Why does screen sharing work under X11?
In the X11 security model every client that can access the X server and isn't restricted by a X server extension is trusted by default and can use queries like
XGetImage to capture the content of every window on the screen. The reasons for this are mostly historical, as the first version of the X11 protocol was released in 1987 and security features were later "bolted on".
Wayland has a stricter security design. There only the compositor or designated trusted applications can access the content of other windows.
The X Access Control Extension framework
One elaborate solution to block screen sharing would be to write a X server extension module using the X Access Control Extension (XACE). This extension provides hooks for other extension modules to allow fine-grained access control decisions.
Unfortunately, I didn't find any pre-existing module that can block specific applications from accessing foreign windows, so you'd need to write one such extension yourself. This will probably be a quite time-consuming task.
The X Security Extension
An easier solution is the Security extension. It predates XACE and only differentiates between "trusted" and "untrusted" clients, so it doesn't only block screen sharing but also things like graphics acceleration, cursor capturing, custom cursors and fullscreen windows. So it may cause buggy behaviour and will slow down rendering.
The basic idea is that applications use a "magic cookie" to authorize with the X server. These "cookies" are essentially random numbers written in some file (
~/.Xauthority or a file like
/tmp/xauth-* referenced in the environment variable
XAUTHORITY) that applications can use to prove to the X server that they are allowed to connect. Cookies can be "trusted" or "untrusted". The default cookie generated on login is trusted.
So to restrict Firefox you need to generate a new untrusted cookie into a new X authority file and use the
XAUTHORITY environment variable to provide Firefox with the untrusted cookie on startup. This is possible using the
The following wrapper script will execute the program given as an argument as an untrusted X client:
# Create empty file only accessible by the current user or empty it if already existing
(umask 0077; : > ~/.Xauthority-untrusted)
# Generate an untrusted magic cookie expiring 30 seconds after last use
xauth -f ~/.Xauthority-untrusted generate "$DISPLAY" MIT-MAGIC-COOKIE-1 untrusted timeout 30
# Set the environment variable
# Replace the shell with the program given on the command line
Save it as e.g.
untrusted.sh and make it executable. Then you'll be able to start Firefox in untrusted mode by using
Please note that this won't fully protect from malicious applications. That protection can be circumvented as long as the application runs on your local machine and under your user account, because a malicious application could guess the location of the original authority file or make use of some fallback rules provided by e.g. the
xhost access control, but it's enough to prevent a browser from screen sharing.