6 ms·

Enhancing x11 Application Security with LXC (2025)

73 points by shirozuki 3mo ago

LtWorf 3mo ago
Or one could just use firejail, which comes with a number of pre made profiles for common applications.
- nosioptar 3mo ago
  The sandbox command works well on systems using SELinux. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/chap-security-enhanced_linux-securing_programs_using_sandbox https://docs.redhat.com/en/documentation/red_hat_enterprise_...
calvinmorrison 3mo ago
Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well. https://github.com/X11Libre/xserver/blob/master/doc/Xnamespace.md https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...
- Chu4eeno 3mo ago
  Not the only one, there's also a new one (written in zig) I've forgot the name of. edit: phoenix was the name: https://github.com/external-mirrors/phoenix#phoenix https://github.com/external-mirrors/phoenix#phoenix
  - mappu 3mo ago
    There's also this new one: https://github.com/joske/yserver https://github.com/joske/yserver
    - asveikau 3mo ago
      Hard for me to take that one seriously.. For example they call out byte swapping for endianness as the type of cruft holding back X11. Such a trivial thing to be concerned enough to put in the readme... (I guess Phoenix is also putting this..) Seems like mostly authored by Claude too.
      - shevy-java 3mo ago
        > Seems like mostly authored by Claude too. This is a problem in many projects now. xserver and mruby for instance also succumbed to claude. It seems claude is the ultimate virus. It leaks into almost every project now. So I am not sure it can be used as differentiating criterium here merely for being claude AI slop. I've noticed a lot of documentation is now totally useless though; claude slop is just unreadable to me. It's like a person who is not able to think, wrote the documentation. I did not have this issue back when real humans wrote documentation, even though high quality documentation was always rare anyway. But, for instance, Jeremy Evans in his projects tends to write high-quality documentation in general, and I can understand it fine, whereas if you look at matz spinel, I have no idea what the AI slop in the README is really trying to convey. Or on ffmpeg, a german dev used AI slop to try to create some proposal, and someone else pointed out that this is pointless and impossible to read and understand, yet the original guy did not understand why real people don't want to be AI slop spammed. It's very strange.
- lotharcable 3mo ago
  XWayland is actively developed. XFree86, which is the "standalone DDX" you see on X11 desktops, is being actively maintained.
  - microgpt 3mo ago
    [dead]
  - loeg 3mo ago
    XFree86 hasn't been relevant for over 20 years, when Xorg forked in 2004.
  - calvinmorrison 3mo ago
    yes. there are X11 'servers' that exist inside other display systems.
sunshine-o 3mo ago
This is a great article. I have little experience with lxc but I guess waypipe could be an option too.
mid-kid 3mo ago
For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.
- BobbyTables2 3mo ago
  Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…
  - enriquto 3mo ago
    > Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside. But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.
    - throwaway7356 3mo ago
      > But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. You mean run everything distro-provided as root? There are reasons systems don't do that any more. Even distro-provided services are often setup in a way to no run with full rights. Can you imaging reasons why this is done? What was neglected is doing the same on user level, which should be done for pretty much the same reasons.
    - orangeboats 3mo ago
      > But granting full rights to distro-provided programs like vim or xeyes is perfectly sane Saying this after the whole XZ utils ordeal has happened is quite interesting. Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange? X11 (the one that most people are familiar with, not the locked down one with X security -- because the latter introduces compatibility issues) does not have an access control model where programs can request for specific permissions. In other words, xeyes would just work(TM) without the user granting it permission to read global mouse pointer position. And simultaneously, the same is true for $compromised_distro_provided_program.
ChocolateGod 3mo ago
Correct me if I'm wrong, but passing through the X socket gives a giant sandbox escape as any application can control/see any other application, including a root terminal in a GUI app.
- Chu4eeno 3mo ago
  No, X11 supports pretty detailed per-application access control, similar to selinux (XACE). The author of the phoenix x server has blogged about it, iirc.
  - ChocolateGod 3mo ago
    > XACE Which is configured by default on what distros?
    - lotharcable 3mo ago
      Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions. However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently. In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks. This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version. Oh, wait, that is what the X developers did with Wayland.
      - froh 3mo ago
        except Wayland dropped the baby with the bathtub? for example standardized window management, left as an exercise to the GUI lib and the compositor? and woop woop X11 GUI apps need to be rewritten to support window management on WSL (Wayland based) and the network reconnect on hybernate also broke. But at least Games are faster, aren't they...
deleted 3mo ago
[deleted]
waynecochran 3mo ago
I wish I lived in a world were you didn't have to sign contracts, lock your doors, or have X11 security. It is so fun to run xmeltdown a new user's display.
ElijahLynn 3mo ago
Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).
- shevy-java 3mo ago
  I don't think it is "just around" - it is actively maintained still: https://github.com/X11Libre/xserver https://github.com/X11Libre/xserver In the end Red Hat failed to kill off X11. Let's see what happens next. The GTK devs already rejected patches for maintaining the toolkit further for the xorg platform, following their "GTK5 will no longer support x11" agenda. Would be kind of great to have a universal GUI toolkit that would work rather than have toolkits controlled de-facto by private companies who just willy-nilly throw out support for this or that platform at their own selfish discretion. Though, someone else now helps maintain gtk2, though most of the patches are in regards to fixing bugs, ensuring that it can be compiled and so forth. https://git.devuan.org/Daemonratte/gtk2-ng https://git.devuan.org/Daemonratte/gtk2-ng
  - kstrauser 3mo ago
    Real question: is X11Libre widely used by anyone but its maintainers?
    - PowerElectronix 3mo ago
      Several distros have gone XLibre as their default display manager. I installed Artix on a bc-250 just last week and XLibre was the default there.
  - oneshtein 3mo ago
    See also yserver[0]: A modern X11 server written from scratch in Rust. 0: https://github.com/joske/yserver https://github.com/joske/yserver
- toenail 3mo ago
  Is wayland going to be aroud in another 10 years, or it it the new pulseaudio?
sedatk 3mo ago
Putting apps in a container sounds like a great idea until you need to access your files.
- mike_hock 3mo ago
  Or until you realize X11 is one giant escape hatch. You might not have (convenient) access to your files but the attacker does.
ddapperd 3mo ago
In terms of attack surface, how does this compare to just using AppArmor or SELinux, without containers?

