GNOME's Mutter Adds Support For Toggling Byte-Swapped XWayland Clients
Stemming from the X.Org Server change to no longer allow byte-swapped clients by default due to the feature being rarely used but of significant security concerns with being a large attack surface, GNOME's Mutter compositor has added optional support for being able to enable byte-swapped XWayland clients.
With the latest XWayland/X.Org Server Git disabling byte-swapped clients by default, the support can be re-enabled using the "+byteswappedclients" command line switch or via the new "AllowByteSwappedClients" xorg.conf configuration option. As a reminder on the feature, this byte-swapped clients functionality is around X.Org/XWayland clients of difference CPU endianness when remotely connecting to the X.Org Server. Protocol messages to/from the clients can be byte-swapped by the X.Org Server but that code isn't actively maintained and known to be a large attack surface for malicious clients. Given different CPU endianness isn't too common these days and even less so these days for people using remote X11, besides some on x86_64 systems still using IBM s390x or PowerPC 64-bit for remote X11 use of graphical applications, this default change shouldn't affect many people.
But there have been some that raised concerns over the change due to their exotic setups, but at least when running the X.Org Server the new configuration knobs allow restoring the old functionality. For those running Wayland compositors and making use of XWayland for old X11 clients, it's up to the compositor to pass the new "+byteswappedclients" argument when desired.
This merge request from Red Hat engineer Olivier Fourdan adds the option of enabling byte-swapped clients for XWayland under Mutter. For Mutter users this is exposed via the new "xwayland-allow-byte-swapped-clients" GSettings option for Mutter. By default xwayland-allow-byte-swapped-clients is false (disabled). The MR successfully landed today in Mutter Git.
This change will be found with GNOME 44 due out in March while on the X.Org Server / XWayland side still needs to end up in a released version, which at this point is unknown when given the lack of release management interest particularly when it comes to xorg-server releases.
With the latest XWayland/X.Org Server Git disabling byte-swapped clients by default, the support can be re-enabled using the "+byteswappedclients" command line switch or via the new "AllowByteSwappedClients" xorg.conf configuration option. As a reminder on the feature, this byte-swapped clients functionality is around X.Org/XWayland clients of difference CPU endianness when remotely connecting to the X.Org Server. Protocol messages to/from the clients can be byte-swapped by the X.Org Server but that code isn't actively maintained and known to be a large attack surface for malicious clients. Given different CPU endianness isn't too common these days and even less so these days for people using remote X11, besides some on x86_64 systems still using IBM s390x or PowerPC 64-bit for remote X11 use of graphical applications, this default change shouldn't affect many people.
But there have been some that raised concerns over the change due to their exotic setups, but at least when running the X.Org Server the new configuration knobs allow restoring the old functionality. For those running Wayland compositors and making use of XWayland for old X11 clients, it's up to the compositor to pass the new "+byteswappedclients" argument when desired.
This merge request from Red Hat engineer Olivier Fourdan adds the option of enabling byte-swapped clients for XWayland under Mutter. For Mutter users this is exposed via the new "xwayland-allow-byte-swapped-clients" GSettings option for Mutter. By default xwayland-allow-byte-swapped-clients is false (disabled). The MR successfully landed today in Mutter Git.
This change will be found with GNOME 44 due out in March while on the X.Org Server / XWayland side still needs to end up in a released version, which at this point is unknown when given the lack of release management interest particularly when it comes to xorg-server releases.
13 Comments