Re: How should the image widget work?

On Wed, Jan 19, 2005 at 10:57:03PM +0000, Mark Thomas wrote:
> X, as it currently stands, lets any application with the window id of
> another window draw directly into that window.  There have been murmurs of
> fixing this in the last couple of years [1].

> [1] http://www.nsa.gov/selinux/papers/X11_Study.pdf

This is an independent problem; such a system operates under the
assumption that the trusted application (the Y server) is secure up to
the test point; a trusted application is directly responsible for
enforcing security rules. Anyway, we can do MAC in the message
dispatcher, after having secured all the protocol code (which will be
painful). Trusted path and domain labelling are easy in
Y. Confidentiality is merely a matter of setting sufficiently
agonisingly painful MAC rules. I don't think it would be difficult to
add all this stuff as an extra security model, for anybody who wants
it, without compromising application compatibility.

A system along these lines would simply deny access to features which
aren't trusted, such as anything involving libpng. Clients would be
expected to fall back to client-side rendering where necessary. The
problem of determining which backend components are and are not
trusted is somebody else's problem.

-- 
  .''`.  ** Debian GNU/Linux ** | Andrew Suffield
 : :' :  http://www.debian.org/ |
 `. `'                          |
   `-             -><-          |

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)

iD8DBQFB7/2IlpK98RSteX8RAuaAAKCHgkSBveRlpPo1liiCmFu8C4iuzwCdEJDm
nxXiXt337qbPRSY/++bVj0s=
=J5AB
-----END PGP SIGNATURE-----