Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Linux Security Circus: On GUI isolation

theinvisiblethings.blogspot.com

Post reply on HN
Print view View original

21–30 of 50 posts

Re: The Linux Security Circus: On GUI isolation

#21

Post by rst »

tedunangst wrote: post #17
tshtf wrote: post #8

ssh with X11 forwarding (-X option) had this same problem. A privileged malicious user on the host you were ssh'ed into might be able to monitor the keystrokes of your whole X session.

Note that hasn't been true for years and years. -Y and -X are different.

[deleted former mummery after five-minute fact-check]

Unfortunately, the documentation on -X and -Y is awfully confusing. On a casual read, it looks like -Y is less safe, since practically the only thing the docs for -Y say is that forwarded connections are "not subjected to X11 SECURITY extension controls"...

Re: The Linux Security Circus: On GUI isolation

#22

Post by tedunangst »

tshtf wrote: post #20
tedunangst wrote: post #17

Earlier quoted context omitted.

Note that hasn't been true for years and years. -Y and -X are different.

That's why I mentioned the -X option... -Y handles the problem the correct way and doesn't have the same issues. Edit: Ignore this, I was incorrect.

You have that backwards.

Re: The Linux Security Circus: On GUI isolation

#23

Post by tedunangst »

rst wrote: post #21
tedunangst wrote: post #17

Earlier quoted context omitted.

Note that hasn't been true for years and years. -Y and -X are different.

[deleted former mummery after five-minute fact-check] Unfortunately, the documentation on -X and -Y is awfully confusing. On a casual read, it looks like -Y is less safe, since practically the only thing the docs for -Y say is that forwarded connections are "not subjected to X11 SECURITY extension controls"...

You were apparently more right the first time. -X establishes an untrusted connection, subject to limitations. -Y says "trust me, no limits". -Y is the less safe option.

Re: The Linux Security Circus: On GUI isolation

#24

Post by doki_pen »

This argument is nonsense. Any program you run can exec other programs and read files from your home directory. You can't simply run any program you feel like running. If it's not a well known and trusted program, then you'll need to look at the source.

Do people run root GUIs as a client? That seems silly to me. I don't have one single GUI program that I run as root unless I'm troubleshooting a permissions issue.

Re: The Linux Security Circus: On GUI isolation

#26

Post by recampbell »

doki_pen wrote: post #24

This argument is nonsense. Any program you run can exec other programs and read files from your home directory. You can't simply run any program you feel like running. If it's not a well known and trusted program, then you'll need to look at the source. Do people run root GUIs as a client? That seems silly to me. I don't have one single GUI program that I run as root unless I'm troubleshooting a permissions issue.

I don't think it's nonsense. I'm quite surprised that (say) my calculator app could control my password manager. My password manager encrypts file storage, and automatically locks itself after usage, but is likely vulnerable to this attack.

Even if you trust the programs you run, they can have their own unintended vulnerabilities.

Re: The Linux Security Circus: On GUI isolation

#27

Post by rst »

tedunangst wrote: post #17
tshtf wrote: post #8

ssh with X11 forwarding (-X option) had this same problem. A privileged malicious user on the host you were ssh'ed into might be able to monitor the keystrokes of your whole X session.

Note that hasn't been true for years and years. -Y and -X are different.

So, trying again... here are the caveats on -X, from the man page on the current version[1]:

     -X      Enables X11 forwarding.  This can also be specified on a per-host
             basis in a configuration file.

             X11 forwarding should be enabled with caution.  Users with the
             ability to bypass file permissions on the remote host (for the
             user's X authorization database) can access the local X11 display
             through the forwarded connection.  An attacker may then be able
             to perform activities such as keystroke monitoring.
So, it's not documented as being proof against hostile parties with root at the remote end; in fact, it's documented as being vulnerable...

[1] http://www.openbsd.org/cgi-bin/man.cgi?query=ssh&sektion...

Re: The Linux Security Circus: On GUI isolation

#28

Post by trotsky »

Qubes seems to be YASTVOS (Yet Another Security Through Virtualization OS). While I'm not going to disagree that Xen vms represent a smaller attack surface than most current installations, that doesn't mean there won't be bugs. If you shift everyone to a solution like this, guaranteed people will be breaking out of it. VMware has had a number of vm escapes.

The other problem is these OS's often don't seem to get very far. Seems like Qubes is launching beta 1. It's the kind of thing that one would expect needing a significant time to shake out.

Which isn't to say I wouldn't like to run a nicely implemented example of the concept. It certainly has the possibility of raising the bar significantly. Of course, it seems like no matter how far windows raises the bar people still keep on jumping it easily.

Re: The Linux Security Circus: On GUI isolation

#30

Post by cygwin98 »

Maybe I misunderstood this article. It seems to me there is a security issue in X Server, which gives out keyboard input info to all running X apps. That's fine. If that's X Server, just fix it then everyone will be happy. Why introduces all the Xen/VM stuffs into this problem. It is like you have a mosquito flying around, but you choose to kill it using a nuclear bomb.
Post reply on HN