Firefox 99

#1

Post by nimar » Tue, Apr 05, 2022, 12:53 PM UTC

Re: Firefox 99

#2

Post by kevincox » Tue, Apr 05, 2022, 3:07 PM UTC

> The Linux sandbox has been strengthened: processes exposed to web content no longer have access to the X Window system (X11).

That is a very significant step. I wonder if this applies to Wayland users as well or if this was already a non-issue.

Re: Firefox 99

#3

Post by alophawen » Tue, Apr 05, 2022, 3:57 PM UTC

kevincox wrote: post #2

> The Linux sandbox has been strengthened: processes exposed to web content no longer have access to the X Window system (X11). That is a very significant step. I wonder if this applies to Wayland users as well or if this was already a non-issue.

The issue with Xorg is that it runs as root by default (there seems to be ways to run it as non-root according to Gentoo Wiki, but I'm pretty sure most popular distros runs it as root).

One of the selling points of wayland is that it does not.

EDIT: See child replies. I am outdated info.

Re: Firefox 99

#4

Post by kevincox » Tue, Apr 05, 2022, 4:00 PM UTC

alophawen wrote: post #3

kevincox wrote: post #2

> The Linux sandbox has been strengthened: processes exposed to web content no longer have access to the X Window system (X11). That is a very significant step. I wonder if this applies to Wayland users as well or if this was already a non-issue.

The issue with Xorg is that it runs as root by default (there seems to be ways to run it as non-root according to Gentoo Wiki, but I'm pretty sure most popular distros runs it as root). One of the selling points of wayland is that it does not. EDIT: See child replies. I am outdated info.

I don't think most distributions run X as root anymore. But it does generally have a lot of access as it can open apps and log keys.

XWayland definitely doesn't run as root, but still has a lot of access to any X applications that you are running.

Re: Firefox 99

#5

Post by alophawen » Tue, Apr 05, 2022, 4:38 PM UTC

kevincox wrote: post #4

alophawen wrote: post #3

Earlier quoted context omitted.

The issue with Xorg is that it runs as root by default (there seems to be ways to run it as non-root according to Gentoo Wiki, but I'm pretty sure most popular distros runs it as root). One of the selling points of wayland is that it does not. EDIT: See child replies. I am outdated info.

I don't think most distributions run X as root anymore. But it does generally have a lot of access as it can open apps and log keys. XWayland definitely doesn't run as root, but still has a lot of access to any X applications that you are running.

Thanks for pointing that out. I'm not up to date on this.

Re: Firefox 99

#6

Post by kup0 » Tue, Apr 05, 2022, 5:08 PM UTC

kevincox wrote: post #2

> The Linux sandbox has been strengthened: processes exposed to web content no longer have access to the X Window system (X11). That is a very significant step. I wonder if this applies to Wayland users as well or if this was already a non-issue.

I wonder if this will break the hardware acceleration I've enabled to run in Firefox in X11 by using the VAAPI flags/etc

Re: Firefox 99

#7

Post by WhyNotHugo » Tue, Apr 05, 2022, 11:38 PM UTC

kevincox wrote: post #2

> The Linux sandbox has been strengthened: processes exposed to web content no longer have access to the X Window system (X11). That is a very significant step. I wonder if this applies to Wayland users as well or if this was already a non-issue.

It's less of an issue on Wayland.

Clients can't randomly snoop onto what others are doing (e.g.: record keystrokes while on background).

There's still _some_ attack surface on Wayland, but less than there was on Xorg.

BTW: Note sure if this feature was implemented for Wayland, but it sounds like it wasn't.