Enhancing x11 Application Security with LXC (2025)

#1

Post by shirozuki » Sat, Jun 27, 2026, 9:27 PM UTC

Enhancing x11 Application Security with LXC (2025)
dobrowolski.dev

Re: Enhancing x11 Application Security with LXC (2025)

#2

Post by LtWorf » Sat, Jun 27, 2026, 11:28 PM UTC

Or one could just use firejail, which comes with a number of pre made profiles for common applications.

Re: Enhancing x11 Application Security with LXC (2025)

#3

Post by calvinmorrison » Sat, Jun 27, 2026, 11:38 PM UTC

Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well.

https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...

Re: Enhancing x11 Application Security with LXC (2025)

#4

Post by Chu4eeno » Sat, Jun 27, 2026, 11:50 PM UTC

calvinmorrison wrote: post #3

Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well. https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...

Not the only one, there's also a new one (written in zig) I've forgot the name of.

edit: phoenix was the name: https://github.com/external-mirrors/phoenix#phoenix

Re: Enhancing x11 Application Security with LXC (2025)

#5

Post by sunshine-o » Sun, Jun 28, 2026, 12:00 AM UTC

This is a great article.

I have little experience with lxc but I guess waypipe could be an option too.

Re: Enhancing x11 Application Security with LXC (2025)

#6

Post by mid-kid » Sun, Jun 28, 2026, 12:04 AM UTC

For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.

Re: Enhancing x11 Application Security with LXC (2025)

#7

Post by nosioptar » Sun, Jun 28, 2026, 12:33 AM UTC

LtWorf wrote: post #2

Or one could just use firejail, which comes with a number of pre made profiles for common applications.

The sandbox command works well on systems using SELinux.

https://docs.redhat.com/en/documentation/red_hat_enterprise_...

Re: Enhancing x11 Application Security with LXC (2025)

#8

Post by mappu » Sun, Jun 28, 2026, 12:38 AM UTC

Chu4eeno wrote: post #4

calvinmorrison wrote: post #3

Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well. https://github.com/X11Libre/xserver/blob/master/doc/Xnamespa...

Not the only one, there's also a new one (written in zig) I've forgot the name of. edit: phoenix was the name: https://github.com/external-mirrors/phoenix#phoenix

There's also this new one: https://github.com/joske/yserver

Re: Enhancing x11 Application Security with LXC (2025)

#9

Post by ChocolateGod » Sun, Jun 28, 2026, 2:09 AM UTC

Correct me if I'm wrong, but passing through the X socket gives a giant sandbox escape as any application can control/see any other application, including a root terminal in a GUI app.

Re: Enhancing x11 Application Security with LXC (2025)

#10

Post by asveikau » Sun, Jun 28, 2026, 2:16 AM UTC

mappu wrote: post #8

Chu4eeno wrote: post #4

Earlier quoted context omitted.

Not the only one, there's also a new one (written in zig) I've forgot the name of. edit: phoenix was the name: https://github.com/external-mirrors/phoenix#phoenix

There's also this new one: https://github.com/joske/yserver

Hard for me to take that one seriously.. For example they call out byte swapping for endianness as the type of cruft holding back X11. Such a trivial thing to be concerned enough to put in the readme... (I guess Phoenix is also putting this..) Seems like mostly authored by Claude too.