I've came across this blog https://notehub.org/rp5n2 which describes a way to make certain X11 clients untrusted, which makes certain X11 extensions unavailable to them. Note that I know perfectly well that this alone is worthless unless I also use UID separation, which I do. I use
xsudo to run crapware.
However, even with untrusted connection, clients can still monitor the clipboard. If the user is
crapware, programs running under its account can still monitor the primary selection. Just try:
watch -n0.5 xsudo crapware xclip -o
The security extensions is definitely useful as it prevents untrusted X11 clients to log keyboard or simulate keypresses but sniffing on clipboard is a weakness. How can I prevent sharing clipboard with untrusted X11 clients by default?
I'm not interested in things like firejail. I don't care about namespaces. UNIX user separation is all I need. I also would like to avoid Xpra. It's way way waaay too slow compared to clients directly connected to X11. You can really notice the lag when typing.
#!/bin/zsh set -e # Copied from https://notehub.org/rp5n2 if [[ $# -lt 1 ]]; then echo "Usage: $0 asuser [cmdline...]" >&2 exit 1 fi asuser=$1 shift if [[ -z $DISPLAY ]]; then echo "DISPLAY is not set" >&2 exit 1 fi cookie=/tmp/.Xauthority-$DISPLAY-$asuser if [[ ! -e $cookie ]]; then touch $cookie chmod 600 $cookie xauth -f $cookie generate $DISPLAY MIT-MAGIC-COOKIE-1 untrusted sudo chgrp $asuser $cookie chmod 660 $cookie fi export XAUTHORITY=$cookie if [[ $# -gt 0 ]]; then exec sudo -u $asuser "$@" else exec sudo -u $asuser -i fi