X.Org Server & XWayland Hit By Four More Security Issues

[oiaohm]

Yeah they're good. Good at dragging crap out for over 11 years. They could have easily fixed X11.

It's THIS exact bullshit that is delaying the "Year of rhe Linux Desktop". HDR and VRR are common arguments but they're fucking eye candy! Then security? Fix that is there! And if anyone say "but X11 is a mess of legacy code... Blah blah blah"

WHAT ISN'T? WHAT PRAY TELL ISN'T?

https://lists.x.org/archives/xorg/2024-April/061615.html

Pays to read.

Short version. You know that different endianness support between client and server with X11 protocol we decided to allow history in way that can be changed at any time turns out to be a down right horrible idea and you should simple disable. Of course users disable because they have some application they want to use.

Once you start doing all the recommendations to configure X11 to be secure like disable the endianess problem turn on XACE with selinux and so on the result is your X11 solution basically totally not usable.

The fixes to lots of X11 server security problems is know. The problem here is the fix to X11 protocol security problems end up being X11 protocol breaking equaling your applications don't work any more.

The idea of could have easily fixed with X11 is because you have never used a secured version of X11 where it questionable if move a window will work let alone anything else..

[back2未來]

[ if things on Wayland are not functional, there's hardly reasoning for a change. Seems X11 is more concerned (or functional) with older and maybe also deprecated hardware or exceptional settings, because of years with users demanding difficult or rare implementations.
From my pov&experience Wayland is not mature for 'every' former setting&hardware requirement, but probably is for more conventional requests and (recent) standards. ]

[kpedersen]

Mmm... are you sure? I mean... MIT-MAGIC-COOKIE seems more for connection authorization, not for framebuffer access.

On a correctly configured machine, it is impossible for an unprivileged user to access the raw framebuffer. They have to go through X (and its authorization process). Some operating systems don't even provide a framebuffer device (i.e fb0). Same with the raw input devices and drm devices, they are inaccessible to unprivileged users.

Some distros weaken this for both Xorg and Wayland compositors using the video or input group and shoving users into it which is a bit daft and is basically a security hazard. Instead the display server is privilege separated (preferably also using something like pledge(2) and unveil(2)) and its effective uid is in the correct groups.

[rastersoft]

On a correctly configured machine, it is impossible for an unprivileged user to access the raw framebuffer.

I'm not talking about reading the raw framebuffer, but to access other applications windows, and that includes the root window.

[kpedersen]

I'm not talking about reading the raw framebuffer, but to access other applications windows, and that includes the root window.

you specifically mentioned "framebuffer"?

As I mentioned before, only applications that you give permission to (by giving them access to the Xauthority file), will be able to access your Xorg session.

I.e An application run in i.e an Xnest, Xephyr, etc with its own Xauthority file (and display socket) will be unable to access any of your other programs running on your main Xorg session.

[J.King]

some programs (like Google Chrome) don't like it and won't work with it enabled... and even worse: in the case of chrome, it was marked as "won't fix" ( https://issues.chromium.org/issues/41211255 )

Did you actually read the bug discussion? They didn't fix it because it wasn't their code. I don't know what that says about Chromium not working with X security extension, but it's not somehow worse that the bug was not addressed by Google; it's a perfectly normal outcome.

[mrg666]

Yeah they're good. Good at dragging crap out for over 11 years. They could have easily fixed X11.

It's THIS exact bullshit that is delaying the "Year of rhe Linux Desktop". HDR and VRR are common arguments but they're fucking eye candy! Then security? Fix what is there! If Sun can do it, then update the entire stack of libraries as X11R7 and implement the new fixes while allowing a smooth transition. Nothing new has to be done, just patch for the security protocols.

Xfree86 4.x had a few years before it stabilized, but it didn't scrap the 3.x trunk of the tree just fix the tree. It rebuilt the trunk and regrew the branches as everything migrated in seemlessly while allowing some backwards compatibility. It took 5 years but everything worked. We went from static built x-servers to dynamic driver loaded x-servers.

And if anyone say "but X11 is a mess of legacy code... Blah blah blah"

WHAT ISN'T? WHAT PRAY TELL ISN'T?

Somebody is really upset. It seems you could just release X11R7 but got real busy with other wonderful things whatever they are. I understand you can't do everything and how upsetting the others fail everything else. Still, I have hopes you can spare some time to help with X11R7. Listen to this guy everyone! He is yelling for god's sake!

[baal]

Yeah they're good. Good at dragging crap out for over 11 years. They could have easily fixed X11.

It's THIS exact bullshit that is delaying the "Year of rhe Linux Desktop". HDR and VRR are common arguments but they're fucking eye candy!

Complaining that VRR and HDR are eye candy is stupid. Of course they are, and we want that eye candy. I don't see how HDR is not a functionnality for a photo editor, VRR is nice for some animations...

[access]

Some enterprising bastard got to X11R7 before him: https://www.x.org/wiki/Releases/7.0/

Oh well, there is always X12 to work on.

[Weasel]

This is going beyond explanation and reasoning now that I will not even try to argue anything. But I really enjoy a bunch of idiots raving and whining about how good is X11. Let me pop a couple more windows on Wayland while reading about their suffering. Burn baby burn

Someone's mad X11 gets closer to perfection and zero exploits while Wayland will forever remain a crippled garbage.

Cope harder.