4 ms·

> XACE Which is configured by default on what distros?

lotharcable 4mo ago
Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions. However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently. In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks. This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version. Oh, wait, that is what the X developers did with Wayland.
- froh 4mo ago
  except Wayland dropped the baby with the bathtub? for example standardized window management, left as an exercise to the GUI lib and the compositor? and woop woop X11 GUI apps need to be rewritten to support window management on WSL (Wayland based) and the network reconnect on hybernate also broke. But at least Games are faster, aren't they...
  - onli 4mo ago
    No, slower. And with compatibility issues as well as additional latency.
- shevy-java 4mo ago
  > that is what the X developers did with Wayland This is rather incomplete. For instance, gtk devs already threw out tons of old code in GTK4. Wayland also has fewer features than xorg; and there are also fewer choices available. I noticed this with regards to WMs/DEs. I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here. You are trying to pick individual cherries. > This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version. I don't think so: https://github.com/X11Libre/xserver https://github.com/X11Libre/xserver Let's have a look in a little while. I myself hope for better and more transparent information at all times. Probably others want better security overall. Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver?
  - fluffybucktsnek 4mo ago
    > Wayland also has fewer features than xorg; and there are also fewer choices available Because Wayland is a strictly a window management protocol focused on policy over mechanism. > I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here. We also aren't going to mention issues Xorg or XLibre have with some graphics setups, because that's neither here nor there. This is a thread about security. > I don't think so: <XLibre github repo link> Didn't XLibre break some applications when launched? > Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver? It would be interesting to see Wayland abandoned for a better protocol/set of protocols, xserver is neither a protocol nor really better.
    - yjftsjthsd-h 4mo ago
      > Didn't XLibre break some applications when launched? It can't have broken as many things as Wayland
      - fluffybucktsnek 4mo ago
        It can. Easily. Wayland is a new protocol, without an established implementation; X11 is an older protocol, while Xorg was an established implementation and XLibre is trying to modernize its codebase. Recall https://xkcd.com/1172/ https://xkcd.com/1172/ .
  - ChocolateGod 4mo ago
    > Wayland also has fewer features than xorg I don't want my display server/compositor to have a print server.
    - yjftsjthsd-h 4mo ago
      And I do want mine to tell a11y programs what windows exist.
- throwaway7356 4mo ago
  > In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks. Unless your distro changes the default to make "ssh -X" and "ssh -Y" behave the same which popular distributions do.
uecker 4mo ago
Most of the time applications can read each other's memory, so protecting the display does not make much sense. Basic X client isolation (not using XACE just Xsecurity) would have worked for sandboxed applications with some minor changes (allowing access to some basic modern extensions, I had a local patch for this once). There is really not fundamental issue in X that could now allow isolation of clients.
- ChocolateGod 4mo ago
  > Most of the time applications can read each other's memory, so protecting the display does not make much sense. Unless you're running everything as root, applications can not read eachothers memory.
  - uecker 4mo ago
    Of course they can! How do you think a debugger works?
    - ChocolateGod 4mo ago
      Because a debugger launches the target process as a child process and thus has access to its memory? /proc/sys/kernel/yama/ptrace_scope is usually set to 1 on non-Selinux distros.
      - uecker 4mo ago
        Without this flag it can also attach to existing processes and on my Debian this is set to zero.

Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions. However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently. In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks. This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version. Oh, wait, that is what the X developers did with Wayland.

froh 4mo ago
except Wayland dropped the baby with the bathtub? for example standardized window management, left as an exercise to the GUI lib and the compositor? and woop woop X11 GUI apps need to be rewritten to support window management on WSL (Wayland based) and the network reconnect on hybernate also broke. But at least Games are faster, aren't they...
- onli 4mo ago
  No, slower. And with compatibility issues as well as additional latency.
shevy-java 4mo ago
> that is what the X developers did with Wayland This is rather incomplete. For instance, gtk devs already threw out tons of old code in GTK4. Wayland also has fewer features than xorg; and there are also fewer choices available. I noticed this with regards to WMs/DEs. I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here. You are trying to pick individual cherries. > This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version. I don't think so: https://github.com/X11Libre/xserver https://github.com/X11Libre/xserver Let's have a look in a little while. I myself hope for better and more transparent information at all times. Probably others want better security overall. Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver?
- fluffybucktsnek 4mo ago
  > Wayland also has fewer features than xorg; and there are also fewer choices available Because Wayland is a strictly a window management protocol focused on policy over mechanism. > I am not even going to issues wayland has with regards to certain video graphics - that's another not mentioned issue here. We also aren't going to mention issues Xorg or XLibre have with some graphics setups, because that's neither here nor there. This is a thread about security. > I don't think so: <XLibre github repo link> Didn't XLibre break some applications when launched? > Would it not be somewhat interesting if wayland were to be abandoned eventually due to having too few useful features compared to xserver? It would be interesting to see Wayland abandoned for a better protocol/set of protocols, xserver is neither a protocol nor really better.
  - yjftsjthsd-h 4mo ago
    > Didn't XLibre break some applications when launched? It can't have broken as many things as Wayland
    - fluffybucktsnek 4mo ago
      It can. Easily. Wayland is a new protocol, without an established implementation; X11 is an older protocol, while Xorg was an established implementation and XLibre is trying to modernize its codebase. Recall https://xkcd.com/1172/ https://xkcd.com/1172/ .
- ChocolateGod 4mo ago
  > Wayland also has fewer features than xorg I don't want my display server/compositor to have a print server.
  - yjftsjthsd-h 4mo ago
    And I do want mine to tell a11y programs what windows exist.
throwaway7356 4mo ago
> In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks. Unless your distro changes the default to make "ssh -X" and "ssh -Y" behave the same which popular distributions do.

uecker 4mo ago

Most of the time applications can read each other's memory, so protecting the display does not make much sense. Basic X client isolation (not using XACE just Xsecurity) would have worked for sandboxed applications with some minor changes (allowing access to some basic modern extensions, I had a local patch for this once). There is really not fundamental issue in X that could now allow isolation of clients.

ChocolateGod 4mo ago
> Most of the time applications can read each other's memory, so protecting the display does not make much sense. Unless you're running everything as root, applications can not read eachothers memory.
- uecker 4mo ago
  Of course they can! How do you think a debugger works?
  - ChocolateGod 4mo ago
    Because a debugger launches the target process as a child process and thus has access to its memory? /proc/sys/kernel/yama/ptrace_scope is usually set to 1 on non-Selinux distros.
    - uecker 4mo ago
      Without this flag it can also attach to existing processes and on my Debian this is set to zero.