Hacker News Reader

Comment by wmanley | Hacker News Reader

> the X11 protocol [...] has plenty of design decisions that simply cannot be secured.

I've been hearing this for over a decade now. I don't get it. Just because xorg currently makes different clients aware of each other and broadcasts keypresses and mouse movements to all clients and allows screen capturing doesn't mean it has to. You could essentially give every application the impression that they are the only thing running.

It might seem difficult to implement, but compare it to the effort that has gone into wayland across the whole ecosystem. Maybe that was the point - motivating people to work on X was too difficult, and the wayland approach manages to diffuse the work out to more people.

I was really bullish on Wayland 10 years ago. Not so much any more. In retrospect it seems like a failure in technical leadership.

View on HN

X always had the capability to isolate clients, but it is not used it would need some work which nobody does because of Wayland.

Some aspects of the client isolation are used by default when doing X11 forwarding via SSH. A remote keylogger will not work for instance.

> You could essentially give every application the impression that they are the only thing running.

> It might seem difficult to implement

This is exactly what OS did (my daily driver): https://forum.qubes-os.org/t/inter-vm-keyboard-isolation/315...

It'll be challenging to even figure out which one of the things connecting to $DISPLAY is the real window manager. Good luck on your lonely[1] journey!

[1]: The people who actually developed Xorg are now working on various Wayland-related things.

> It'll be challenging to even figure out which one of the things connecting to $DISPLAY is the real window manager.

I suspect it would be less challenging than writing a whole new wayland server.

Off the top of my head, I'd use a separate abstract domain socket for the window manager including some UUID, and then pass that to the window manager when launching it.

You could create these sockets on demand - one for each security context. On linux typically a different security contexts will either have different UIDs - in which case filesystem permissions would be sufficient - or they have different mount namespaces - in which case you make different sockets visible in different namespaces.

For SSH forwarding you could have SSH ask the X server for a new socket for forwarding purposes - so remote clients can't snoop on local clients.

> Good luck on your lonely[1] journey! > > [1]: The people who actually developed Xorg are now working on various Wayland-related things.

This is what I mean by a failure of technical leadership.

"You could create these sockets on demand - one for each security context. On linux typically a different security contexts will either have different UIDs - in which case filesystem permissions would be sufficient - or they have different mount namespaces - in which case you make different sockets visible in different namespaces."

This is reminiscent of how Trusted Solaris[0] implements Mandatory Access Control (MAC) a la Orange Book[1].

[0] https://www.oracle.com/technetwork/server-storage/solaris10/... [1] https://public.milcyber.org/activities/magazine/articles/202...

> For SSH forwarding you could have SSH ask the X server for a new socket for forwarding purposes - so remote clients can't snoop on local clients.

SSH pretty much already does this. Per default (using -X) X11 forwarding is in untrusted mode, which makes certain unsafe X11 extensions unavailable. So remote clients already cannot snoop the whole keyboard input.

> Off the top of my head, I'd use a separate abstract domain socket for the window manager including some UUID, and then pass that to the window manager when launching it.

And then the window manager spawns whatever programs the user wants, and they end up sharing that $DISPLAY.

I'm not trying to claim that X is secure as is. The claim I'm making is:

1. There is nothing fundamentally insecure about the design of X that couldn't be fixed with a bit of effort.

2. The effort required would be significantly less than what has gone into Wayland over the last 16 years.

Fixing the security of the system certainly would involve changes to more than just xorg. Anywhere there is a security boundary you'd need to make modifications - but that's OK, most of these security boundaries are younger than wayland anyway.

This discussion of $DISPLAY seems like distracting minutiae. Sure it's a medium size problem that would need solving, but that's all it is.

To address your specific point: it could be the responsibility of the window manager to set $DISPLAY to a less powerful socket when starting processes. Ultimately it doesn't matter though, because if the display server isn't doing some sort of sandboxing then the spawned process can just ptrace xorg and do whatever it wants. X being secure only matters in the presence of a security boundary and in that case it would be the responsibility of whatever is setting up that boundary to create a less privileged socket. Whether that be ssh or flatpak or whatever.

So now we've reached the point of "you could secure X11 if you changed everything". Sure, fine.

Once again, for emphasis: nobody has stepped up to do that, in the history of X (outside of proprietary products, of unknown quality).

Wayland is not some outsider project competing against X11. It's the people who were developing Xorg, saying they're fed up with X11 and need a clean slate to fix its problems.

Here's my unpriviledged user trying to ptrace my Wayland compositor running as me:

    strace --syscall-limit=1 -p 697351
    strace: attach: ptrace(PTRACE_SEIZE, 697351): Operation not permitted

Nearby, I have a Chromebook where a potentially hostile virtual machine can display Wayland windows seamlessly on the host. The worst the VM can do is fill bitmaps with offensive imagery.

In a world where the people doing the work switched to developing the Wayland ecosystem, arguing about a "could" that requires changing every window manager seems like a guarantee X11 will not get improved. Feel free to put effort into it...

Reply on news.ycombinator.com