4 ms·
Most of the time applications can read each other's memory, so protecting the display does not make much sense. Basic X client isolation (not using XACE just X
by uecker 4mo ago
Most of the time applications can read each other's memory, so protecting the display does not make much sense.
Basic X client isolation (not using XACE just Xsecurity) would have worked for sandboxed applications with some minor changes (allowing access to some basic modern extensions, I had a local patch for this once). There is really not fundamental issue in X that could now allow isolation of clients.
- ChocolateGod 4mo ago> Most of the time applications can read each other's memory, so protecting the display does not make much sense. Unless you're running everything as root, applications can not read eachothers memory.
- uecker 4mo agoOf course they can! How do you think a debugger works?
- ChocolateGod 4mo agoBecause a debugger launches the target process as a child process and thus has access to its memory? /proc/sys/kernel/yama/ptrace_scope is usually set to 1 on non-Selinux distros.
- uecker 4mo agoWithout this flag it can also attach to existing processes and on my Debian this is set to zero.