73 points by shirozuki 3mo ago

LtWorf 3mo ago

Or one could just use firejail, which comes with a number of pre made profiles for common applications.

nosioptar 3mo ago
The sandbox command works well on systems using SELinux. https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/selinux_users_and_administrators_guide/chap-security-enhanced_linux-securing_programs_using_sandbox https://docs.redhat.com/en/documentation/red_hat_enterprise_...

calvinmorrison 3mo ago

Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well. https://github.com/X11Libre/xserver/blob/master/doc/Xnamespace.md https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...

Chu4eeno 3mo ago
Not the only one, there's also a new one (written in zig) I've forgot the name of. edit: phoenix was the name: https://github.com/external-mirrors/phoenix#phoenix https://github.com/external-mirrors/phoenix#phoenix
- mappu 3mo ago
  There's also this new one: https://github.com/joske/yserver https://github.com/joske/yserver
  - asveikau 3mo ago
    Hard for me to take that one seriously.. For example they call out byte swapping for endianness as the type of cruft holding back X11. Such a trivial thing to be concerned enough to put in the readme... (I guess Phoenix is also putting this..) Seems like mostly authored by Claude too.
    - shevy-java 3mo ago
      > Seems like mostly authored by Claude too. This is a problem in many projects now. xserver and mruby for instance also succumbed to claude. It seems claude is the ultimate virus. It leaks into almost every project now. So I am not sure it can be used as differentiating criterium here merely for being claude AI slop. I've noticed a lot of documentation is now totally useless though; claude slop is just unreadable to me. It's like a person who is not able to think, wrote the documentation. I did not have this issue back when real humans wrote documentation, even though high quality documentation was always rare anyway. But, for instance, Jeremy Evans in his projects tends to write high-quality documentation in general, and I can understand it fine, whereas if you look at matz spinel, I have no idea what the AI slop in the README is really trying to convey. Or on ffmpeg, a german dev used AI slop to try to create some proposal, and someone else pointed out that this is pointless and impossible to read and understand, yet the original guy did not understand why real people don't want to be AI slop spammed. It's very strange.
lotharcable 3mo ago
XWayland is actively developed. XFree86, which is the "standalone DDX" you see on X11 desktops, is being actively maintained.
- microgpt 3mo ago
  [dead]
- loeg 3mo ago
  XFree86 hasn't been relevant for over 20 years, when Xorg forked in 2004.
- calvinmorrison 3mo ago
  yes. there are X11 'servers' that exist inside other display systems.

sunshine-o 3mo ago

This is a great article. I have little experience with lxc but I guess waypipe could be an option too.

mid-kid 3mo ago

For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.

