[Wayland-bugs] [Bug 101345] Multiple compositor crash and security problem

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=101345

Daniel Stone <daniel at fooishbar.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |NOTABUG
             Status|NEEDINFO                    |RESOLVED

--- Comment #3 from Daniel Stone <daniel at fooishbar.org> ---
(In reply to Jonas Ådahl from comment #2)
> FWIW, gnome-terminal uses a single client for all terminal windows, and
> running "gnome-terminal" will just, over D-Bus tell gnome-terminal-daemon to
> launch another window, and it'll use the Wayland display where it was first
> launched. So for that particular "issue" that is probably the cause. I
> suspect chromium works in a similar way.

It does, and it will print 'Creating new window in existing session' whilst
doing so.

This is not a security issue: as a user, you have two processes
(gnome-terminal-daemon and the 'gnome-terminal' wrapper binary you are running)
which are allowed, per your local security policy, to communicate with each
other. This is usually by D-Bus, but can be by UNIX sockets, or even ptrace.

If you want to ensure you cannot access one session from another, I would
recommend running as a different user, so your permissions will prevent
accessing the compositor socket, so they will not share UNIX sockets in your
home directory, and so ptrace will also be cut off.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/wayland-bugs/attachments/20170608/b54dd6b8/attachment.html>