5 ms·

All of this is outweighed by the fact that any application using X11 has complete control of your entire desktop, including other applications. This fact makes

All of this is outweighed by the fact that any application using X11 has complete control of your entire desktop, including other applications. This fact makes Linux desktops using X11 significantly inferior in security to all other operating systems. There is no way to sandbox an application that is allowed to send window events to all other applications, since it can just tell your desktop environment to open a shell and then send commands at will. The only reasonable solution (nested X servers and XSECURITY are not reasonable solutions) is to switch to Wayland.

happymellon 4y ago
I had understood that this was also true under ~MacOS and~ Windows. Keylogging and screen monitoring is trivial in Windows. Wayland solves a problem that is present on all systems, but it does it with a sledgehammer. [Edit] I am reminded that MacOS has a sane model for this.
- MBCook 4y ago
  MacOS does not allow screen sharing (say in Google Chat) of your entire desktop or other windows without user permission. The application has to be added to a list of allowed applications through the System Preferences. Same with intercepting all keyboard input IIRC. Can’t speak to Windows.
  - happymellon 4y ago
    You are correct, I remember now. Although this wasn't always the case, it has been true for a few years now.
    - MBCook 4y ago
      Yeah. Two or three releases I think.
- pcwalton 4y ago
  macOS has a reasonable security model and it doesn't allow that without explicit (annoying-to-grant) user consent. On Windows, apps that are concerned about RCE can drop privileges and still access the desktop in a secure way. On X11, there is no such option; you have to adopt a Chromium-like content/chrome process model, with the content process having no windowing access whatsoever. Because it's so difficult, almost nobody does this on X11.
  - happymellon 4y ago
    Ah, yes you are correct! I do remember the Mac security model, and I think it is a much better solution to Wayland. Don't ban, just make it a user specific choice.
    - pcwalton 4y ago
      I can't imagine anyone involved with Wayland wants to ban screen recorders. They just want to make sure they get the security right.
      - happymellon 4y ago
        But they did, and there are requests that they provide a standardised API for screensharing/recording which are `wontfix`. All the desktops made their own API outside of Wayland and Pipewire standardised a global API wrapper for everyone's implementation. Whether that's the correct location rather than Wayland is a separate discussion.
        kaba0 4y ago
        But then you are just claiming inconsistent things. Also, screen sharing is indeed a different problem as that often mandates sound recording/transmission as well which is very much not in scope for a display manager. (That’s where we can see how a cathedral model could fare better). I think having a simple screen shot api in wayland is a good idea, while letting pipewire properly solve video (and optionally audio) channeling a good technical solution.
- vetinari 4y ago
  MacOS and Windows never gave direct socket and well-defined protocol to the display server. If you wanted to connect, you had to use their client libs. Turns out, you can handle many cases in the linked libraries and if you do not have them, and you cannot change the protocol, touch luck. Sledgehammer time.
smoldesu 4y ago
All of that is outweighed by the fact that Wayland does not "just work" in the same way Xorg does. I absolutely despise x11, it's far too long in the tooth and needs to be replaced by literally anything. MacOS has been using Quartz for the better part of a decade, and on Linux, your choice of window servers is either Tweedle-Dee or Tweedle-Dum. If Wayland's developers hadn't used wlroots as a purgatory for salient concerns about their project, then we might have a good starting spot. If they created a Xorg-agnostic interface for running a Mutter shell on legacy desktops, that would be even better. But we got nothing. They cut real features like AppIndicators straight out of the project for no good reason. They left every other desktop environment out in the cold. People understand that Wayland isn't a drop-in replacement for Xorg, and that's becoming a problem. People want to run desktops that aren't GNOME or Sway, people want to use hardware that isn't AMD-based, and people want to use the software they've always had just like they did before. Wayland doesn't do that, and after 10 years of antagonizing Linux software development, I think it's safe to say it failed.
- hollerith 4y ago
  >I think it's safe to say [Wayland] failed In that case I think it is safe to say that all the apps I have been using for over a year have been talking to my window server using a failed protocol. But I really like the experience.
cxr 4y ago
> any application using X11 has complete control of your entire desktop, including other applications[...] There is no way to sandbox an application That is not a concern in the world that I or many people live in; the desktop is not expected to provide this type of Web browser-level isolation to protect against adversarial programs running on our machines. It may in theory be worse than e.g. Windows in this regard, but in practice you can operate a computer in the freedesktop.org tradition with much more confidence compared to running Windows. The traditional packaging and distribution practices and social norms turn out to provide a much better line of defense than whatever technical design is being imported from other contemporary OSes.
- pcwalton 4y ago
  > That is not a concern in the world that I or many people live in; the desktop is not expected to provide this type of Web browser-level isolation to provide protection from adversarial programs running on our machines. Increasingly, it is. Mobile OS's have operated under this assumption since the App Store. Windows and macOS are both strongly moving in this direction. Sandboxed apps are the future, and desktop Linux is behind. > The traditional packaging and distribution practices and social norms turn out to provide a much better line of defense than whatever technical design is being imported from other contemporary OSes. No, they don't. The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. With X11, any compromised app has keys to the kingdom.