BobbyTables2 3mo ago
Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…
- enriquto 3mo ago
  > Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside. But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.
  - throwaway7356 3mo ago
    > But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. You mean run everything distro-provided as root? There are reasons systems don't do that any more. Even distro-provided services are often setup in a way to no run with full rights. Can you imaging reasons why this is done? What was neglected is doing the same on user level, which should be done for pretty much the same reasons.
  - orangeboats 3mo ago
    > But granting full rights to distro-provided programs like vim or xeyes is perfectly sane Saying this after the whole XZ utils ordeal has happened is quite interesting. Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange? X11 (the one that most people are familiar with, not the locked down one with X security -- because the latter introduces compatibility issues) does not have an access control model where programs can request for specific permissions. In other words, xeyes would just work(TM) without the user granting it permission to read global mouse pointer position. And simultaneously, the same is true for $compromised_distro_provided_program.

ChocolateGod 3mo ago

Correct me if I'm wrong, but passing through the X socket gives a giant sandbox escape as any application can control/see any other application, including a root terminal in a GUI app.

Chu4eeno 3mo ago
No, X11 supports pretty detailed per-application access control, similar to selinux (XACE). The author of the phoenix x server has blogged about it, iirc.
- ChocolateGod 3mo ago
  > XACE Which is configured by default on what distros?
  - lotharcable 3mo ago
    Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions. However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently. In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks. This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version. Oh, wait, that is what the X developers did with Wayland.
    - froh 3mo ago
      except Wayland dropped the baby with the bathtub? for example standardized window management, left as an exercise to the GUI lib and the compositor? and woop woop X11 GUI apps need to be rewritten to support window management on WSL (Wayland based) and the network reconnect on hybernate also broke. But at least Games are faster, aren't they...

deleted 3mo ago

[deleted]

waynecochran 3mo ago

I wish I lived in a world were you didn't have to sign contracts, lock your doors, or have X11 security. It is so fun to run xmeltdown a new user's display.

ElijahLynn 3mo ago

Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).

shevy-java 3mo ago
I don't think it is "just around" - it is actively maintained still: https://github.com/X11Libre/xserver https://github.com/X11Libre/xserver In the end Red Hat failed to kill off X11. Let's see what happens next. The GTK devs already rejected patches for maintaining the toolkit further for the xorg platform, following their "GTK5 will no longer support x11" agenda. Would be kind of great to have a universal GUI toolkit that would work rather than have toolkits controlled de-facto by private companies who just willy-nilly throw out support for this or that platform at their own selfish discretion. Though, someone else now helps maintain gtk2, though most of the patches are in regards to fixing bugs, ensuring that it can be compiled and so forth. https://git.devuan.org/Daemonratte/gtk2-ng https://git.devuan.org/Daemonratte/gtk2-ng
- kstrauser 3mo ago
  Real question: is X11Libre widely used by anyone but its maintainers?
  - PowerElectronix 3mo ago
    Several distros have gone XLibre as their default display manager. I installed Artix on a bc-250 just last week and XLibre was the default there.
- oneshtein 3mo ago
  See also yserver[0]: A modern X11 server written from scratch in Rust. 0: https://github.com/joske/yserver https://github.com/joske/yserver
toenail 3mo ago
Is wayland going to be aroud in another 10 years, or it it the new pulseaudio?

sedatk 3mo ago

Putting apps in a container sounds like a great idea until you need to access your files.

mike_hock 3mo ago
Or until you realize X11 is one giant escape hatch. You might not have (convenient) access to your files but the attacker does.

ddapperd 3mo ago

In terms of attack surface, how does this compare to just using AppArmor or SELinux, without containers?