11–20 of 78 posts
Correct me if I'm wrong, but passing through the X socket gives a giant sandbox escape as any application can control/see any other application, including a root terminal in a GUI app.
The author of the phoenix x server has blogged about it, iirc.
Correct me if I'm wrong, but passing through the X socket gives a giant sandbox escape as any application can control/see any other application, including a root terminal in a GUI app.
No, X11 supports pretty detailed per-application access control, similar to selinux (XACE). The author of the phoenix x server has blogged about it, iirc.
Which is configured by default on what distros?
Earlier quoted context omitted.
No, X11 supports pretty detailed per-application access control, similar to selinux (XACE). The author of the phoenix x server has blogged about it, iirc.
> XACE Which is configured by default on what distros?
It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it.
So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permission model were applications can be designated as "Trusted" or "Untrusted". That is going to show up in many Linux distributions.
However all applications default to "trusted" because if they are untrusted they tend to cause lots of other annoying problems and crashes a lot of apps, apparently.
In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks.
This sort of thing is why to fix X11 security you have to give up backwards compatibility and create a new X version.
Oh, wait, that is what the X developers did with Wayland.
Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well. https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...
XFree86, which is the "standalone DDX" you see on X11 desktops, is being actively maintained.
Earlier quoted context omitted.
> XACE Which is configured by default on what distros?
Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permi…
for example standardized window management, left as an exercise to the GUI lib and the compositor? and woop woop X11 GUI apps need to be rewritten to support window management on WSL (Wayland based) and the network reconnect on hybernate also broke.
But at least Games are faster, aren't they...
Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).
https://github.com/X11Libre/xserver
In the end Red Hat failed to kill off X11. Let's see what happens next. The GTK devs already rejected patches for maintaining the toolkit further for the xorg platform, following their "GTK5 will no longer support x11" agenda. Would be kind of great to have a universal GUI toolkit that would work rather than have toolkits controlled de-facto by private companies who just willy-nilly throw out support for this or that platform at their own selfish discretion. Though, someone else now helps maintain gtk2, though most of the patches are in regards to fixing bugs, ensuring that it can be compiled and so forth. https://git.devuan.org/Daemonratte/gtk2-ng