Questions about the SECURITY extension, and X security generally
mrs at mythic-beasts.com
Mon Dec 22 08:31:32 PST 2008
Chris Palmer <chris at noncombatant.org> wrote:
> I want to enjoy the benefits of the X SECURITY extension, such as with
> OpenSSH's -X (vs. -Y) option.
I wouldn't bother using the old X Security extension. It only
provides two protection domains, called "trusted" and "untrusted".
Imagine a multi-user operating system that only allowed two users, or
that could only run two processes.
> I want to be able to stop X clients running on remote servers from being
> able to e.g. take a screenshot of other (local client) windows or log
> keystrokes intended for other (local) clients.
You have three options:
* Use Xpra (http://partiwm.org/wiki/xpra). It will forward X connections
and though it was not intended to be a security tool I belive it does
have the property you want.
* Use SELinux, which makes use of the X server's XACE hooks.
* Write your own extension that uses the X server's XACE hooks.
> Using a dumb keylogger I wrote (my first raw X program) and scrot, I can
> read all keystrokes and take a screenshot of the whole screen, from a remote
> machine that I connected to with "ssh -X".
On what system? On Debian/Ubuntu, -X and -Y do the same thing. (See
ForwardX11Trusted in the ssh_config man page and
More information about the xdg