Is it possible to do exploit-free Linux keylogging with non-root client-only X Windows access?

Question

Lets say that on a Linux system I use bubblewrap to sandbox an application and give it write access to /tmp/.X11-unix so that it can be an X Windows client. Is it possible for the sandboxed application (without using any X server exploits) to invisibly log keystrokes that go to other applications? On the one hand, the Linux keystroke logger logkeys requires root access to one of the /dev/input/event# devices. On the other hand xhotkeys can, without any root privileges, intercept arbitrary keystrokes, so maybe the sandboxed app could similarly intercept arbitrary keystrokes and then re-post the event as a synthetic event so that the it goes through to the intended recipient.

EDIT: If it is possible for the sandboxed app to do keystroke logging with just an X Windows client connection, can this be prevented by launching a nested X server and only giving the sandbox access to the nested server?

Answer 1

Yes, it is possible to do keystroke logging with just an X11 connection. The two common ways to do this are to use the XTEST extension, or to use XQueryKeymap(), which returns the current state of the keyboard. As an X11 connection just goes over a socket, if a process has access to the X11 cookie and can authenticate itself with Xorg, it will be able to monitor (and inject) keystrokes.

Using a nested X server would protect from this (though I would recommend Xephyr rather than Xnest, as the latter is deprecated). You would have to give the sandboxed process access to the nested server's X11 cookie, and prevent it from accessing the root X11 cookie.