Wayland Keylogger
this seems completely miss the point of wayland security.<p>Of course if you run the programs under same account you can keylog them. You can also connect to Chrome and steal the cookies directly, wrap terminal to install pty loggers, backdoor ssh and so on.<p>The real point of wayland security is you can safely run multiple user accounts on the same desktop. And the LD_PRELOAD tricks (or PATH tricks etc..) do not work across accounts, unless you are doing something stupid.<p>I wish people would stop saying silly things like &quot;But for any possible way to break it, I could add countermeasures as well. Applications could use &#x27;getenv&#x27; ....&quot;. That&#x27;s not how you break keyloggers! You break them with privilege separation. The least-code version would be:<p>1. Create a separate user for web browsing, with its homedir and all<p>2. Create &quot;&#x2F;etc&#x2F;sudoers.d&quot; entry to launch browser which does not require password, but also does not allow any arguments, enforces HOME and only passes through a small subset of env vars<p>3. Launch your browser with &quot;sudo -H -u browser-user firefox&quot;. Make it a desktop shortcut or something so you are not tempted to enter your password if someone messes with the shortcut.<p>that&#x27;s it -- this will stop this attack, and many others, cold. And will not require any SELinux.