  - cxr 4y ago
    > > That is not a concern in the world that I or many people live in[...] > Increasingly, it is. You haven't really done anything to show this. And as a point of fact, I'm in much better position to explain the concerns I live with than you are. Appealing yet again to what other platforms are doing is not an argument. Mac and Windows and Android are doing this. Fine. Granted. Where's your evidence of the actual, practical threat, besides merely gesturing to the (purported) imperative to follow their mitigation strategy? To repeat, this is just not a concern in the world that we're talking about—that other platforms/vendors have taken a different position is not evidence that their position is ipso facto rational and correct. > The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. I'm not. I'm far more concerned, actually, about the threat from programs and utilities that don't have GUIs, incl. programs that depend on third-party packages of dubious provenance, than I am concerned about the threat of desktop applications reaching across to interfere with each other and violating any (non-existent) expectation of isolation of the sort described here.
kelnos 4y ago
And yet, 12 years later, Wayland still has significant problems, and has not displaced X11. There's a reason for that: it's just not good enough. I find it hard to believe that the security issues with X11 could not be fixed. It might have to be done in a way that causes some incompatibilities and pain, but I can't imagine that would be anywhere near as bad as all the time people have spent working on and dealing with Wayland. I mean, c'mon, here's a simple X11 "any app can read out the contents of any other window" solution: add access controls to Xorg so that they can't. You open a connection to the X server, and you can read any window created by that connection, and that's it. Input events? You only get the input events destined for windows created on your connection. Want to write a screenshot or screen recording app, or an app that allows sharing your screen? Cool, we can create an interface for that, one that requires user confirmation. Privilege separation is hardly an unsolved problem. I'm not saying all of this is easy, but it strains credibility to suggest that this could not have been accomplished in the past 12+ years since work started on Wayland.
- pcwalton 4y ago
  > I mean, c'mon, here's a simple X11 "any app can read out the contents of any other window" solution: add access controls to Xorg so that they can't. This exists and is called XSECURITY. It breaks everything, so nobody uses it. Also, nobody thinks Xorg is secure against RCE from hostile clients: the code is just too old and brittle.
  - uecker 4y ago
    Xorg network code is considered well audited and very few problems have been found over the years. Please stop making stuff up.
    - tadfisher 4y ago
      The most recent release had to be rolled back after four zero-day remote privilege escalations were found and given CVEs. The network code may be fine, but everything exposed to the network is not, and manpower is dwindling to address problems.
ajross 4y ago
> This fact makes Linux desktops using X11 significantly inferior in security to all other operating systems. This is a valid enough point in isolation, but it seems belied by actual experience. There are really very few desktop-related exploits I can think of reading about, at least since the days of unencrypted X servers on the network. The most recent panic (maybe 10-15 years ago?) was about the default permissions behind ssh protocol forwarding, and even then I don't think anyone famous got hacked by ssh'ing into an untrusted or compromised host. The simple truth is that getting access to a user's X display on a modern Linux distro requires being able to run arbitrary code as that user, on their system. And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive, and there are much more attractive options to an enterprising hacker than trying to spoof a UI.
- MBCook 4y ago
  On my Mac, I can run your code. Maybe I download your program, maybe you break the sandbox on my browser. You can’t record all my keyboard activity. You can’t see my whole desktop. You can’t see other applications’ windows. Running local code is not game-over.
  - ajross 4y ago
    There's literally one of these every few weeks: https://www.trendmicro.com/en_us/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html https://www.trendmicro.com/en_us/research/22/d/macos-suhelpe... I know what you're saying. I'm not saying it's false (I was writing Xlib/Xt code professionally in the late 90's on a giant open network where we all had "xhost +" in our startup scripts, trust me I know what you can do). I'm saying the rest of the system sucks even worse. If you have an exploit on a modern linux system and want to install a keylogger, you don't do it with X. You just don't. It's not a realistic hole. Especially since the first line of defense (don't let attackers run arbitrary binaries of any type) is actually quite strong on modern systems.
- pcwalton 4y ago
  > And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive That's why seccomp-bpf exists.
uecker 4y ago
X has trusted on non-trusted clients. The problem is that non-trusted clients were not allowed to use some important extensions such as Xrender. This could be changed though and largely solve this problem. Of course, apps of the same user are not sandboxed against each other on the system level on Unix, so this only helps if you also do this.

happymellon 4y ago

I had understood that this was also true under ~MacOS and~ Windows. Keylogging and screen monitoring is trivial in Windows. Wayland solves a problem that is present on all systems, but it does it with a sledgehammer. [Edit] I am reminded that MacOS has a sane model for this.

