[click0]

The three items 1.1.77 left open in TODO §7 (two MED, one LOW).

What changes

1. The X servers crate starts are sealed (MED).
Xvfb ran with -ac; Xephyr and Xorg had no -auth, which an X server reads as "every local client is welcome". Their sockets are in the host's /tmp/.X11-unix, so any local user or shared-mode jail could read another tenant's display.

• Each run makes a 16-byte MIT-MAGIC-COOKIE-1 and starts its server with -auth.
• The cookie goes into the jail as /var/run/crate-Xauthority (XAUTHORITY), to x11vnc, to the embedded VNC server and to crate gui screenshot.
• The shared X11 mode mounts a private directory holding only the socket of the display DISPLAY names, read-only. It used to mount the host's whole /tmp/.X11-unix read-write.
• websockify listens on gui/vnc_bind (loopback by default). It had no listen address and served noVNC on every interface. gui/vnc_bind is now accepted in every mode that can have a VNC server.

2. Wayland: a socket the compositor restricts (MED).
gui: auto / gui.mode: wayland bound the host compositor's own socket, privileged protocols included.

• crate asks the compositor for a security context (wp_security_context_v1) and mounts that restricted socket instead.
• No libwayland dependency: the exchange is seven requests and three kinds of events, written in lib/wayland_wire_pure and lib/wayland_security_context.
• New key gui/wayland_security_context: auto (default; falls back to the raw socket with a warning), require (restricted or no run), off (raw on purpose).
• crate doctor reports whether the compositor can do it; crate audit reports the restricted socket as a PASS.

3. Services and hooks see the jail's display (LOW).

• DISPLAY, XAUTHORITY, WAYLAND_DISPLAY and XDG_RUNTIME_DIR went on the main command's env(1) line only. JailExec now carries them on both exec paths.
• The exec_in_jail privops request gains optional fields lang, display, xauthority, wayland_display, xdg_runtime_dir. The names are fixed and the daemon checks each value's shape.
• Jail environment values are quoted on the sh -c line.

Behaviour changes to know about

• noVNC is on 127.0.0.1 unless gui/vnc_bind says otherwise.
• A client needs the cookie to open a headless / nested / gpu display.
• An x11 shared jail sees one socket, read-only; a host X server restart needs a jail restart.
• On sway 1.9+ / KWin 6 / Mutter 46+ a gui: auto / wayland jail loses layer-shell, screencopy, virtual input and data-control. A jail meant to have them sets gui/wayland_security_context: off.

How it was checked

Check	Result
Unit suite, -Werror	1668/1668
New wayland_security_context_test under ASan + UBSan	8/8
Generated cookie file against a real Xvfb	no cookie and wrong cookie refused; right cookie accepted, also from another host name
websockify listen argument	127.0.0.1:port listens on loopback only; bare port listens on every interface
Security context against sway 1.9 (headless)	restricted socket offers 29 of 44 globals; kill -9 of the owner stops new connections; nesting answered "not offered"

The new unit test drives the client against a stand-in compositor written in the test from the protocol text, including both passed file descriptors.

Not run on FreeBSD. Everything above is from Linux stand-ins. The on-hardware checks are in docs/on-hardware-validation.md §4t.

Left open (TODO §7)

• The shared X11 mode still gives the jail the host's trusted cookie (an untrusted XSECURITY cookie would be an opt-in).
• A compositor without the protocol still gets the raw socket by default; PipeWire / PulseAudio are one shared bus.
• GUI under a rootless crate: the GUI registry in root-owned /var/run/crate looks unreachable (plausible, needs hardware; found while doing this, not fixed here).
• The clipboard proxy runs jexec with crate's environment.

---

Generated by Claude Code