4 ms·

The problem is that with a shared X11, sandboxing is pointless. Any application with access to the X11 socket has easy privilege escalation available to it. By

The problem is that with a shared X11, sandboxing is pointless. Any application with access to the X11 socket has easy privilege escalation available to it. By for example, injecting into a sudo enabled terminal or keylogging the user. Admittedly, with Wayland the security situation wasn't ideal until recently with the adoption of security contexts that can finally allow you to deny screen capture access among other Wayland protocols to sandboxed applications[1]. [1] <https://git.sr.ht/~whynothugo/way-secure https://git.sr.ht/~whynothugo/way-secure>

nolist_policy 3y ago
AFAIK Wayland does not provide screen capture though. It is provided outside of it via xdg-desktop-portal[1]. [1] https://flatpak.github.io/xdg-desktop-portal/docs/portal-interfaces.html https://flatpak.github.io/xdg-desktop-portal/docs/portal-int...
- coppsilgold 3y ago
  wlroots-based compositors had screen capture for a long time. I'm not sure about Gnome. <https://wayland.app/protocols/wlr-screencopy-unstable-v1 https://wayland.app/protocols/wlr-screencopy-unstable-v1> <https://sr.ht/~emersion/grim/ https://sr.ht/~emersion/grim/> <https://github.com/ammen99/wf-recorder https://github.com/ammen99/wf-recorder>
denton-scratch 3y ago
So like nearly every other X11 user, my X11 server is not exposed to the network at all. Not the internet, and not my LAN. It's the default; you have to do work to make it insecure. I don't hot-desk, and I use SSH to talk to the machines on my network that don't need a GUI. Wayland solves a problem that I've never had. I don't believe I'm an outlier. I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I don't think that the majority of Linux users are hot-desking corporate users, with multiple user sessions on the same machine, or trying to run a GUI over a network connection. Those are eccentric use-cases. Red Hat/Gnome are trying to make a version of Linux that can be used by a child. I think that's a fine objective; but it's not even on the horizon. An operating system that just gets out of your way would be lovely, but for now it's a dream (and Windows isn't that system, of course; I think managing a Linux system is miles easier than trying to manage Windows). As far as Gnome is concerned, it's experienced at least two violent changes of direction in its history. One of the things you need from a child-friendly OS is no violent changes of direction. If a GUI in particular changes dramatically from one version to the next, that's a big fail.
- nolist_policy 3y ago
  And then a website triggers an exploit in your firefox process and gains remote code execution. Okay, firefox uses sandboxing so even with code execution the attacker won't gain much. Except that sandboxed process has a unix-socket connection open to a certain other process...
  - denton-scratch 3y ago
    Yeah, I get it. You make a good point. A website might target a Linux desktop user in the way you describe, and that is a serious weakness in X11. But this is a rather exotic scenario: the attacker uses an exploit that works on the Linux version of a browser, and uses that to attack some other application running under X11. That's a complicated chain of dependencies; it might be worth it if I was operating a bank of Uranium centrifuges, but not just to violate my privacy (e.g. steal passwords from my password manager). I think Wayland is a fine project, and when it's mature I'll jump. I'd prefer a local-only GUI. But I don't think it's mature yet. And the way it's pushed reminds me of Poetteringware; I need to be sure I'm not being shafted.
- coldpie 3y ago
  > So like nearly every other X11 user, my X11 server is not exposed to the network at all. Are you misunderstanding what the OP meant by "socket"? It doesn't have to literally be a network socket, but your X11 apps all connect to the server via some IPC mechanism, could be a network socket or a local named pipe (I think it lives out in /var/, but I'm not on a Linux system atm). Their point was there is no client authentication or separation via this IPC mechanism: one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. You can see this for yourself using a virtual keyboard program. It's just an X11 app like any other, it's just injecting messages for the server to dispatch to another client. > I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems.
wing-_-nuts 3y ago
> The problem is that with a shared X11, sandboxing is pointless. You're not hearing me. For most desktop users, there was never a need to sandbox applications. It's simply not a threat vector 99% of desktop linux users have ever dealt with. It's certainly not a big enough problem to break the screen / input recording and sharing of tons of applications. Again, if you need to do that, the correct way is to PROMPT the user, not invisibly disable it entirely.
- acdha 3y ago
  You’re saying Linux users never make mistakes like clicking on the wrong link or opening the wrong attachment? Unless that’s true, yes, we need sandboxing.
  - deleted 3y ago
    [deleted]
  - Dylan16807 3y ago
    Sandboxing would be nice, but very little gets sandboxed right now, so it's hard to classify it as a real need. And the sandboxes that do get used aren't very vulnerable to X11 attacks. If you're running firefox the web process sandbox doesn't have X11 access, and by the time the rendering process gets chain-exploited it can access your files directly without needing to go through X11.
    - acdha 3y ago
      Arguing that we shouldn’t deploy sandboxing because it’s not widely used seems counterproductive, and a recipe for not catching up with macOS or even Windows. Even if Firefox is perfect, that still leaves everything else which connects to the outside world or opens downloaded files. We know there’s a long history of those exploits and everyone serious in the desktop OS space has been trying to harden things so it’s not a single mistake away from an irrecoverable compromise.
      - Dylan16807 3y ago
tedunangst 3y ago
The X11 Security extension is nearly 30 years old at this point, but Wayland users still haven't heard of it. One wonders what else they're missing out on.
- nolist_policy 3y ago
  Yes and then HN'lers will shame any distro enabling it by default to death.
- yjftsjthsd-h 3y ago
  I've wondered about this for a while - why didn't XACE get wide adoption?
  - tedunangst 3y ago
    Because nobody actually cares about keyloggers. They just like how it feels to say "Wayland is secure". Anybody who cared about key loggers or screen scrapers or any of that solved their problem two decades ago.
  - arp242 3y ago
    From what I can find XACE doesn't actually work all that well. e.g. [1] mentions "X Applications expect full access to X server and die when denied any access". It's rather vague and kind of hard to find more detailed information. I also agree with the sibling comment from tedunangst that most people just don't worry all that much about keyloggers, nor should they IMHO because it's not really a common attack vector. [1]: https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandbox.pdf https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandb...