MBCook 4y ago
MacOS does not allow screen sharing (say in Google Chat) of your entire desktop or other windows without user permission. The application has to be added to a list of allowed applications through the System Preferences. Same with intercepting all keyboard input IIRC. Can’t speak to Windows.
- happymellon 4y ago
  You are correct, I remember now. Although this wasn't always the case, it has been true for a few years now.
  - MBCook 4y ago
    Yeah. Two or three releases I think.
pcwalton 4y ago
macOS has a reasonable security model and it doesn't allow that without explicit (annoying-to-grant) user consent. On Windows, apps that are concerned about RCE can drop privileges and still access the desktop in a secure way. On X11, there is no such option; you have to adopt a Chromium-like content/chrome process model, with the content process having no windowing access whatsoever. Because it's so difficult, almost nobody does this on X11.
- happymellon 4y ago
  Ah, yes you are correct! I do remember the Mac security model, and I think it is a much better solution to Wayland. Don't ban, just make it a user specific choice.
  - pcwalton 4y ago
    I can't imagine anyone involved with Wayland wants to ban screen recorders. They just want to make sure they get the security right.
    - happymellon 4y ago
      But they did, and there are requests that they provide a standardised API for screensharing/recording which are `wontfix`. All the desktops made their own API outside of Wayland and Pipewire standardised a global API wrapper for everyone's implementation. Whether that's the correct location rather than Wayland is a separate discussion.
      - kaba0 4y ago
        But then you are just claiming inconsistent things. Also, screen sharing is indeed a different problem as that often mandates sound recording/transmission as well which is very much not in scope for a display manager. (That’s where we can see how a cathedral model could fare better). I think having a simple screen shot api in wayland is a good idea, while letting pipewire properly solve video (and optionally audio) channeling a good technical solution.
vetinari 4y ago
MacOS and Windows never gave direct socket and well-defined protocol to the display server. If you wanted to connect, you had to use their client libs. Turns out, you can handle many cases in the linked libraries and if you do not have them, and you cannot change the protocol, touch luck. Sledgehammer time.

smoldesu 4y ago

All of that is outweighed by the fact that Wayland does not "just work" in the same way Xorg does. I absolutely despise x11, it's far too long in the tooth and needs to be replaced by literally anything. MacOS has been using Quartz for the better part of a decade, and on Linux, your choice of window servers is either Tweedle-Dee or Tweedle-Dum. If Wayland's developers hadn't used wlroots as a purgatory for salient concerns about their project, then we might have a good starting spot. If they created a Xorg-agnostic interface for running a Mutter shell on legacy desktops, that would be even better. But we got nothing. They cut real features like AppIndicators straight out of the project for no good reason. They left every other desktop environment out in the cold. People understand that Wayland isn't a drop-in replacement for Xorg, and that's becoming a problem. People want to run desktops that aren't GNOME or Sway, people want to use hardware that isn't AMD-based, and people want to use the software they've always had just like they did before. Wayland doesn't do that, and after 10 years of antagonizing Linux software development, I think it's safe to say it failed.

hollerith 4y ago
>I think it's safe to say [Wayland] failed In that case I think it is safe to say that all the apps I have been using for over a year have been talking to my window server using a failed protocol. But I really like the experience.

cxr 4y ago

> any application using X11 has complete control of your entire desktop, including other applications[...] There is no way to sandbox an application That is not a concern in the world that I or many people live in; the desktop is not expected to provide this type of Web browser-level isolation to protect against adversarial programs running on our machines. It may in theory be worse than e.g. Windows in this regard, but in practice you can operate a computer in the freedesktop.org tradition with much more confidence compared to running Windows. The traditional packaging and distribution practices and social norms turn out to provide a much better line of defense than whatever technical design is being imported from other contemporary OSes.

