25

I'm new to X11 and want to understand if it is really as dangerous as they say on the Internet.

I will explain how I understand this. Any application launched from under the current user has access to the keyboard, mouse, display (e.g. taking a screenshot), and this is not good. But, if we install programs from the official repository (for example, for Debian), which are unlikely to contain keyloggers, etc., then the danger seems exaggerated. Am I wrong?

Yes, you can open applications on separate servers (for example, Xephyr), but this is inconvenient, since there is no shared clipboard. Creating a clipboard based on tmp files is also inconvenient.

  • @mosvy X11 is also not Linux (and the OP mentions Debian). And a display is not a screen-shot. – ctrl-alt-delor Mar 22 at 15:19
  • @ctrl-alt-delor X11 works on Linux (does not depend on the GNU userland), and you can take a screenshot of an X11 display (eg. with xwd -root). – mosvy Mar 22 at 15:21
  • OK I have put some clarity around screen-shot. I now realise what the OP was trying to say about it. And I have removed Linux, as you are correct, it is not relevant X11 does not depend on it. – ctrl-alt-delor Mar 22 at 15:25
  • 29
    Ob. xkcd: xkcd.com/2044 – Eric Towers Mar 22 at 23:37
  • 18
    Who calls it dangerous on the internet? Links! – curiousdannii Mar 23 at 0:40
43

Any application launched from under the current user has access to the keyboard, mouse, display (e.g. taking a screenshot), and this is not good.

All the X11 clients on a desktop can access each other in depth, including getting the content of any window, changing it, closing any window, faking key and mouse events to any other client, grabbing any input device, etc.

The X11 protocol design is based on the idea that the clients are all TRUSTED and will collaborate, not step on each other's toes (the latter completely broken by modern apps like Firefox, Chrome or Java).

BUT, if we install programs from the official repository (for example, for Debian), which are unlikely to contain keyloggers, etc., then the danger problem is clearly exaggerated. Am I wrong?

Programs have bugs, which may be exploited. The X11 server and libraries may not be up-to-date. For instance, any X11 client can crash the X server in the current version of Debian (Buster 10) via innocuous Xkb requests. (That was fixed in the upstream sources, but didn't make it yet in Debian). If it's able to crash it, then there's some probability that it's also able to execute code with the privileges of the X11 server (access to hardware, etc).

For the problems with the lax authentication in Xwayland (and the regular Xorg Xserver in Debian), see the notes of the end of this answer.

Yes, you can open applications on separate servers (for example, Xephyr), but this is inconvenient, since there is no shared clipboard. Creating a clipboard based on tmp files is also inconvenient.

Notice that unless you take extra steps, Xephyr allows any local user to connect to it by default. See this for a discussion about it.

Creating a shared clipboard between multiple X11 servers is an interesting problem, which deserves its own Q&A, rather than mixed with this.

| improve this answer | |
  • 11
    Just curious, what’s specifically bad about Java in this context? – Stephen Kitt Mar 22 at 18:54
  • 15
    @StephenKitt Java apps (swing) steal the focus upon starting, which means that they completely break any focus-follows-mouse model, unless treated specially. Just like Firefox, java apps need special assistance from the window manager, otherwise drop-down menus won't open, entry boxes won't focus, etc. I don't know if that's still the case, but java was assuming that a window manager is reparenting, unless it was named "LG3D" or similar (java library had a select list of non-parenting WMs, and all the other non-reparenting WMs had to lie about their name ;-)). – mosvy Mar 23 at 2:44
  • 4
    @mosvy that's still the case, at least for openjdk. E.g. in xmonad, you have to configure "LG3D" as window manager-name. Otherwise java-applications with a gui won't work. – Paul Mar 23 at 3:09
  • 2
    @mosvy Java apps (swing) steal the focus upon starting If that makes something a security concern, half the applications coded for Windows are insecure [insert your own joke here]. Somebody needs to take a three-weeks-dead, fully rotten mackerel and use it to slap the UX clowns who insist their app is "special" and MUST steal focus on startup. – Andrew Henle Mar 23 at 13:45
  • 4
    I can't find the source anymore, but I once read the reason why MS Office steals the focus is to prevent lots of support calls "I triple-clicked on Excel on my desktop because I don't have enough motor control to just double-click, and it didn't start" (because Excel is actually minimized because the 3rd click re-focused the desktop) and users don't know how to switch windows. So, focus stealing is actually intentional from the UX perspective. – Erlkoenig Mar 24 at 13:46
9

Applications running on the same machine with the same user account can use the ptrace system call to modify each other's process memory, so X11 is not the most convenient attack surface here.

For applications you don't fully trust, you need to first run them with a different user ID (like Android does with applications from different vendors), and you can use the XSECURITY extension to generate an "untrusted" access token for the X server, with which the application's access to X11 is restricted:

  • no access to input events not directed at the own window
  • no access to the XTEST extension
  • no transparent windows

Input events in X11 have a Synthetic field that tells whether the input event was generated from an input device or sent from another program, and the receiving program decides what to do with synthetic events, for example xterm just ignores them. The XTEST extension allows generating non-Synthetic events from software for testing purposes, which is why untrusted clients are not allowed to use that extension.

| improve this answer | |
  • I read somewhere i the past that untrusted is still not very secure. – akostadinov Mar 23 at 21:03
  • Unfortunately, the untrusted mode is pretty broken, and it will cause many apps to malfunction. Especially the fact that it hides the RENDER extension (despite it continuing to work) trip many programs which call XRenderQueryExtension. – mosvy Mar 24 at 16:39
  • Yeah, a lot of modern programs weren't designed with security in mind -- they happily accept Synthetic events, and they require to be run with full privileges. – Simon Richter Mar 25 at 8:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.