Bug 101345

Please provide the value of the environment variables WAYLAND_DISPLAY and XDG_RUNTIME_DIR on each of your simultaneous sessions when you observe application windows showing up on unexpected compositors.

Wayland clients use that variable to choose which compositor to connect to. If the variable is not set, a default address is used.

Do note, that the address is specific to your current user account. If the file permissions on your system are correct, no-one except root will be able to connect to another user's compositor.

If you are running all your separate sessions as the same user, nothing will prevent applications from opening on an arbitrary compositor of the same user.

I do not see any security issue so far.

FWIW, gnome-terminal uses a single client for all terminal windows, and running "gnome-terminal" will just, over D-Bus tell gnome-terminal-daemon to launch another window, and it'll use the Wayland display where it was first launched. So for that particular "issue" that is probably the cause. I suspect chromium works in a similar way.

(In reply to Jonas Ådahl from comment #2)
> FWIW, gnome-terminal uses a single client for all terminal windows, and
> running "gnome-terminal" will just, over D-Bus tell gnome-terminal-daemon to
> launch another window, and it'll use the Wayland display where it was first
> launched. So for that particular "issue" that is probably the cause. I
> suspect chromium works in a similar way.

It does, and it will print 'Creating new window in existing session' whilst doing so.

This is not a security issue: as a user, you have two processes (gnome-terminal-daemon and the 'gnome-terminal' wrapper binary you are running) which are allowed, per your local security policy, to communicate with each other. This is usually by D-Bus, but can be by UNIX sockets, or even ptrace.

If you want to ensure you cannot access one session from another, I would recommend running as a different user, so your permissions will prevent accessing the compositor socket, so they will not share UNIX sockets in your home directory, and so ptrace will also be cut off.

If the user can view an application on compositor A but receiving messages from compositor B is a security issue.
The compositor starts without root privileges and it may be easy to start a fake compositor created only to run a keylogger.
I remember that a sway application appeared on the gnome session but responded to the sway session messages.

In the coming days I will try to start multiple compositor on the same session.

(In reply to Daniele from comment #4)
> If the user can view an application on compositor A but receiving messages
> from compositor B is a security issue.

What is happening is: application A is connected to compositor A. Application B is connected to compositor B. Application A can send messages _directly_ to application A, without the need of any compositor.

This is what gnome-terminal (and Chrome, etc) do, the same as they do under X11. This has nothing to do with Wayland, but the design of the specific client applications you are trying to use.

> The compositor starts without root privileges and it may be easy to start a
> fake compositor created only to run a keylogger.

If this is true, then you control the environment your applications run in. If you control the environment your applications run in, then you can trace them and modify their execution directly: you don't even need to bother running a separate compositor.

This has nothing to do with Wayland, but you may be interested in things like SELinux for isolation.

I understand the problems you are describing, but this is really not a security issue introduced by Wayland. If you would like to have sessions isolated from each other, then run them as separate users, at which point you will never be able to connect to the other compositor (thanks to filesystem permissions) no matter how hard you try.