4 ms·
> Is there any way to prevent it? Put it into it's own namespace, and only allow it to connect to your X11 session over TCP.
by akira2501 5y ago
> Is there any way to prevent it?
Put it into it's own namespace, and only allow it to connect to your X11 session over TCP.
- mishafb 5y agoI think only Wayland has real security, X11 lets you do anything
- phendrenad2 5y agoDoes that prevent it from reading from `/proc`?
- jraph 5y agoIn a PID namespace [1], it will be able to read /proc, but will see nothing interesting other than a strangely empty system. The process is isolated from the rest of the system as far as processes and PIDs are concerned. [1] https://www.redhat.com/sysadmin/pid-namespace https://www.redhat.com/sysadmin/pid-namespace
- zzo38computer 5y agoIf you want to prevent programs from accessing other windows, then (in addition to using its own namespace and file access) you would also need to proxy the X server, or run it in a nested X server (which does not have access to the one outside).
- yjftsjthsd-h 5y agoSpecifically, Xephyr is generally the go-to option, although there are others.
- kamray23 5y agoFor a more general solution, firejail.