Skip to content

docs: sway does not have screencopy vulnerability (https://github.com… #412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
helinoscool wants to merge 1 commit into
base: live
Choose a base branch
from
Open

docs: sway does not have screencopy vulnerability (https://github.com… #412

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions content/IMAGES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,6 @@ GNOME, KDE Plasma, Sway, and COSMIC (Silverblue, Kinoite, Sericea, and COSMIC im

In addition, GNOME also provides weak <a href="https://gitlab.gnome.org/GNOME/gnome-desktop/-/issues/213">thumbnailer sandboxing</a> in Gnome Files, and Thunar/Tumblerd on secureblue Sway images provide weak [thumbnailer sandboxing](https://gitlab.gnome.org/GNOME/glycin/-/blob/main/glycin/src/sandbox.rs#L32) via Glycin. These are both efforts to mitigate <a href="https://scarybeastsecurity.blogspot.com/2016/11/0day-exploit-compromising-linux-desktop.html">attacks via thumbnailers</a>. COSMIC [is planning](https://github.com/pop-os/cosmic-files/issues/1189#event-20127287968) to add thumbnailer sandboxing for the release of Epoch 2. It's not known whether KDE plans to add this to Dolphin.

It should also be noted that our Sericea images disable the wlroots desktop portal, despite it being commonly used alongside Sway. This is because the portal reintroduces the screencopy vulnerability described above, which would undermine the security improvements in Sway for sandboxed applications. The downside of this is that by default on our Sericea images, Flatpaks and applications that haven't implemented protocol support (like chromium-based browsers) are entirely prevented from screenshotting and screensharing. If necessary, Sway users can configure this using their own <a href="https://flatpak.github.io/xdg-desktop-portal/docs/portals.conf.html">portals.conf</a>.

This section is a relative recommendation between the desktop environments available on secureblue. This should not be misconstrued as saying that any one solves any of the fundamental issues with desktop Linux security. For more details, consult the table below. Note: this table assumes no extensions are installed. Extensions are a significant source of attack surface in and of themselves and they can reduce the effectiveness of, or completely negate, the security advantages described above.

| DE/WM | Secures privileged Wayland protocols? | Thumbnailer sandboxing? | Stability | Recommendation |
Expand Down