Am 03.02.2017 um 17:49 schrieb Bart De Roy via arch-general:
hello
I've been postponing looking into browser isolation since I started using Wayland about a year ago.
Does anyone have pointers, experiences or comments on this topic with regard to Xwayland? If I'd want to disassociate parts of chromiums execution context, what are common, good options?
cheers, Bart
As long as the application has access to the xwayland instance, which is by default the case when xwayland is available, it can influence all other applications that still use the x-protcol. Only the input/output of applications using only the wayland protocol are somewhat safe from this attack vector. To fully close this risk, full adaption of wayland in all applications is necessary, because then you no longer need any xserver. In the end this is really tricky and as has been mentioned, there is currently no really good solution for sandboxing desktop applications that can be easily applied. For most isolation purposes, applications like bubblewrap, lxc or systemd-nspawn can help, but you will still need to take care of X11, dbus and some other issues taht are not all that easy.