taway098123

There's no code I can show you that would be any more convincing than just looking at the code to the X server and then looking at the code to any wayland implementation. There's not anything particularly special about these projects.

I was familiar with that documentation around 10 years ago, please stop making these assumptions and please stop dismissing what I have to say. The documentation is irrelevant, I'm talking about the server source code. There is one real plugin implementation there that uses SELinux. That's it. There is currently no other real way to use XACE, it's otherwise totally useless to end users.

Yes people could develop new plugins that integrate with some other security mechanism, but they haven't, in part because the hooks are so out of date, and in part because, you know, that requires building another security mechanism. The access hooks are not a security mechanism, they allow you to integrate with some external MAC.

As someone who has done both, I respectfully disagree.

It's not wrong, it's not FUD, and that doesn't change anything. The only working plugin is the SELinux one. If you can't use that, you have to rebuild an entire new security architecture... which is what they had to do in Wayland anyway. XACE isn't really built for anything besides MAC either, so it's inadequate for doing anything that isn't an LSM. It also has a problem where new hooks need to be added for every new X extension, and that didn't happen so now it's outdated. In Wayland that entire concept was replaced with a single API function to do generic traffic filtering.

It's also outside the scope of a desktop environment or window manager to ship plugins to the X server. Hence another reason why they had to go with a new protocol that makes it easier to implement their own server...

There isn't really much difference. It's about the same amount of work either way to ship an extension.

In Wayland, you make the extension, then you patch every compositor, every toolkit and every application.

In X11, you make the extension, then you patch the X server, Xlib, XCB, every window manager, every toolkit, and every application.

XACE doesn't solve it. As mentioned elsewhere, that's dependent on SELinux. The idea with Wayland is to make things more secure everywhere, and not just on systems that have a particular LSM.

I completely disagree with everything in your comment. Wayland is an attempt by some developers to fix some longstanding issues with X11. They know what the new issues are and there is active work being done in preserve back compatibility and preventing things from breaking, e.g. XWayland. I've been using it for a few years, with no issues. I think it was bad up until around 2017-2018, that's when the major implementations started stabilizing and when consensus really started happening.

Dbus won't allow it because you have to switch to that user before it lets you connect. You would have to have whatever is doing the access running as root and then change its user. There's not really any magic here, it's just a socket with access controls on it, the same thing you would be building anyway.

I'm sorry about the throwaway, it's a long story.

You're crossing a security boundary trying to access other users' GUI programs. The session bus is for programs that are private to the user's session. Accessing that is mostly equivalent to logging in as that user, you're not supposed to take control of all their programs as another user.

I don't really understand your solution, the problem doesn't go away when you use a Unix socket. You're still crossing a security boundary and now you have to build in those access controls into your program. If you don't really care about the security aspect it would be just as easy to tell the user to grant you access to the dbus socket for their session bus, or run another dbus instance under a different user and control access to that socket. You can publish the same interface on multiple buses at once, and build in your own access controls too.

Yes it can, why wouldn't it? You can make a program that connects to more than one bus. Though that would probably be crossing a security boundary. The simple way to make multi-user services is to just deploy them on the system bus and be done with it.

You just kill the process, which causes the file descriptor to close. Cancelling the inhibitor lock by other means wouldn't do much, there's no way to get out of that situation without forcibly shutting the process down or disrupting its state.

Dbus is mostly just a message queue for Unix sockets. Think Kafka or SQS but only for local services.

>a protocol prescribes exactly the intersection of all implementations.

That's a better way to put it and that's more what I was getting at.

I hope someone comes along to review those, but I don't see there being much interest in it.

Everything you're saying is... mostly what's been happening? It's not impossible to have consensus. You're missing my point which is that people were trying various solutions since 2008, and there just wasn't any consensus on this particular feature until a few years ago. There's no reason to put it in a spec if there's no consensus. It turned out that the consensus was to not put this in a Wayland protocol, and to do it somewhere else. So it would have probably been a mistake if someone tried to force this through before then.

If you ask me, people only notice the ones where it takes a while to reach agreement. Just look at the PR we're commenting on, it took nvidia several years to come around and implement dma-bufs. Sucks but it happens. No one ever seems to pay attention to all the other areas over the years where there was consensus.