On Saturday 4 February 2017 7:28:31 AM IST sivmu wrote:
As long as the application has access to the xwayland instance, which is by default the case when xwayland is available, it can influence all other applications that still use the x-protcol.
Just to understand, if there are two applications using xwayland, under a wayland session, will they be still able to look at each other's resources? If the answer is no, the security is equivalent to the wayland applications, since xwayland instance is essentially a sandbox?
Only the input/output of applications using only the wayland protocol are somewhat safe from this attack vector. To fully close this risk, full adaption of wayland in all applications is necessary, because then you no longer need any xserver.
Again, if a wayland application and a xwayland application are running side- by-side, the xwayland application cannot of peek into the resources of wayland application right? Thanks. -- Regards Shridhar