3 ms·

> This fact makes Linux desktops using X11 significantly inferior in security to all other operating systems. This is a valid enough point in isolation, but it

by ajross 4y ago

> This fact makes Linux desktops using X11 significantly inferior in security to all other operating systems. This is a valid enough point in isolation, but it seems belied by actual experience. There are really very few desktop-related exploits I can think of reading about, at least since the days of unencrypted X servers on the network. The most recent panic (maybe 10-15 years ago?) was about the default permissions behind ssh protocol forwarding, and even then I don't think anyone famous got hacked by ssh'ing into an untrusted or compromised host. The simple truth is that getting access to a user's X display on a modern Linux distro requires being able to run arbitrary code as that user, on their system. And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive, and there are much more attractive options to an enterprising hacker than trying to spoof a UI.

MBCook 4y ago
On my Mac, I can run your code. Maybe I download your program, maybe you break the sandbox on my browser. You can’t record all my keyboard activity. You can’t see my whole desktop. You can’t see other applications’ windows. Running local code is not game-over.
- ajross 4y ago
  There's literally one of these every few weeks: https://www.trendmicro.com/en_us/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html https://www.trendmicro.com/en_us/research/22/d/macos-suhelpe... I know what you're saying. I'm not saying it's false (I was writing Xlib/Xt code professionally in the late 90's on a giant open network where we all had "xhost +" in our startup scripts, trust me I know what you can do). I'm saying the rest of the system sucks even worse. If you have an exploit on a modern linux system and want to install a keylogger, you don't do it with X. You just don't. It's not a realistic hole. Especially since the first line of defense (don't let attackers run arbitrary binaries of any type) is actually quite strong on modern systems.
pcwalton 4y ago
> And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive That's why seccomp-bpf exists.
- ajross 4y ago
  An excellent technology. But truthfully if you want to apply that level of filtering, X11 is a more constrained language with more conventional app behavior and it's easier to protect via stateful inspection than arbitrary syscall filtering.
  - pcwalton 4y ago
    But Wayland is far easier than that to secure, because it's reasonably secure today. Securing X11 would be a lot of work, which nobody has signed up to do. Far easier than fixing the relatively minor complaints about Wayland. Besides, seccomp-bpf and windowing protocol security are orthogonal. Desktop apps must make syscalls, and they must interact with the window server. You need security for both.

by ajross 4y ago

MBCook 4y ago

On my Mac, I can run your code. Maybe I download your program, maybe you break the sandbox on my browser. You can’t record all my keyboard activity. You can’t see my whole desktop. You can’t see other applications’ windows. Running local code is not game-over.

ajross 4y ago
There's literally one of these every few weeks: https://www.trendmicro.com/en_us/research/22/d/macos-suhelper-root-privilege-escalation-vulnerability-a-deep-di.html https://www.trendmicro.com/en_us/research/22/d/macos-suhelpe... I know what you're saying. I'm not saying it's false (I was writing Xlib/Xt code professionally in the late 90's on a giant open network where we all had "xhost +" in our startup scripts, trust me I know what you can do). I'm saying the rest of the system sucks even worse. If you have an exploit on a modern linux system and want to install a keylogger, you don't do it with X. You just don't. It's not a realistic hole. Especially since the first line of defense (don't let attackers run arbitrary binaries of any type) is actually quite strong on modern systems.

pcwalton 4y ago

> And let's be real: if you can do that then the game is up anyway. Local root exploits are cheap and pervasive That's why seccomp-bpf exists.

ajross 4y ago
An excellent technology. But truthfully if you want to apply that level of filtering, X11 is a more constrained language with more conventional app behavior and it's easier to protect via stateful inspection than arbitrary syscall filtering.
- pcwalton 4y ago
  But Wayland is far easier than that to secure, because it's reasonably secure today. Securing X11 would be a lot of work, which nobody has signed up to do. Far easier than fixing the relatively minor complaints about Wayland. Besides, seccomp-bpf and windowing protocol security are orthogonal. Desktop apps must make syscalls, and they must interact with the window server. You need security for both.