I was told that one of the core benefits of Wayland is that it prevents applications from snooping each other, such as by recording the contents of windows that don’t belong to them or logging keystrokes that don’t belong to them. But the program wf-recorder can record my entire screen without root! Doesn’t that mean any rogue application could do the same thing?
screen recording of wlroots-based compositors (more specifically, those that support wlr-screencopy-v1 and xdg-output)
It’s a “custom” protocol provided by your compositor, that’s not part of Wayland itself. Just like technically, you could have your graphics driver provide an API for capturing all screen output.
As for the security implications, i’m not entirely sure (not familiar with that stack). I assume you can only capture from your own user, and that there’s settings to disable that capability. It still means yes, that a malicious application could record your session and submit it to a 3rd party, which is why:
-
we should use only free software, compiled by trusted third-parties (distro packages or Nix/guix)
-
you should probably setup an applicative firewall like OpenSnitch to make it harder for malware to extract stuff out of your computer (though not impossible, because once you have a shell on the machine root is usually not far away)
-