nolist_policy 3y ago

AFAIK Wayland does not provide screen capture though. It is provided outside of it via xdg-desktop-portal[1]. [1] https://flatpak.github.io/xdg-desktop-portal/docs/portal-interfaces.html https://flatpak.github.io/xdg-desktop-portal/docs/portal-int...

coppsilgold 3y ago
wlroots-based compositors had screen capture for a long time. I'm not sure about Gnome. <https://wayland.app/protocols/wlr-screencopy-unstable-v1 https://wayland.app/protocols/wlr-screencopy-unstable-v1> <https://sr.ht/~emersion/grim/ https://sr.ht/~emersion/grim/> <https://github.com/ammen99/wf-recorder https://github.com/ammen99/wf-recorder>

denton-scratch 3y ago

So like nearly every other X11 user, my X11 server is not exposed to the network at all. Not the internet, and not my LAN. It's the default; you have to do work to make it insecure. I don't hot-desk, and I use SSH to talk to the machines on my network that don't need a GUI. Wayland solves a problem that I've never had. I don't believe I'm an outlier. I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I don't think that the majority of Linux users are hot-desking corporate users, with multiple user sessions on the same machine, or trying to run a GUI over a network connection. Those are eccentric use-cases. Red Hat/Gnome are trying to make a version of Linux that can be used by a child. I think that's a fine objective; but it's not even on the horizon. An operating system that just gets out of your way would be lovely, but for now it's a dream (and Windows isn't that system, of course; I think managing a Linux system is miles easier than trying to manage Windows). As far as Gnome is concerned, it's experienced at least two violent changes of direction in its history. One of the things you need from a child-friendly OS is no violent changes of direction. If a GUI in particular changes dramatically from one version to the next, that's a big fail.

