Re: [qubes-devel] feature request, copy / paste / type. is this feasible?

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Aug 11, 2017 at 03:08:45AM -0700, pixel fairy wrote:
> sometimes, copy paste isnt enough, esp for keyboards, because not all apps
> use them. usually you cant copy / paste into remote desktops like rdp or
> vnc unless that app has its own clipboard sharing mechanism. while one
> could simple view their keepass file and type, this has two problems.
>
>
> - shoulder surfing
> - keyboard timing attacks
>
> before qubes, when i ran vmware/virtualbox with packer and ansible, i would
> use xsel to copy and xdotool to create keyboard events on the receiving vm.
> is there a way to do this with qrexec or the input proxy? could this be
> added, perhaps as ctrl-shift-t?

xsel + xdotool combo should work in the VM after ctrl-shift-v. But it
should be used carefully, because when you request "paste" operation in
application, it have clear separation between data and commands. But when
you type the same thing, application have hard time distinguishing those
things. Consider for example pasting something into VIM - if there will
be ESC char inside, part of the data will be interpreted as commands.
Limiting allowed character set to printable ASCII solve most of those
problems, but also breaks diacritics (like ą or ł in polish). Another
problem is possibly different keyboard layout - you need to take care of
it while typing text...

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZjYlAAAoJENuP0xzK19csZwwIAJXZ4FJY5tB78kvfEeD2IgV/
YaavAmAR4IN7ghMsq+n1Bwm64r8eabCmrKIlULcjKxlcJgcNOE6kC3cv09xv/cO0
e8b5boDVfOcO2EAWqkbGOW1Zbvukr4cfoLbNHbM9PwMWh7fvpKQIpwYOmziieXwa
Bv8YLuHQCY/ELTtIW7nvd9566k43LEabYuw5nHL99g7Gi85WEHBOYpcsiOtR26Om
nVdwXLqtnAaOke4qg50RVHCNFsKyTwtWEUI0WxA7hWfXvqNh1CjPi1ISGRCH6DnB
XPLQPybj8wGI0kbqtpKJIJNCsg4zdRJ/IQFCxO7mDE8QdQldokxLhUaA6pM1N1M=
=zREK
-----END PGP SIGNATURE-----

[pixel fairy]

On Friday, August 11, 2017 at 3:39:01 AM UTC-7, Marek Marczykowski-Górecki wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Aug 11, 2017 at 03:08:45AM -0700, pixel fairy wrote:
> sometimes, copy paste isnt enough, esp for keyboards, because not all apps
> use them. usually you cant copy / paste into remote desktops like rdp or
> vnc unless that app has its own clipboard sharing mechanism. while one
> could simple view their keepass file and type, this has two problems.
>
>
>    - shoulder surfing
>    - keyboard timing attacks
>
> before qubes, when i ran vmware/virtualbox with packer and ansible, i would
> use xsel to copy and xdotool to create keyboard events on the receiving vm.
> is there a way to do this with qrexec or the input proxy? could this be
> added, perhaps as ctrl-shift-t?

xsel + xdotool combo should work in the VM after ctrl-shift-v. But it
should be used carefully, because when you request "paste" operation in
application, it have clear separation between data and commands. But when
you type the same thing, application have hard time distinguishing those
things. Consider for example pasting something into VIM - if there will
be ESC char inside, part of the data will be interpreted as commands.
Limiting allowed character set to printable ASCII solve most of those
problems, but also breaks diacritics (like ą or ł in polish). Another
problem is possibly different keyboard layout - you need to take care of
it while typing text...

:) i deleted and reposted this mentioning keyboard layout problems.

also, with xdotool you need the target window. when your doing it over ssh from a different vm, you can simply target the selected window. in qubes, i wasnt able to get a window id to target. just tried "sleep 5 && xdotool type" and then focusing the target window, which did work.

is the qubes copy/paste limited to ascii? i thought it was unicode.

there is another reason id like to be able to type into a VM, but its a corner case ive seen twice. sometimes the gui can hide keyboard events from other apps, but not the clipboard. os x does it, but its hard to use unless the app specifically allows for this, and wayland when xwayland is enabled thanks to a design flaw in that. i doubt os x will ever become a supported appvm, but wayland is inevitable. a future version of windows may also become like this. for now we have more reason to make different appvms to isolate all those gui apps.

[Marek Marczykowski-Górecki]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

If you need to get window ID inside VM, from outside (dom0), take a look
at _QUBES_VMWINDOWID window property (xprop).

> is the qubes copy/paste limited to ascii? i thought it was unicode.

Yes, it allow arbitrary data (but in practice linux agent and X server
limit this to unicode). Which can be dangerous when you use type instead
of paste.

> there is another reason id like to be able to type into a VM, but its a
> corner case ive seen twice. sometimes the gui can hide keyboard events from
> other apps, but not the clipboard. os x does it, but its hard to use unless
> the app specifically allows for this, and wayland when xwayland is enabled
> thanks to a design flaw in that. i doubt os x will ever become a supported
> appvm, but wayland is inevitable. a future version of windows may also
> become like this. for now we have more reason to make different appvms to
> isolate all those gui apps.

I wouldn't count on _meaningful_ GUI isolation in any mainstream OS in
the near future... There are improvements, but - as you noted already -
there is still way more to do there.

- --
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJZjZIRAAoJENuP0xzK19csRAoH/iEz5Eujq6PPMBY0Bb7O50HI
ixqFEbbJAvfnR0s6tKH8kYX4Z9JwdQauiErbNANCiszKzJWnh/HnQaiqjI7UY9Xs
dYUORunjlRFMxWlTvmZDVXZdTSMYtgjAqRGBapMRmYzy56/qB4ScVcOYpDW2FhGi
uiBRDKqhtcLoGQ5dQF9enC5Sm6zOu214otponNZnd1t+/i9gnP00qY9Rb2JEu6UL
0ifX65AK0bNpZErla09rISsLzA8/qB823r3IcsSyhPK/pUFtp8Zd7k+lSg5SaQ1Y
JvhpXSKjkMXBTHrje0suuoyAeq5gSwN3QEsv/g05cx8URfxOslNSucK5YtwA5Ds=
=uE/r
-----END PGP SIGNATURE-----

[pixel fairy]

On Friday, August 11, 2017 at 4:16:38 AM UTC-7, Marek Marczykowski-Górecki wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Fri, Aug 11, 2017 at 04:08:53AM -0700, pixel fairy wrote:
>
> there is another reason id like to be able to type into a VM, but its a
> corner case ive seen twice. sometimes the gui can hide keyboard events from
> other apps, but not the clipboard. os x does it, but its hard to use unless
> the app specifically allows for this, and wayland when xwayland is enabled
> thanks to a design flaw in that. i doubt os x will ever become a supported
> appvm, but wayland is inevitable. a future version of windows may also
> become like this. for now we have more reason to make different appvms to
> isolate all those gui apps.

I wouldn't count on _meaningful_ GUI isolation in any mainstream OS in
the near future... There are improvements, but - as you noted already -
there is still way more to do there.

wayland has the right intentions. it isolates screen, clipboard, and input (mouse, keyboard etc)

so im skeptically hopeful for this one. its far better than any other design i've seen. 

but, all it took was one misdesigned plugin, and desktops that rely on its functionality (gnome), 

and not only does the clipboard isolation go out the window, the rest of wayland prevents something like 

keepassx from getting around that by typing into the receiving app. you would have to build keepassx 

into your compositor to get around that. (or send keystrokes to the vm)

just thought about xdotool from dom0 to make it transparent to the receiving end. thats scary close

to the trusted base, but perhaps a tool like this could be made in the future.