Enhancing x11 Application Security with LXC (2025)
73 points by shirozuki
by mid-kid
2 subcomments
For an article written late last year I hoped for a little more awareness of how massive a security hole granting full, unfiltered access to the X11 server is. Granted, any sandboxing is better than none, but firefox is one of the few apps that already sandboxes itself really well, and with a blog title like that it might be good to touch upon things like nested X servers such as Xephyr.
by ChocolateGod
1 subcomments
Correct me if I'm wrong, but passing through the X socket gives a giant sandbox escape as any application can control/see any other application, including a root terminal in a GUI app.
by sedatk
1 subcomments
Putting apps in a container sounds like a great idea until you need to access your files.
by ElijahLynn
6 subcomments
Is X11 going to be like IE6. Still around in another 10 years after it was intended to be deprecated across all major distros (2025/2026).
by waynecochran
0 subcomment
I wish I lived in a world were you didn't have to sign contracts, lock your doors, or have X11 security. It is so fun to run xmeltdown a new user's display.
by ddapperd
0 subcomment
In terms of attack surface, how does this compare to just using AppArmor or SELinux, without containers?
by
0 subcomment
by sunshine-o
0 subcomment
This is a great article.
I have little experience with lxc but I guess waypipe could be an option too.
by LtWorf
1 subcomments
Or one could just use firejail, which comes with a number of pre made profiles for common applications.
by calvinmorrison
2 subcomments
Xlibre (the only current actively developed implementation of a X11 server) has a new extension - XNamespace to address some challenges as well.
Hacker News