Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Enhancing x11 Application Security with LXC (2025)

dobrowolski.dev

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Enhancing x11 Application Security with LXC (2025)

#31

Post by throwaway7356 »

enriquto wrote: post #29
BobbyTables2 wrote: post #22

Earlier quoted context omitted.

Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…

> Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside . But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

> But granting full rights to distro-provided programs like vim or xeyes is perfectly sane.

You mean run everything distro-provided as root?

There are reasons systems don't do that any more. Even distro-provided services are often setup in a way to no run with full rights. Can you imaging reasons why this is done?

What was neglected is doing the same on user level, which should be done for pretty much the same reasons.

Re: Enhancing x11 Application Security with LXC (2025)

#32

Post by throwaway7356 »

lotharcable wrote: post #13
ChocolateGod wrote: post #12

Earlier quoted context omitted.

> XACE Which is configured by default on what distros?

Nowhere (and everywhere). It is my understanding that XACE doesn't actually provide any security features itself. It just provides the "hooks" to implement security extensions. Like LSM feature in Linux kernel. You have to install a additional X11 extension to do something useful with it. So the most common X11 security extension is going to be xcsecurity which enables the SECURITY extension. It allows a course permi…

> In practice the only place it shows up is if you are using "ssh -X". That uses the security extension by default. Which is why there is also a "ssh -Y" that disables it for applications that it breaks.

Unless your distro changes the default to make "ssh -X" and "ssh -Y" behave the same which popular distributions do.

Re: Enhancing x11 Application Security with LXC (2025)

#33

Post by orangeboats »

enriquto wrote: post #29
BobbyTables2 wrote: post #22

Earlier quoted context omitted.

Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…

> Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside . But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

> But granting full rights to distro-provided programs like vim or xeyes is perfectly sane

Saying this after the whole XZ utils ordeal has happened is quite interesting.

Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange?

X11 (the one that most people are familiar with, not the locked down one with X security -- because the latter introduces compatibility issues) does not have an access control model where programs can request for specific permissions.

In other words, xeyes would just work(TM) without the user granting it permission to read global mouse pointer position. And simultaneously, the same is true for $compromised_distro_provided_program.

Re: Enhancing x11 Application Security with LXC (2025)

#34

Post by TZubiri »

orangeboats wrote: post #33
enriquto wrote: post #29

Earlier quoted context omitted.

> Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside . But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

> But granting full rights to distro-provided programs like vim or xeyes is perfectly sane Saying this after the whole XZ utils ordeal has happened is quite interesting. Can you really guarantee that your distro is not compromised? And if it is compromised, how can you easily _discover_ that a program is doing something strange? X11 ( the one that most people are familiar with, not the locked down one with X security…

> the whole XZ ordeal

1 malicious package almost got distributed in 20 years of debian history?

>granting full rights to vim or xeyes

I'm not sure I get what's being discussed here. Standard Xorg runs without root already. And Xeyes definitely 100% run without root, I get why you would you run vim on root, to edit root files, but also don't? Especially if you have plugins, run simple programs like echo>> , ed, grep or nano.

Re: Enhancing x11 Application Security with LXC (2025)

#36

Post by oneshtein »

shevy-java wrote: post #20
ElijahLynn wrote: post #18

Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).

I don't think it is "just around" - it is actively maintained still: https://github.com/X11Libre/xserver In the end Red Hat failed to kill off X11. Let's see what happens next. The GTK devs already rejected patches for maintaining the toolkit further for the xorg platform, following their "GTK5 will no longer support x11" agenda. Would be kind of great to have a universal GUI toolkit that would work rather than have…

See also yserver[0]: A modern X11 server written from scratch in Rust.

0: https://github.com/joske/yserver

Re: Enhancing x11 Application Security with LXC (2025)

#37

Post by mike_hock »

enriquto wrote: post #29
BobbyTables2 wrote: post #22

Earlier quoted context omitted.

Yeah, sadly Firefox and Chrome want almost full privileges so that they can sandbox themselves. X itself always bothers me. Xeyes is cute until one considers the practical implications…

> Xeyes is cute until one considers the practical implications… what's the problem with xeyes? it reads data on your computer and displays it. Just like vim or cat. If, for some reason, you want to run a program that you don't trust, you should sandbox it from the outside . But granting full rights to distro-provided programs like vim or xeyes is perfectly sane. Just like you trust your kernel.

> until one considers the practical implications

You failed at that step.

The practical implication is that every other X11 app can also read your input even when it's not in the foreground.

Re: Enhancing x11 Application Security with LXC (2025)

#39

Post by mike_hock »

_jackdk_ wrote: post #30
ElijahLynn wrote: post #18

Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).

The problem is that Wayland just isn't a compelling alternative for many people, so they don't move. For me, I see no benefit because I got used to avoiding HiDPI and don't have a mixed-DPI workspace. For some bizarre reason they made each compositor implement input-handling separately, so for example artists might have to switch compositor just to use their tablet of choice. And worse yet, some people with input acc…

> I like my cozy Plasma DE [...] clean, all free of ads and bad UI redesigns and AI injected into every corner.

Plasma itself is an example of bad UI redesign (but a far cry from Gnome).

Post reply on HN