0

Why are people saying that the X Window System is not secure? The OpenBSD team succeeded with privilege separation in 2003; why didn't the "Linux developers" do this?

To be clear: What security design flaws does X have? Why don't the Linux developers separate privileges in X?

  • I don't get it, I mean what is the problem? point it out please, so I could correct it. What is the problem with asking that "why are people saying that X is not secure"? – LanceBaynes Jun 19 '11 at 19:05
  • 5
    What people? What are they saying? What does "secure" mean? In what context, for what risk profile? Compared to what? Which threats are they worried about? What are they basing this on? How should we know, short of speculating or pejorative adjectivizing? Do you have a specific article you'd like to relate to, or should we assume the same amorphous cloudcrowd that say you shouldn't go swimming after eating? – AviD Jun 19 '11 at 19:07
  • 1
    Adding to what @Graham said, and the question as posed doesnt even ask about X' security posture - rather, it asks about "why someone said something about it's posture". – AviD Jun 19 '11 at 19:23
  • 3
    @Lance - it appears that you may have answered your own question with those links...but I don't know, as your question does not make any sense without context. Add some context or else it will have to be closed due to it not being a real question. Look at the How To Ask section of the FAQ as per @AviD's comment. – Rory Alsop Jun 19 '11 at 20:33
  • 1
    Although, I do agree with the other commenters that this is a terribly formed question. I am really glad it was not stricken down and remained available. I had a different topic I was researching and it mentioned X11 being insecure and actually causing problems with the new .snap format of applications. ()datamation.com/open-source/…) I then searched for more information and found this post with the answer from D.W., which actually was useful information. – ZaxLofful Nov 21 '17 at 3:18
28

This is a poorly phrased question. For instance, it does not define what is meant by "secure". That makes it harder to provide a useful answer.

Here are three possible security concerns, and how X11 fares:

  • Isolation between apps. X11 does not isolate apps from each other. If one app is malicious, it can grab all keystrokes, tamper with other apps windows, steal the contents of copy/paste buffers, inject keystrokes into other windows, etc. (Windows has similar security properties.)

  • Preventing privilege escalation. X11 apps run as a non-root user. However, on most platforms the X11 drivers run as root, so they can access the display hardware. This introduces the risk that a malicious app might be able to exploit some security vulnerability in the X11 code and use it to become root. This is a serious risk, because X11 is a complex system with a tremendous amount of code, and all it takes is one security vulnerability anywhere in that code to make a privilege escalation attack possible. This is indeed a concern.

    The question refers to privilege separating the X11 code. I do not know how easy or hard this is to do, or how effective OpenBSD's attempt is. However, the aim of privilege separation is to reduce the likelihood of such privilege escalation vulnerabilities.

  • Enabling remote attacks. If I run X11 on my Linux machine, does that make it easy (or possible) for remote attackers to "hack" my machine? The answer is no. Remote attackers have no way to access or talk to X11, so running X11 on my machine does not make my machine insecure.

All in all, I would say that X11 does pose some security risks, but they are relatively minor, compared to the risks you are already accepting when you use any desktop OS. In the desktop world, every app you run already must be completely trusted (since any one rogue app you run has access to all your files and everything, and can ruin your life); X11 does not make this fact any worse.

Therefore, I would not hesitate to use X11, at least not on security grounds. If you find X11 useful, go ahead and use it.

  • 4
    +1, Very nice answer, especially considering the question... I nominate this for the [Reversal] badge... ;) – AviD Jun 20 '11 at 6:52
  • 2
    Regarding remote attacks, it's important to consider the design and security posture of X's network protocol (and XDMCP). It's not on by default, but it does raise its own issues once enabled. – user185 Jun 20 '11 at 8:07
2

According to one report the X Windows System had an application separation issue, but not a major issue where it is usually deployed.

As others have posted, the question asks the wrong question, especially as X Windows predates Linux. Linux is just the most visible target for flamebait.

On the application isolation issue:

On the web the most relevant article seems to be: Security Watch which references Joanna Rutkowska's Blog

Apparently there is no inherent isolation between gui applications on x windows.

Which doesn't mean too much in a Libre software system but much more when including software from many other providers on the one system.

Note: It seems as if in normal operation every application can see for as an example the password entered into sudo/xterm and every other thing on the gui.

It seems to be accurate, but I have not tested it myself, Joanna gives an example of it on her blog.

She is also trying to sell a product to fix it LOL.

-2

The question claims that "people are saying that X-windows is not secure". I see no evidence for this claim. I'm not familiar with anyone who is saying that. Wikipedia doesn't say that X-windows is insecure. I say it is BS.

(I know you posted some links in the comments on the question, but none of them say "X-windows is insecure". You have mischaracterized what they say. Please read more carefully in the future, and don't put words in people's mouth.)

Of course, if you want to be nitpicky, I realize you can probably find someone, somewhere, who is saying that X-windows is insecure. Heck, you can pick pretty much any statement you want, and I bet you can find someone, somewhere, who is saying that. But who cares? Even if someone is saying it, why should I care? I don't care what people are saying. People say dumb or uninformed stuff all the time. You shouldn't care about that stuff, either. You should care about the technical facts.

So don't ask about "why people are saying blah". Instead, ask about the facts. For instance, a much better question would be "Is X-windows a security threat?". Or maybe you ask a narrower question. The point is, don't waste people's time. If you want to get good answers, start by asking a good question.

  • 4
    I completely agree with the sentiment, but this should really have been a comment (or two or three :) ). This is not much of an answer, your other answer was much better. – AviD Jun 20 '11 at 6:54
  • Sorry that you didn't like it. I believe that sometimes the most accurate answer to a question with a faulty premise is to dispute the premise and un-ask the question. – D.W. Jun 20 '11 at 18:34
  • Oh I agree - see my comments on the question, this question as it stands now isnt much of a question... On the other hand, your other answer does a great job of handling the non-question-ish... – AviD Jun 20 '11 at 19:28
-2

I think the issue here is that any software you run on your system presents a security risk. The larger the software and the more privilege it requires, the greater the risk. The rule of thumb for running a secure system is to only install and run the absolute bare minimum of what's required for the system to do it's job. If you are using Linux as a desktop OS, then yes X11 makes a lot of sense. Many, many, Linux systems are servers that probably never have a display connected. It's not so much that running X11 is not secure, it's more like it's less secure than not running it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.