Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What the most harmful thing can malware program started as separate limited user account do if it has access to the X server?

Network and filesystem things are already considered by chroot and netfilter.

It obviously can lock the screen and I will need to switch to other vt and kill it manually. Can it for example disrupt other GUI programs on the same X server (access a root terminal in nearby window)?

I know that it is safer to run it in separate X server, for example, in Xtightvnc or even some virtual machine, but how dangerous is to just run it like other programs?

share|improve this question
up vote 1 down vote accepted

If you've already gone to the trouble of setting up a separate X server, have you considered running the program inside a nested X-server like Xnest. Then, you would completely isolate the malicious program in its own X envrionment. Or if you want to be absoutely safe, you might even consider something VirtualBox for a whole other VM.

share|improve this answer

Once a program has access to the X server it can virtually do everything you can do with a mouse and a keyboard. This will not be limited to this application's window should it have one, but could affect other running applications.

There are tons of applications to help people with accessibility-related problems assisting them to use the keyboard or the mouse to control their X sessions. Why should malware not do that and just pretend to be you?

share|improve this answer
Example: It's not a virus, it's a GUI scripting engine that you can use to script arbitrary actions, like clicking on GUI buttons and typing in text boxes and stuff. I'm just providing it as an example of what capabilities a malicious program would have access to. – Ryan Thompson Mar 27 '10 at 22:21

Install Zephyr and then :

Zephyr -ac -screen 800x600 -br -reset -terminate :2 &

to run a nested/isolated x session.


share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .