to root or to display “owner”, which is the one who requested it on a given tty.

Here are a few ways off the top of my head that don't require exploiting Wayland or gaining access to the `input` group (or whatever group owns the /dev/input/* events), using nothing more than a local shell under your user account:

* Using ptrace(2) to hook into your running processes and grabbing key data that way

* Adding a LD_PRELOAD around your application launcher (via your .bashrc or some other auto-exec script) to have it intercept key events for your application

* Downloading and mounting a FUSE filesystem image with the /dev/input device nodes owned by your user ID instead of root.

* Use one of the multitude of privilege-escalation CVEs on the Linux desktop to gain root, and keylog you that way [1].

Come back when you understand the problem.

[1] https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux+privi...

What is not clear about necessary but not sufficient? Of course sandboxing is necessary, but graphics is a deliberate hole in a sandbox. If that hole is unsecure, the whole thing is.

How does X help here?

X already solves this particular input hole with the XACE extension. No need to replace the whole graphics stack when the X server is already capable of addressing this issue.

XACE doesn't solve it. As mentioned elsewhere, that's dependent on SELinux. The idea with Wayland is to make things more secure everywhere, and not just on systems that have a particular LSM.

Wrong. XACE is independent of SELinux and LSMs. It's just a protocol for writing plugins to X servers that filter which events X clients can see.

That there exist SELinux plugins does not mean that XACE itself depends on it. Like, try reading the actual documentation instead of regurgitating FUD: https://www.x.org/releases/X11R7.6/doc/xorg-docs/specs/Xserv...

It's not wrong, it's not FUD, and that doesn't change anything. The only working plugin is the SELinux one. If you can't use that, you have to rebuild an entire new security architecture... which is what they had to do in Wayland anyway. XACE isn't really built for anything besides MAC either, so it's inadequate for doing anything that isn't an LSM. It also has a problem where new hooks need to be added for every new X extension, and that didn't happen so now it's outdated. In Wayland that entire concept was replaced with a single API function to do generic traffic filtering.

It's also outside the scope of a desktop environment or window manager to ship plugins to the X server. Hence another reason why they had to go with a new protocol that makes it easier to implement their own server...

> The only working plugin is the SELinux one. If you can't use that, you have to rebuild an entire new security architecture

I stopped reading at this point. If you're not going to read the documentation, then you can kindly go crawl back under your rock on /r/linuxmasterrace.

I was familiar with that documentation around 10 years ago, please stop making these assumptions and please stop dismissing what I have to say. The documentation is irrelevant, I'm talking about the server source code. There is one real plugin implementation there that uses SELinux. That's it. There is currently no other real way to use XACE, it's otherwise totally useless to end users.

Yes people could develop new plugins that integrate with some other security mechanism, but they haven't, in part because the hooks are so out of date, and in part because, you know, that requires building another security mechanism. The access hooks are not a security mechanism, they allow you to integrate with some external MAC.

Reply on news.ycombinator.com