4 ms·

Professional pentester here - Wayland alone doesn't really do much for you, security wise. It is still very possible for an application simply running under a w

Professional pentester here - Wayland alone doesn't really do much for you, security wise. It is still very possible for an application simply running under a wayland compositor to do lots of nasty things. The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. Running wayland alone gets you very little in terms of sandboxing. It locks the front door, but leaves the backdoor and all your windows open, because that's what every application under the sun expects. > Under X11, you are basically running every application with root, always. This is ... not true, either broadly or generally. You're saying this because Xorg runs as root, which means that any security flaw in Xorg yields root access. I think saying that "you are running every application with root" is stretching it a bit, but I'll accept it. But Xorg doesn't have to run as root. OpenBSD started it years ago with Xenocara, but AFAIK Fedora also does not run Xorg as root. I'm not sure what other OSes are doing, but it's at least not a flaw of X11 in general, just a flaw of Xorg.

kuschku 6y ago
> This is ... not true, either broadly or generally I’m saying that because if you ever type in your password, e.g. into a screenlocker, into a terminal with sudo, or an apt-get gui, every application can listen to those input events. Every application has the ability to be a keylogger by default. And with that captured password, it then can either inject input events into your terminal, or run sudo itself. > The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. That’s true, but also not. With X11, even a flatpak without any special permissions or bind mounts can still basically control your system. Just listen for input events until you see the keys "s u d o", then listen until you see something that looks like a password, then wait until the user is not paying attention, and inject virtual input events to start a terminal and inject input events to run "sudo rm -rf /*" with the password you captured earlier. By making the ability to intercept, record, or inject input events a special API, wayland at least allows flatpaks to be sandboxed at all.
- enriquto 6y ago
  > With X11, even a flatpak without any special permissions or bind mounts can still basically control your system. Just listen for input events until you see the keys "s u d o", then listen until you see something that looks like a password, then wait until the user is not paying attention, and inject virtual input events to start a terminal and inject input events to run "sudo rm -rf /*" with the password you captured earlier. Why such complication? An hostile application can simply add an "evil" line to your .bashrc and you are fucked anyway. No need to keylog anything, nor the fancy stuff that you describe. It doesn't need to be a graphical application, even. The "ls" command can do it!
  - kuschku 6y ago
    Flatpak runs applications in what’s nowadays referred to as container: the application can’t see any processes outside the container, can’t access any filesystem except for files you explicitly open with the application, and especially can’t edit your .bashrc. That’s the point of flatpak. But as long as you use X11, there’s one single privilege escalation path left, and that’s the complicated one I described above.
    - enriquto 6y ago
      What if I don't trust the person that sent me the flatpack container itself? A truly secure sandboxing should be a standard OS facility, not tied to a package distribution method. The flatpack/snap model is all wrong. I need to run arbitrary hostile applications in a safe manner, not only those that the developers have decided to distribute in a certain form.
      - kuschku 6y ago
        Sure, but the flatpak model is a way to get these advantages for as large a userbase as fast as possible. If you use flatpaks without bind-home under wayland today, you’ve significantly improved your actual security already. Sandboxing arbitrary badly behaving software is just going to use the same APIs as flatpak, so this helps for your use case as well.
Majestic121 6y ago
I think the point about root is not so much about whether Xorg is run as root, but rather that any application can then elevate itself as root by listening to the key events to catch your password (for example when unlocking your screen) and then sudo with it.
ben-schaaf 6y ago
> You're saying this because Xorg runs as root, which means that any security flaw in Xorg yields root access. They're saying that because every app under Xorg can do keylogging they're effectively running as root, as any of them can keylog your root password next time you type it in.
pmoriarty 6y ago
"But Xorg doesn't have to run as root" All the hand wringing over root privilege escalation on Linux is almost irrelevant for most single-user systems, as since there's really only one non-root account which usually has all the data the user cares about, getting access to just that non-root account would be disaster enough for the user.[1] So if Wayland's design is standing in the way of doing useful things because they're concerned about root privilege escalation, they've got their priorities mixed up. [1] - not to mention that once a non-root account is exploited then getting root in some other way, even if Wayland itself can't be exploited, is usually not difficult.
- kuschku 6y ago
  The goal isn’t to prevent escalation to root, but to prevent escalation out of a sandbox. If you sandbox an application today, while it can’t access the filesystem at all, and nothing under your user account, as long as it can show you a window under X11, it can log, manipulate, and inject any input events or window contents of any other windows as well. That’s the one single big hole in todays sandboxes under linux, and there’s only two options to solve it: put a whole separate X server into the sandbox of every single application with X-on-X, or replace X. Which is one of the things wayland fixes.

