4 ms·

From what I understand, and I’m no expert on this, X pretty much broke application sandboxing. X’s design was inherently insecure in the context of modern OS se

From what I understand, and I’m no expert on this, X pretty much broke application sandboxing. X’s design was inherently insecure in the context of modern OS security practices.

asveikau 3y ago
I think you're phrasing that incorrectly. There was no application sandboxing for X to break. And you can't build sandboxing atop X. You speak as if application sandboxing within the ever existed in the past... Not that people tried to build it and X doesn't play well with it.
- gpderetta 3y ago
  I don't profess to have any deep knowledge of X11 or Wayland, but I don't understand how sandboxing can't work in X11. XWayland exists and it is either non-sandboxed (hence Wayland doesn't add any security benefit) or it is. And if it is it means that X can be sandboxed and it should be possible to run XonX sandboxes. Something like xnest.
  - asveikau 3y ago
    This is a very good comment. I guess then the claim is more that no common implementation is amenable to sandboxing, and the compatibility break of a brand new protocol means they can implement it from day 1 in the way they like. Which is a lot weaker an argument, but practically speaking, it's true that no one is rushing to bolt on security features to X. To be clear I'm not realy a Wayland fan.
- hedora 3y ago
  You certainly can build sandboxing atop X11. If you're reading using a web browser on a Linux desktop (or in a VM on a Linux desktop), then you're literally staring at an existence proof.
  - asveikau 3y ago
    I guess the point is it can't be sandboxed by directly exposing X protocol messages to the sandboxed app. Although your sibling comment by gpderetta makes an excellent point. I guess they're saying no one wants to sandbox the X protocol, and breaking compatibility, proponents would claim, lets you design a sandbox friendly protocol from scratch.
woodruffw 3y ago
Without claiming that X is secure: I think it’s more accurate to say that X has never cared about application isolation at all, since it wasn’t (like its contemporaries) built with that paradigm in mind. In other words: while not originally UNIX-y, X matured in an ecosystem that idiomatically treats every userspace program as a perfect proxy for the user agent themselves. Sandboxing is a foreign (but good!) idiom that’s being bolted onto that paradigm.
chasil 3y ago
OpenBSD does implement some kind of privilege separation for X. $ ps ax -ouser,args | awk 'NR==1;/X.*:/' USER COMMAND _x11 /usr/X11R6/bin/X :0 vt05 -auth /etc/X11/xenodm/authdir/authfiles/A:0-PFzcIG (Xorg) root X: [priv] (Xorg)

From what I understand, and I’m no expert on this, X pretty much broke application sandboxing. X’s design was inherently insecure in the context of modern OS security practices.

asveikau 3y ago

I think you're phrasing that incorrectly. There was no application sandboxing for X to break. And you can't build sandboxing atop X. You speak as if application sandboxing within the ever existed in the past... Not that people tried to build it and X doesn't play well with it.

gpderetta 3y ago
I don't profess to have any deep knowledge of X11 or Wayland, but I don't understand how sandboxing can't work in X11. XWayland exists and it is either non-sandboxed (hence Wayland doesn't add any security benefit) or it is. And if it is it means that X can be sandboxed and it should be possible to run XonX sandboxes. Something like xnest.
- asveikau 3y ago
  This is a very good comment. I guess then the claim is more that no common implementation is amenable to sandboxing, and the compatibility break of a brand new protocol means they can implement it from day 1 in the way they like. Which is a lot weaker an argument, but practically speaking, it's true that no one is rushing to bolt on security features to X. To be clear I'm not realy a Wayland fan.
hedora 3y ago
You certainly can build sandboxing atop X11. If you're reading using a web browser on a Linux desktop (or in a VM on a Linux desktop), then you're literally staring at an existence proof.
- asveikau 3y ago
  I guess the point is it can't be sandboxed by directly exposing X protocol messages to the sandboxed app. Although your sibling comment by gpderetta makes an excellent point. I guess they're saying no one wants to sandbox the X protocol, and breaking compatibility, proponents would claim, lets you design a sandbox friendly protocol from scratch.

woodruffw 3y ago

Without claiming that X is secure: I think it’s more accurate to say that X has never cared about application isolation at all, since it wasn’t (like its contemporaries) built with that paradigm in mind. In other words: while not originally UNIX-y, X matured in an ecosystem that idiomatically treats every userspace program as a perfect proxy for the user agent themselves. Sandboxing is a foreign (but good!) idiom that’s being bolted onto that paradigm.

chasil 3y ago

OpenBSD does implement some kind of privilege separation for X. $ ps ax -ouser,args | awk 'NR==1;/X.*:/' USER COMMAND _x11 /usr/X11R6/bin/X :0 vt05 -auth /etc/X11/xenodm/authdir/authfiles/A:0-PFzcIG (Xorg) root X: [priv] (Xorg)