4 ms·
At the end of the day people don't care about security that much. Wayland is still getting there. Its getting better, particularly in the last year, but its not
by danieldk 9y ago
At the end of the day people don't care about security that much. Wayland is still getting there. Its getting better, particularly in the last year, but its not a huge priority for many people so it has taken upwards of ten years to become usable.
I think many people are also not aware of how bad X11 security is. The other day I mentioned that X11 applications can read all keystrokes to someone who does system administration/security at an ISP. To my big surprise, he was not aware of this. (Didn't everyone play with xev at some point?)
On Linux, I only use Wayland because of X11's broken security model. Fortunately, it works very well these days with the amdgpu driver.
- wander_homer 9y agoHowever the way Wayland (or its broader ecosystem) "fixes" security is just stupid. Instead of using a fine grained whitelisting based permission system to grant different clients all the permissions they need to do their work (taking screenshots, reading the color of a point, listening to a certain key combination, apply some filtering to the display, get the size/position of a different client, ...) it treats every client as untrustworthy with no standard way to change that. And let's not forget that just using Wayland doesn't grant any improved security compared to X11. There are numerous other ways to get input data, display contents, etc., so you need further sandboxing anyway, at which point you might just as well sandbox X11 clients you don't trust to get the same security. The benefit here is that you can decide if you trust your color picker and let it do its work by not sandboxing it, while Wayland just decides for you that no color picker can be trusted.
- jcantero 9y ago> However the way Wayland (or its broader ecosystem) "fixes" security is just stupid. Instead of using a fine grained whitelisting based permission system to grant different clients all the permissions they need to do their work Because you can't do that in Unix. You can't ensure that the process with PID 1234 is really executing /usr/bin/foo.
- owl57 9y agoAssuming other apps are sandboxed from /proc/1234, can't the shell just exec "/usr/bin/foo" and pass some file descriptors or secrets in environment variables?
- jcantero 9y agoHow the wayland server and the shell are going to share (or agree to) that file descriptors or secrets in the first place? Or how can you ensure that the shell is not a rogue one?
- owl57 9y ago> How the wayland server and the shell are going to share (or agree to) that file descriptors or secrets in the first place? I read that GNOME just implements both in the same program (and calls it "shell"). > Or how can you ensure that the shell is not a rogue one? I'm confused. Do you mean this kind of attack would become somewhat more probable or more dangerous if the original shell had some mechanism of allowing certain apps to pick colors?
- jcantero 9y agoThe reason that Wayland (or X11) protocol uses Unix sockets for communications is because there is not a hierarchical relationship between a client process and the server process (they can be even from different user "sessions"). Also, a client can be launched from anywhere, including a "shell" such as a /bin/bash interactive session.
- alien_at_work 9y agoYou can with SELinux, which is on all the major distros now, no?
- jcantero 9y agoI haven't heard about that, can you please provide a link?