5 ms·

Independent of Wayland or X11, why should a user not be able to take inputs for their own window (as in, the owning process is run as the same user)? Why does i

by mook 6y ago

Independent of Wayland or X11, why should a user not be able to take inputs for their own window (as in, the owning process is run as the same user)? Why does it require a tool that needs extra privileges (that presumably works by doing it at a lower level)? That's a genuine question — as in, I'm mostly thinking about Windows and how window message handling works with UAC windows. You can send messages to your own windows all day without needing extra permissions, but not other users' windows. I assume that's what you're referring to with the X11 sandbox; is it reasonable to set up Wayland _without_ such a sandbox?

chousuke 6y ago
The short reason is that if the user can do it, so can any application running as the user. I don't know about you, but I'd prefer my applications not be able to inject and read inputs arbitrarily, though it may be that even stricter sandboxing is needed to make that a reality; Wayland being stricter than X11 is just one step along the way.
- Blikkentrekker 6y ago
  > though it may be that even stricter sandboxing is needed to make that a reality; Wayland being stricter than X11 is just one step along the way. It is not a situation of “it may be”; it is a situation of “it is”. Right now, it is useless as the security boundary on Unix and any other operating system is fundamentally the user and malicious software that runs as one's user can modify every file and process one owns anyway. I read one comment a while back by a developer that illustrated the fruitlessness of Wayland by saying that it is essentially a lock on a door, that stands in the middle of room, that one can simply walk around, claiming to add security.
  - cycloptic 6y ago
    That would be true if someone refused to use any form of sandboxing, however there are multiple sandboxing solutions available that the "door" works in combination with. That is the only real way to make this kind of security work on an ordinary Linux distribution, the approach used by Android where a new user is created for each application is not really feasible. There are also ways to sandbox X11, it's a bit harder to do, but you do have some options on how you'd like to do things.
cycloptic 6y ago
Yes, you can run Wayland without a sandbox, but it is being built to work in a case where sandboxes are an option.

by mook 6y ago

chousuke 6y ago

The short reason is that if the user can do it, so can any application running as the user. I don't know about you, but I'd prefer my applications not be able to inject and read inputs arbitrarily, though it may be that even stricter sandboxing is needed to make that a reality; Wayland being stricter than X11 is just one step along the way.

Blikkentrekker 6y ago
> though it may be that even stricter sandboxing is needed to make that a reality; Wayland being stricter than X11 is just one step along the way. It is not a situation of “it may be”; it is a situation of “it is”. Right now, it is useless as the security boundary on Unix and any other operating system is fundamentally the user and malicious software that runs as one's user can modify every file and process one owns anyway. I read one comment a while back by a developer that illustrated the fruitlessness of Wayland by saying that it is essentially a lock on a door, that stands in the middle of room, that one can simply walk around, claiming to add security.
- cycloptic 6y ago
  That would be true if someone refused to use any form of sandboxing, however there are multiple sandboxing solutions available that the "door" works in combination with. That is the only real way to make this kind of security work on an ordinary Linux distribution, the approach used by Android where a new user is created for each application is not really feasible. There are also ways to sandbox X11, it's a bit harder to do, but you do have some options on how you'd like to do things.

cycloptic 6y ago

Yes, you can run Wayland without a sandbox, but it is being built to work in a case where sandboxes are an option.