hashirama/xserver
Watch
0
0
Fork
You've already forked xserver
 0
mirror of https://github.com/X11Libre/xserver.git synced 2026-11-15 05:23:40 +00:00
Code Issues Projects Releases Wiki Activity

Xext: namespace: grant superPower bypass in resource-access hook

Browse source 
Every other Xace hook in this extension already exempts superPower
clients (hook-client.c, hook-ext-access.c, hook-ext-dispatch.c,
hook-windowproperty.c, hook-send.c, hook-server.c, hook-device.c,
hook-selection.c) but hookResourceAccess() did not, so a superPower
client (e.g. a WM) could not resolve GetClientNamespace(windowID) for
a window owned by a client in another namespace - exactly the gap
probono asked about.

Verified: xnamespace -s whoami <window-id-in-other-ns> now returns
that namespace instead of BadAccess; go-x11proto conformance suite
still 40/40 (both byte orders).

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
This commit is contained in:
Enrico Weigelt, metux IT consult 2026-07-01 20:31:48 +02:00 • committed by Enrico Weigelt
commit 31336c8a4b
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Xext/namespace/hook-resource.c
View file

@ -28,6 +28,10 @@ void hookResourceAccess(CallbackListPtr *pcbl, void *unused, void *calldata)
if (param->client == serverClient)
goto pass;
// no restriction on super power
if (subj->ns->superPower)
goto pass;
// special filtering for windows: block transparency for untrusted clients
if (param->rtype == X11_RESTYPE_WINDOW) {
WindowPtr pWindow = (WindowPtr) param->res;