From what I can find XACE doesn't actually work all that well. e.g. [1] mentions "X Applications expect full access to X server and die when denied any access".

From what I can find XACE doesn't actually work all that well. e.g. [1] mentions "X Applications expect full access to X server and die when denied any access". It's rather vague and kind of hard to find more detailed information. I also agree with the sibling comment from tedunangst that most people just don't worry all that much about keyloggers, nor should they IMHO because it's not really a common attack vector. [1]: https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandbox.pdf https://fedorapeople.org/~dwalsh/SELinux/Presentations/sandb...