[GH-ISSUE #3436] hopper(linux): private X authority cookie is visible in xauth's argv #1281

New issue

Closed

opened 2026-10-16 21:03:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:03:43 +00:00

Owner

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3436

scripts/hopper-demo-x11.py (authorize_display) runs xauth -f <authority> add :N . <cookie>, so the MIT-MAGIC-COOKIE is readable by other local users through /proc/<pid>/cmdline while xauth runs.

Xvfb is started with -nolisten tcp -auth, but its Unix socket under /tmp/.X11-unix accepts connections from anyone. A local user who catches the cookie can view or inject input into the private Hopper display.

Expected: pass the command on stdin (xauth -q -f <authority> source -), so the cookie never appears in argv.

Reviewed at fa4b828. A PR follows.

Originally created by @GovinduSasanka on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3436 `scripts/hopper-demo-x11.py` (`authorize_display`) runs `xauth -f <authority> add :N . <cookie>`, so the MIT-MAGIC-COOKIE is readable by other local users through `/proc/<pid>/cmdline` while xauth runs. Xvfb is started with `-nolisten tcp -auth`, but its Unix socket under `/tmp/.X11-unix` accepts connections from anyone. A local user who catches the cookie can view or inject input into the private Hopper display. **Expected:** pass the command on stdin (`xauth -q -f <authority> source -`), so the cookie never appears in argv. Reviewed at fa4b828. A PR follows.

bsakaguchi referenced this issue

2026-10-17 21:09:56 +00:00

[PR #1278] [MERGED] docs(ghidra): explain supported heap and CPU controls #2760

bsakaguchi referenced this issue

2026-10-17 21:09:58 +00:00

[PR #1281] [MERGED] fix(ci): pass selected environment to Windows Ghidra fixture #2763

bsakaguchi closed this issue

2026-10-31 00:30:25 +00:00