pcwalton 4y ago
> That is not a concern in the world that I or many people live in; the desktop is not expected to provide this type of Web browser-level isolation to provide protection from adversarial programs running on our machines. Increasingly, it is. Mobile OS's have operated under this assumption since the App Store. Windows and macOS are both strongly moving in this direction. Sandboxed apps are the future, and desktop Linux is behind. > The traditional packaging and distribution practices and social norms turn out to provide a much better line of defense than whatever technical design is being imported from other contemporary OSes. No, they don't. The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. With X11, any compromised app has keys to the kingdom.
- cxr 4y ago
  > > That is not a concern in the world that I or many people live in[...] > Increasingly, it is. You haven't really done anything to show this. And as a point of fact, I'm in much better position to explain the concerns I live with than you are. Appealing yet again to what other platforms are doing is not an argument. Mac and Windows and Android are doing this. Fine. Granted. Where's your evidence of the actual, practical threat, besides merely gesturing to the (purported) imperative to follow their mitigation strategy? To repeat, this is just not a concern in the world that we're talking about—that other platforms/vendors have taken a different position is not evidence that their position is ipso facto rational and correct. > The thing you're trying to defend against is not just hostile apps, but someone remotely achieving RCE in one of your network-exposed applications. I'm not. I'm far more concerned, actually, about the threat from programs and utilities that don't have GUIs, incl. programs that depend on third-party packages of dubious provenance, than I am concerned about the threat of desktop applications reaching across to interfere with each other and violating any (non-existent) expectation of isolation of the sort described here.

kelnos 4y ago

And yet, 12 years later, Wayland still has significant problems, and has not displaced X11. There's a reason for that: it's just not good enough. I find it hard to believe that the security issues with X11 could not be fixed. It might have to be done in a way that causes some incompatibilities and pain, but I can't imagine that would be anywhere near as bad as all the time people have spent working on and dealing with Wayland. I mean, c'mon, here's a simple X11 "any app can read out the contents of any other window" solution: add access controls to Xorg so that they can't. You open a connection to the X server, and you can read any window created by that connection, and that's it. Input events? You only get the input events destined for windows created on your connection. Want to write a screenshot or screen recording app, or an app that allows sharing your screen? Cool, we can create an interface for that, one that requires user confirmation. Privilege separation is hardly an unsolved problem. I'm not saying all of this is easy, but it strains credibility to suggest that this could not have been accomplished in the past 12+ years since work started on Wayland.

pcwalton 4y ago
> I mean, c'mon, here's a simple X11 "any app can read out the contents of any other window" solution: add access controls to Xorg so that they can't. This exists and is called XSECURITY. It breaks everything, so nobody uses it. Also, nobody thinks Xorg is secure against RCE from hostile clients: the code is just too old and brittle.
- uecker 4y ago
  Xorg network code is considered well audited and very few problems have been found over the years. Please stop making stuff up.
  - tadfisher 4y ago
    The most recent release had to be rolled back after four zero-day remote privilege escalations were found and given CVEs. The network code may be fine, but everything exposed to the network is not, and manpower is dwindling to address problems.

ajross 4y ago

> This fact makes Linux desktops using X11 significantly inferior in security to all other operating systems. This is a valid enough point in isolation, but it seems belied by actual experience. There are really very few desktop-related exploits I can think of reading about, at least since the days of unencrypted X servers on the network. The most recent panic (maybe 10-15 years ago?) was about the default permissions behind ssh protocol forwarding, and even then I don't think anyone famous got hacked by ssh'ing into an untrusted or compromised host. The simple truth is that getting access to a user's X display on a modern Linux distro requires being able to run arbitrary code as that user, on their system. And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive, and there are much more attractive options to an enterprising hacker than trying to spoof a UI.

MBCook 4y ago
On my Mac, I can run your code. Maybe I download your program, maybe you break the sandbox on my browser. You can’t record all my keyboard activity. You can’t see my whole desktop. You can’t see other applications’ windows. Running local code is not game-over.
- ajross 4y ago
  There's literally one of these every few weeks: https://www.trendmicro.com/en_us/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html https://www.trendmicro.com/en_us/research/22/d/macos-suhelpe... I know what you're saying. I'm not saying it's false (I was writing Xlib/Xt code professionally in the late 90's on a giant open network where we all had "xhost +" in our startup scripts, trust me I know what you can do). I'm saying the rest of the system sucks even worse. If you have an exploit on a modern linux system and want to install a keylogger, you don't do it with X. You just don't. It's not a realistic hole. Especially since the first line of defense (don't let attackers run arbitrary binaries of any type) is actually quite strong on modern systems.
pcwalton 4y ago
> And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive That's why seccomp-bpf exists.

uecker 4y ago

X has trusted on non-trusted clients. The problem is that non-trusted clients were not allowed to use some important extensions such as Xrender. This could be changed though and largely solve this problem. Of course, apps of the same user are not sandboxed against each other on the system level on Unix, so this only helps if you also do this.