Isolating Xwayland in a VM
This is a bit off topic, but the article reminded me of something that&#x27;s always bothered me: one of the (several) motivations for creating Wayland was to fix the security issues with X11, namely that any X client can read and manipulate the windows belonging to any other X client.  And I&#x27;ve heard claims that this problem is just unsolvable.<p>It... doesn&#x27;t seem like it is, really.  Couldn&#x27;t we modify the X server so clients just <i>can&#x27;t</i> do that anymore?  And then introduce a new X extension that provides for cases where this does need to happen, like the window manager (which could be granted blanket permissions), and other apps that would cause a dialog to pop up where the user could approve or deny access (think apps that take screenshots, or video conferencing apps that share the screen or specific windows with other participants).  This permissions dialog could be handled by the window manager, or perhaps some standalone app that is somehow securely registered with the X server via this new X extension.<p>I expect there are some other issues (and things that will break[0]) with apps not knowing about other apps&#x27; windows, but I&#x27;m not convinced those issues can&#x27;t be solved.  I could even imagine that this new regime might only implement partial isolation, where clients can&#x27;t read pixels from or fake events to other clients&#x27; windows (among other things), but can know the sizes and positions of other windows, and maybe even read some whitelisted set of window properties.  I think that would still address most, if not all, security concerns with the current model.<p>(Just to present some credentials so this doesn&#x27;t come off as a clueless, &quot;duh, this is so easy, you morons&quot;-type post: I&#x27;ve written an X11 compositor, hacked on a window manager, built a simple toy WM for fun, and was once a co-maintainer of a reasonably popular desktop environment.  So I&#x27;m not a complete noob here.)<p>Certainly there are other benefits to Wayland over X11, not just security: greatly simplifying the graphics situation, moving the compositor into the &quot;server&quot; where IMO it belongs, etc.  But I&#x27;m still not completely sold on the idea that this is worth a multi-decade project to completely replace this critical bit of the Linux GUI stack.<p>I&#x27;m also not convinced that the X server can&#x27;t be extended in other ways to fix other deficiencies.  Of course, at the end of the day, I&#x27;m not doing the work, and the nature of open source means that if everyone wants to work on Wayland and no one wants to work on X11 or the xorg server, that&#x27;s just the way it will be.  But it feels like if we&#x27;d put even a fraction of the Wayland effort toward making X11 better, we&#x27;d be done by now, and people writing X11 applications would mostly not have had to do all that much work to migrate (and many wouldn&#x27;t have to do <i>any</i>).  Would it be as objectively &quot;good&quot; as Wayland supposedly is?  No, probably not, but perhaps that doesn&#x27;t matter.<p>[0] One thing I can think of here is that some applications need to open more than one connection to the X server, and the X server would see them as separate clients.  That could break an application that expects to be able to share and manipulate resources between the multiple connections.  But perhaps that could be worked around by grouping permissions not solely by connection, but by process ID.  There are probably still some edge cases here, but I think changing the apps here would be ok to do; at least, it seems like less work to accept this sort of breakage and try to fix the apps rather than develop an entirely new windowing system!