nolist_policy 3y ago
And then a website triggers an exploit in your firefox process and gains remote code execution. Okay, firefox uses sandboxing so even with code execution the attacker won't gain much. Except that sandboxed process has a unix-socket connection open to a certain other process...
- denton-scratch 3y ago
  Yeah, I get it. You make a good point. A website might target a Linux desktop user in the way you describe, and that is a serious weakness in X11. But this is a rather exotic scenario: the attacker uses an exploit that works on the Linux version of a browser, and uses that to attack some other application running under X11. That's a complicated chain of dependencies; it might be worth it if I was operating a bank of Uranium centrifuges, but not just to violate my privacy (e.g. steal passwords from my password manager). I think Wayland is a fine project, and when it's mature I'll jump. I'd prefer a local-only GUI. But I don't think it's mature yet. And the way it's pushed reminds me of Poetteringware; I need to be sure I'm not being shafted.
coldpie 3y ago
> So like nearly every other X11 user, my X11 server is not exposed to the network at all. Are you misunderstanding what the OP meant by "socket"? It doesn't have to literally be a network socket, but your X11 apps all connect to the server via some IPC mechanism, could be a network socket or a local named pipe (I think it lives out in /var/, but I'm not on a Linux system atm). Their point was there is no client authentication or separation via this IPC mechanism: one X11 application can send messages directly to another X11 application. That's where their example of a malicious app inserting text into a sudo terminal comes from. You can see this for yourself using a virtual keyboard program. It's just an X11 app like any other, it's just injecting messages for the server to dispatch to another client. > I believe most Linux users are like me: they are conscious of security issues, and they don't need a nanny to look after them. I feel under this argument, you can also describe memory segmentation as a "nanny" =/ I don't think many would argue we should go back to shared memory systems.

wing-_-nuts 3y ago

> The problem is that with a shared X11, sandboxing is pointless. You're not hearing me. For most desktop users, there was never a need to sandbox applications. It's simply not a threat vector 99% of desktop linux users have ever dealt with. It's certainly not a big enough problem to break the screen / input recording and sharing of tons of applications. Again, if you need to do that, the correct way is to PROMPT the user, not invisibly disable it entirely.

acdha 3y ago
You’re saying Linux users never make mistakes like clicking on the wrong link or opening the wrong attachment? Unless that’s true, yes, we need sandboxing.
- deleted 3y ago
  [deleted]
- Dylan16807 3y ago
  Sandboxing would be nice, but very little gets sandboxed right now, so it's hard to classify it as a real need. And the sandboxes that do get used aren't very vulnerable to X11 attacks. If you're running firefox the web process sandbox doesn't have X11 access, and by the time the rendering process gets chain-exploited it can access your files directly without needing to go through X11.
  - acdha 3y ago
    Arguing that we shouldn’t deploy sandboxing because it’s not widely used seems counterproductive, and a recipe for not catching up with macOS or even Windows. Even if Firefox is perfect, that still leaves everything else which connects to the outside world or opens downloaded files. We know there’s a long history of those exploits and everyone serious in the desktop OS space has been trying to harden things so it’s not a single mistake away from an irrecoverable compromise.
    - Dylan16807 3y ago

tedunangst 3y ago

The X11 Security extension is nearly 30 years old at this point, but Wayland users still haven't heard of it. One wonders what else they're missing out on.

nolist_policy 3y ago
Yes and then HN'lers will shame any distro enabling it by default to death.
yjftsjthsd-h 3y ago
I've wondered about this for a while - why didn't XACE get wide adoption?
- tedunangst 3y ago
  Because nobody actually cares about keyloggers. They just like how it feels to say "Wayland is secure". Anybody who cared about key loggers or screen scrapers or any of that solved their problem two decades ago.
- arp242 3y ago
  From what I can find XACE doesn't actually work all that well. e.g. [1] mentions "X Applications expect full access to X server and die when denied any access". It's rather vague and kind of hard to find more detailed information. I also agree with the sibling comment from tedunangst that most people just don't worry all that much about keyloggers, nor should they IMHO because it's not really a common attack vector. [1]: https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandbox.pdf https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandb...