X has some serious security problems, not the least of which is that any program using a given display can log keystrokes from any other program on that display. (This can be demonstrated easily using xinput.)
Is there any way to mitigate this within a single X display, without losing essential things like shared clipboard support?
e.g. would it be possible for a window manager to intercept all keystrokes, and pass them on only to the program owning the currently selected window?
Also, is there at least any way to prevent programs from sending sequences of keystrokes to each other? As things are by default on almost all Linux distributions, a compromised program running in my account could send 'rm -rf /\n' to a shell prompt running as root.
I know Linux has mandatory access control frameworks aplenty, but for purposes of spying on a user, those are all AFAIK rendered moot by X having insecure design from day one. What steps can be taken to reduce this hazard?