Xorg Developer's Conference - Security Talk
Rough outline of talk/discussion follows:
Security Advisories/Response
- Not covered
X Authentication/Transport
- Loadable module support for authentication methods. Could be done: provide registration function, call callback list passing connection setup information plus file descriptor; callback performs authentication entirely before returning decision to server.
- Xtrans improvements. XCB doesn't use it. Could make it an actual library. Is a filehandle a sufficient abstraction?
- XC-QUERY-SECURITY rework.
Fine-Grained Access Control
- Have a research paper; will post link.
Improved resource lookup functions: still thinking about the prototype for dixLookupResource. Not sure if the DixReadAccess/DixWriteAccess flags are useful or necessary.
- Use the resource system to store your module's objects.
- Don't multiplex different operations through the same protocol request.
Other Security Work of Note
Security error handling. Right now, the Security extension "hides" denials from the user by returning false information. I would like to see the server begin returning actual errors, preferably BadAccess.
- devPrivates rework. Currently have separate functions for each supported structure. Could standardize this into one set of functions.
Need to add devPrivates to additional structures: PropertyRec.
- Window labeling: currently exporting properties to window manager. Feature request: need secure area for showing labels.
- Secure handling of input events. Secure attention key support.
Applications
- Shared Display Wall