Skip to content

Security: suppress cross-seat VT keyboard leakage #72

@kavau

Description

@kavau

The bug

The Linux kernel's kbd handler is bound to every keyboard regardless of udev ID_SEAT tagging, and routes keystrokes to whichever VT is currently the system-wide foreground. When seat0 shows a text VT (e.g. agetty on tty1), keystrokes from seat1's keyboard land on it. seat1 -> seat0 leaks; seat0 -> seat1 doesn't.

This is universal Linux multiseat behavior, not an atrium bug, but we should do something about it!

A proper upstream fix would be to preserve EVIOCGRAB across VT-side activity in the kernel.

Why the obvious fixes don't work on their own

  • libinput already does EVIOCGRAB. It works initially -- but the grab is silently invalidated by certain seat0 VT-side operations (agetty respawn, terminal reset). Userspace can't reliably keep it held. This is an upstream kernel bug.
  • KDSKBMODE K_OFF on text VTs is wiped the next time agetty respawns on that VT, since agetty sets its own keyboard mode.
  • /sys/class/input/inputN/inhibited detaches both kbd and evdev, killing the legitimate compositor input too.

Possible mitigations

  1. Disable text logins on managed seats (mask getty@tty1, autovt@tty[2-6]). Removes the leak destination.
  2. K_OFF on atrium-managed VTs at startup, and reassert in the SIGCHLD handler.
  3. VT_LOCKSWITCH, opt-in via lock-vt-switching config (requires unlock/switch/relock plumbing for atrium's own VT activations).

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:daemonDaemon core: event loop, signal handling, main.c wiringenhancementNew feature or requestsoonWaiting queue - ready to move to Next

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions