From 31336c8a4bafa684e05046b333d1dad21653dc64 Mon Sep 17 00:00:00 2001 From: "Enrico Weigelt, metux IT consult" Date: Wed, 1 Jul 2026 20:31:48 +0200 Subject: [PATCH] Xext: namespace: grant superPower bypass in resource-access hook Every other Xace hook in this extension already exempts superPower clients (hook-client.c, hook-ext-access.c, hook-ext-dispatch.c, hook-windowproperty.c, hook-send.c, hook-server.c, hook-device.c, hook-selection.c) but hookResourceAccess() did not, so a superPower client (e.g. a WM) could not resolve GetClientNamespace(windowID) for a window owned by a client in another namespace - exactly the gap probono asked about. Verified: xnamespace -s whoami now returns that namespace instead of BadAccess; go-x11proto conformance suite still 40/40 (both byte orders). Signed-off-by: Enrico Weigelt, metux IT consult --- Xext/namespace/hook-resource.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Xext/namespace/hook-resource.c b/Xext/namespace/hook-resource.c index b90d8889d0..66b69f9e32 100644 --- a/Xext/namespace/hook-resource.c +++ b/Xext/namespace/hook-resource.c @@ -28,6 +28,10 @@ void hookResourceAccess(CallbackListPtr *pcbl, void *unused, void *calldata) if (param->client == serverClient) goto pass; + // no restriction on super power + if (subj->ns->superPower) + goto pass; + // special filtering for windows: block transparency for untrusted clients if (param->rtype == X11_RESTYPE_WINDOW) { WindowPtr pWindow = (WindowPtr) param->res;