Lets say that on a Linux system I use bubblewrap to sandbox an application and give it write access to
/tmp/.X11-unix so that it can be an X Windows client. Is it possible for the sandboxed application (without using any X server exploits) to invisibly log keystrokes that go to other applications? On the one hand, the Linux keystroke logger logkeys requires root access to one of the
/dev/input/event# devices. On the other hand xhotkeys can, without any root privileges, intercept arbitrary keystrokes, so maybe the sandboxed app could similarly intercept arbitrary keystrokes and then re-post the event as a synthetic event so that the it goes through to the intended recipient.
EDIT: If it is possible for the sandboxed app to do keystroke logging with just an X Windows client connection, can this be prevented by launching a nested X server and only giving the sandbox access to the nested server?