Re: Proxying Wayland for untrusted clients

Michael Raskin
2021-05-22T16:12:01Z

>>>One of the benefits that Wayland is supposed to have over X11 is
>>>security. A Wayland application isn't supposed to be able to record the
>>>screen without user permission, for example. But in most compositors,
>>>it can, with no restrictions. Existing Wayland compositors are
>>
>> … and theoretically, an X server could feed empty capture to a client it
>> does not like …
>>
>> (of course with literal decades of actual backwards compatibility, X11
>> protocol has accumulated enough extensions that assigning permissions
>> to all of them might be somewhat painful)
>
>Considering that the world has convered on a single X server
>implementation, and it's apparently pretty horrible to maintain, I'm not
>sure I feel very positive about the idea of a custom one!

Considering how much works fine in Xvnc which kind of lacks half the
extensions, and considering that all the bad hardware stuff now needs to
be handled in each compositor, it is unclear how much worse it would
actually be.

So OpenGL-first design sounds like the real reason for all the mess.

>And yeah, with Wayland clients are already expecting to have to ask for
>permission. (I've just learned that this is actually done over DBus, so
>the proxy would have to implement that as well, ugh.) I suspect X11
>clients wouldn't be very happy if it took them seconds to get the result
>of their attempted screen capture, and users wouldn't be very happy if
>screen sharing was just a blank box by default, rather than a permission
>request. (I'm not sure which of those would be possible with X11.)

Assuming the client does not use the protocol extensions to control the
request, presumably black rectangle immediately and a permission dialog
from WM to the user, then the capture suddenly getting real data.

Single-window capture depends on whether the client can handle capture
resize, if yes, no problem (capture the generic «window» in the client,
get black box while the user picks the true target). Otherwise there
might be some juggling indeed.

>> … unsurprisingly, as these are typically WM teams who are now deprived
>> of what Xorg server did for everyone.
>
>Only the ones that don't use wlroots, I think. wlroots has its own
>problems, but in large part those are the problems we're trying to
>mitigate here.

Yes, but it seems memory-unsafe even by the «careful C» standards, and
it seems to crash noticeably often with reasonably well-behaved clients,
so just a protocol compliance filter would not be enough.

>>>To solve these problems, I propose a proxy program that sits between
>>>Wayland clients and the compositor, in the same privelege domain as the
>>>compositor. The proxy would decode and re-encode every Wayland request
>>>(client->compositor message), and would discard any request it didn't
>>>understand. This would mitigate the problem of a large, privileged
>>>program written in a memory-unsafe language being exposed to untrusted
>>
>> Presumably, also validating that the shared memory buffers passed around
>> have the same size and protection as promised?
>
>Aren't shared memory buffers usually handed out by the compositor, to
>the client? IIRC this was the reason virtio wayland can work when it
>only supports shared memory that was allocated by the host.

Looks like for wl_shm the client creates and shm object and sends FD to
the server, then both sides mmap from there. Given that one could cook
an FD with approximately arbitrary combination of properties, I guess
some care should be taken about this, too.

>>>no support in the Wayland protocol. It could even be used to modify
>>>surfaces, to implement things like Qubes-style unspoofable coloured
>>>window borders.
>>
>> I am tempted to ask how close it will be to providing a socket for WM
>> and window decorator implementation (with some suitably limited
>> compositor as the backend behind the proxy).
>>
>> (So basically, defining a scope will be hard, and defining a scope in
>> a usefully extensible way might be even harder)
>
>I don't understand this point. Can you rephrase / expand?

Well, you start describing a proxy that is basically «only valid
messages pass» and that's it, then add that it could also implement some
more functionality. Then you say plugins for policy-heavy functionality.
(I guess at that point the natural next step is a socket so that
safety-handling and user logic could be in different processes)

This sounds like a recipe for scope creep, although it might also be
good as a single well-vetted Thing being safety-critical and a lot of
policy decisions being pushed to restartable and
functionality-restricted separate processes is actually better than the
current recommended approach to Wayland compositors.

If you want to try pushing the project to freedesktop, I suspect it is
a good idea to define how much scope you want to include into the pitch.
Although apparently they don't have any objections to hosting software
with heavy scope creep, when reaching for a high profile, it is a good
idea to set internal expectations before having to manage external ones.