Commit Graph

24 Commits

Author SHA1 Message Date
Enrico Weigelt, metux IT consult d338bf6e68 namespace: drop unused winIsRoot()
Not used in this file, so no need to keep it around anymore.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-07-04 17:11:54 +02:00
dasha_uwu 7c64a06ba4 treewide: remove "lib" prefix in static_library names (meson)
this was producing static libraries named "liblibsomething.a"

Signed-off-by: dasha_uwu <dasha@linuxping.win>
2025-07-03 12:01:52 +02:00
Enrico Weigelt, metux IT consult a353ffddd0 Xnamespace: add support for multiple auth tokens per namespace
Support having more than one auth token per namespace, so separate tokens
can be handed out to clients that are still landing in the same namespace.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult f790bae8dc Xnamespace: initial config loader
This loads the configuration (simple text file) passed via command line.
For now just supporting static configuration, that's loaded on server
startup.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 9c4b4e54d1 Xnamespace: property access hook
Filter property access. Right now just allowed inside same namespace,
or when caller is in root namespace.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 21e890e5fc Xnamespace: whitelist access to some server resources
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 8df9373199 Xnamespace: whitelist some XI operations
Whitelisting some XI operations in various hooks.

Note that some additional filtering needs to be done in send or
receive hook in order to prevent clients to receive possibly sensible
input data from the root window.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 0a90e70a01 Xnamespace: filter access on other clients
Restrict access to other clients within same namespace.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult e92d6ad8e4 Xnamespace: filter client-to-client message sending
Filter message sending by clients. Only sending within the same
namespace is allowed (except for clients in a NS with superpowers,
e.g. root)

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 5a2903901a Xnamespace: filter server access
Whitelisting several server access calls that are safe, rejecting the rest.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult e293308ef7 Xnamespace: filter device access
Filter device access, whitelist several commonly used operations that
should be safe (eg. query keyboard layout).

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 7afdba1952 Xnamespace: whitelist access to namespace virtual root window
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult fdba5d405d Xnamespace: whitelist certain operations on (real) root window
CreateWindow() needs access to root window, in order to create
top level windows. Whitelisting this operation.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult df56b26ed4 Xnamespace: whitelist resource access for serverClient
The server itself is allowed to access anything w/o restrictions.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult eaa08af7d1 Xnamespace: whitelist resource access within same namespace
Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 86dd87d46c Xnamespace: filter transparency
Silently drop transparency flag if namespace isn't allowed to use it.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 14008eb698 Xnamespace: filter extension access
Whitelist several extension calls that are safe. Also allow namespaces
to be configured for unrestricted access.

TBD: doesn't actually reject yet

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 81faed9c8c Xnamespace: filter raw mouse motion and keyboard access
Only namespaces with allowMouseOption flag enabled can receive
raw mouse motion events. Raw key press events are always blocked.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult cb1baec84a Xnamespace: isolate root window property access
Redirecting access to root window properties to the per-namespace
virtual root windows. This isolates a lot of communication via root
window, e.g. the cut buffers.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 159183c8a0 Xnamespace: create per-namespace fake root windows
For each namespace creating a fake (invisible) root window, which can be
used for storing per-namespace properties (eg. cut buffers), etc.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 5901cb001d Xnamespace: add selection isolation
Selection names (as seen by the client) are internally prefixed with the
namespace ID, so each client can only access those within it's namespace.

If a client within namespace "foo" want's to operate on "PRIMARY",
it actually will be doing so on "<foo>PRIMARY", w/o ever noticing it.
Events will sent back to the client still pointing to "PRIMARY".

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 0698743fde Xnamespace: assign incoming clients to namespaces
The association is done by matching client's and namespace's
authentication token.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 9f8ef921ad Xnamespace: add basic namespace config structures
Adding data structure and initial data for namespace configuration.

Built-in namespaces are ROOT and ANONYMOUS.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00
Enrico Weigelt, metux IT consult 4379f7cc87 Xnamespace: namespace extension skeleton
Add tiny skeleton for the namespace extension. Disabled by default,
can be enabled via +extension arg, but doesn't actually do something yet.

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>
2025-06-12 17:21:48 +02:00