Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read here that it's possible for any app using the X server to sniff keystrokes to any other app which is also using the X server, including su (on a terminal) or gksu. I've heard of a few ways to make the X server secure like Xephyr, but I'm not sure which one to use. I just want to prevent any app like xinput from easily sniffing the keystrokes when I'm typing a password in the terminal or gksu. I'm currently using Debian sid.

share|improve this question
Don't type. runs – Ignacio Vazquez-Abrams Apr 12 '12 at 7:09
any app = any application with access to your X11 server, see X.Org's security documentation for first pointers. Also note that there is XACE, the whole story seems a little more complicated, with trusted/untrusted X11 clients. No idea how much of this is used in recent Xorg setups. – sr_ Apr 12 '12 at 8:01
I have installed Xephyr. It is very cumbersome and requires complex bash magic but xinput running inside the nested X server couldn't detect keypresses outside Xephyr (however, xinput running outside Xephyr can still detect all keypresses). I've tried using the SELinux sandbox but I couldn't get it to work. I'll still leave this question open in case someone has a better idea. – Magnus Apr 15 '12 at 0:12
This is a recent lwn.net-article on the security of GNU/Linux' graphics stack that quite thoroughly discusses the X developers' take on the issue. – sr_ Oct 21 '12 at 17:24

Note that Xephyr/Xnest/vnc-server will make the application talk to a different X server, but will not forbid it to talk to your other X server where you're running gksu.

Best is to run it in a different X server and as a different user (or use a LSM to prevent the application to connect to the X server or read your .Xauthority file). To take it one step further, you can make it run in a chroot jail, and to take it one step yet further, you can run it in a container, and to take it one step yet, further, run it in a full controlled virtual machine (for instance with kvm -snapshot).

If you don't trust the application, you probably will have to go all the way.

share|improve this answer

I believe, but don't know how to prove, that any X11 app that prevents you typing anywhere else (such as password prompts) can't be sniffed.

Try this: run gksu, and when the password prompt opens, try to adjust the volume using keys (if your machine has them), or hit other hot keys (super, power, etc.) and see if they do anything. If they don't, I think you're safe.

I think ctrl-alt-f1 etc. always work though.

share|improve this answer
Actually, xinput can track key presses even in gksu. I have tried that and while it didn't show the key presses while entering the password, once the gksu dialog box was gone the key presses appeared. – Magnus Apr 12 '12 at 18:21
@Magnus: That's disappointing. :( – ams Apr 12 '12 at 19:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.