🔒X11 Containers Get a Wildcard Fix
Containers now have unrestricted access to X11
TL;DR
A new trick uses the FamilyWild family (0xffff) in .Xauthority files to grant containers unrestricted access to X11. This simplifies setup but requires careful handling of security risks.
Google just introduced a tweak for X11 container setups, using the FamilyWild family (0xffff) in .Xauthority files to bypass hostname constraints and allow containers unrestricted access. If you're running X11 apps inside Docker or LXC containers, this is huge. It simplifies setup but demands careful security practices to avoid exposing your system. The change involves a single field update: the 2-byte family at the start of each entry. This tweak keeps the door locked with secret keys while removing hostname restrictions.
Key Points
FamilyWild family value: 0xffff
Rewrite with sed command: sed 's/^..ffff/' /path/to/.Xauthority
xauth nlist prints entries in numeric format, showing FamilyWild as ffff
Merged into new file with xauth -f /tmp/portable.Xauthority nmerge -
Requires careful handling to avoid security risks
Why It Matters
If you're setting up X11 forwarding for unprivileged LXC containers, the FamilyWild trick simplifies access but demands tight control over .Xauthority files. Anyone who can read these files and reach your X socket gains full access, so don't leave copies lying around on shared machines.
Frequently Asked Questions
Why does this matter?
If you're setting up X11 forwarding for unprivileged LXC containers, the FamilyWild trick simplifies access but demands tight control over .Xauthority files. Anyone who can read these files and reach your X socket gains full access, so don't leave copies lying around on shared machines.
What happened?
A new trick uses the FamilyWild family (0xffff) in .Xauthority files to grant containers unrestricted access to X11. This simplifies setup but requires careful handling of security risks.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 2,544 builders reading daily.