kuschku 6y ago

> This is ... not true, either broadly or generally I’m saying that because if you ever type in your password, e.g. into a screenlocker, into a terminal with sudo, or an apt-get gui, every application can listen to those input events. Every application has the ability to be a keylogger by default. And with that captured password, it then can either inject input events into your terminal, or run sudo itself. > The Wayland protocol provides the building blocks for someone to create an Android-like sandboxed environment, but doing so would break every application. Snaps and Flatpak come closer, but still generally miss the mark, since many applications require your entire home directory to be bind mounted in their container. That’s true, but also not. With X11, even a flatpak without any special permissions or bind mounts can still basically control your system. Just listen for input events until you see the keys "s u d o", then listen until you see something that looks like a password, then wait until the user is not paying attention, and inject virtual input events to start a terminal and inject input events to run "sudo rm -rf /*" with the password you captured earlier. By making the ability to intercept, record, or inject input events a special API, wayland at least allows flatpaks to be sandboxed at all.

enriquto 6y ago
> With X11, even a flatpak without any special permissions or bind mounts can still basically control your system. Just listen for input events until you see the keys "s u d o", then listen until you see something that looks like a password, then wait until the user is not paying attention, and inject virtual input events to start a terminal and inject input events to run "sudo rm -rf /*" with the password you captured earlier. Why such complication? An hostile application can simply add an "evil" line to your .bashrc and you are fucked anyway. No need to keylog anything, nor the fancy stuff that you describe. It doesn't need to be a graphical application, even. The "ls" command can do it!
- kuschku 6y ago
  Flatpak runs applications in what’s nowadays referred to as container: the application can’t see any processes outside the container, can’t access any filesystem except for files you explicitly open with the application, and especially can’t edit your .bashrc. That’s the point of flatpak. But as long as you use X11, there’s one single privilege escalation path left, and that’s the complicated one I described above.
  - enriquto 6y ago
    What if I don't trust the person that sent me the flatpack container itself? A truly secure sandboxing should be a standard OS facility, not tied to a package distribution method. The flatpack/snap model is all wrong. I need to run arbitrary hostile applications in a safe manner, not only those that the developers have decided to distribute in a certain form.
    - kuschku 6y ago
      Sure, but the flatpak model is a way to get these advantages for as large a userbase as fast as possible. If you use flatpaks without bind-home under wayland today, you’ve significantly improved your actual security already. Sandboxing arbitrary badly behaving software is just going to use the same APIs as flatpak, so this helps for your use case as well.

Majestic121 6y ago

I think the point about root is not so much about whether Xorg is run as root, but rather that any application can then elevate itself as root by listening to the key events to catch your password (for example when unlocking your screen) and then sudo with it.

ben-schaaf 6y ago

> You're saying this because Xorg runs as root, which means that any security flaw in Xorg yields root access. They're saying that because every app under Xorg can do keylogging they're effectively running as root, as any of them can keylog your root password next time you type it in.

pmoriarty 6y ago

"But Xorg doesn't have to run as root" All the hand wringing over root privilege escalation on Linux is almost irrelevant for most single-user systems, as since there's really only one non-root account which usually has all the data the user cares about, getting access to just that non-root account would be disaster enough for the user.[1] So if Wayland's design is standing in the way of doing useful things because they're concerned about root privilege escalation, they've got their priorities mixed up. [1] - not to mention that once a non-root account is exploited then getting root in some other way, even if Wayland itself can't be exploited, is usually not difficult.

kuschku 6y ago
The goal isn’t to prevent escalation to root, but to prevent escalation out of a sandbox. If you sandbox an application today, while it can’t access the filesystem at all, and nothing under your user account, as long as it can show you a window under X11, it can log, manipulate, and inject any input events or window contents of any other windows as well. That’s the one single big hole in todays sandboxes under linux, and there’s only two options to solve it: put a whole separate X server into the sandbox of every single application with X-on-X, or replace X. Which is one of the things wayland fixes.