Re: How should the image widget work?

On Wed, Jan 19, 2005 at 10:57:03PM +0000, Mark Thomas wrote:
> On Wed, 19 Jan 2005, Phil wrote:
> 
> > The biggest obstacle I can see to server-side image rendering is that it
> > would be relatively easy for us (or of course the libMagick crew) to
> > introduce a bug which allowed one client to alter the image resources of
> > another.  This would be a big security problem (as you could
> > misrepresent data), and would be less likely to crop up if we had a
> > simpler server-side widget and put the complexity in the client.  The
> > recent(ish) JPEG-rendering-related security holes in a lot of software
> > show how easy it is for this kind of thing to creep in.
> 
> X, as it currently stands, lets any application with the window id of
> another window draw directly into that window.  There have been murmurs of
> fixing this in the last couple of years [1].

We already have the 'simple' solution: there's a security model in
place for connecting to the server at all, such that untrusted users
should not be able to connect. With no untrusted users there aren't
any possible security issues further on in the code, aside from
privilege escalation, and that's probably inevitable anyway.

I don't think there's a good reason for letting untrusted users access
your display system. This seems rather more like the job of a web
browser or similar things. Y is essentially a single-user system, and
should probably stay that way (multiple users on the same screen seems
like a bad idea). Contemporary graphics hardware is built with this
principle in mind, so we can't really do anything about it before they
do.

> > I'm not suggesting we're more likely to introduce security holes than
> > anyone else, just that we're no less likely to do so.
> >
> > A compromise would be to use the server-side widget if the uid of the
> > client process matches the uid of the server process, that should at
> > least stop malicious images interfering with privileged programs.
> 
> What about clients on remote machines?  To disallow them access to the
> server-side widgetry will negate their greatest benefit.

Illustrating this with an example:

An image viewer should be able to rescale the displayed image (from
'1:1' to 'fit screen' or similar) without having to reupload the 300k
image over the modem link. (It should not, however, attempt to do this
with a 50Mb image; it should rescale that client side).

We want to at least permit this, and ideally implement it.

-- 
  .''`.  ** Debian GNU/Linux ** | Andrew Suffield
 : :' :  http://www.debian.org/ |
 `. `'                          |
   `-             -><-          |

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFB7/pAlpK98RSteX8RAjqyAKCPOJ78kOpuJIZ+gWvM/Gw9VvGuMQCfRaBh
9PRDiPQJamINcuiBANxT4Ic=
=jT1k
-----END PGP SIGNATURE-----