~bhyvxe/xblade -
xblade is a fork of xlibre with refinements to XNamespaces and other dynamic solutions for stability enhancements. -
sourcehut git
~bhyvxe/xblade
summary
tree
log
refs
xblade is a fork of xlibre with refinements to XNamespaces and other dynamic solutions for stability enhancements.
b224b8ed
spidervixn
35 minutes ago
THE HOOKS: neither of them were going through hook-resource.c,
fcc33e77
spidervixn
an hour ago
README: philosophical addendum to fork explanation
34eb107b
vi
3 hours ago
README: document how namespace isolation enables a server-hosted forward model
refs
main
browse
log
clone
read-only<br>https://git.sr.ht/~bhyvxe/xblade<br>read/write<br>git@git.sr.ht:~bhyvxe/xblade
Clone repo to your account
You can also use your local clone with<br>git send-email.
```<br>xblade
xblade is a display server for X11 forked from xlibre (itself forked<br>from xorg). the upstream tree is the community xlibre server with the<br>nvidia teardriver handling, tearfree modesetting, and the Xnamespace<br>extension for separating clients. on top of that this tree carries a<br>set of fixes and changes that make the thing actually work as a daily<br>desktop and, where the design allows, go past both xorg and xlibre.
why this exists
the fork exists because the base servers leave two problems on the<br>floor: input that is silent when it breaks, and isolation that is<br>opt-in and then fights the desktop it is supposed to protect. xblade<br>treats both as boot-time obligations, not options.
the work behind isolation-by-default has a name older than this<br>codebase: labor that keeps a system honest at its edges gets counted<br>as overhead, not engineering, and gets left off the roadmap because<br>it isn't a new feature. the lifestyle is more mundane. the boot guard,<br>the socket probe, the pixel read barrier, none of them add capability.<br>all of them are the difference between refusal being the default state<br>and refusal being something you have to fight to configure.
that difference is the boundary between this project and its predecessors.
the changes
* default input actually works. the live break was the server user<br>lacking the input group, so libinput could not open /dev/input/event*<br>and every device failed with "Permission denied" while the desktop<br>booted looking fine and dead. xblade does not paper over this: it<br>fails fast so it can never sit silent with a dead keyboard.<br>* boot guard. config/udev.c counts successfully registered input<br>devices during the initial scan; if that number is zero the server<br>refuses to boot with a message that names the cause (missing input<br>group membership on /dev/input/event*). no more diagnosing a<br>keyboard that quietly does nothing.
* namespace isolation on by default. the Xnamespace extension is<br>enabled at boot and generates /etc/X11/ns.conf on first run: a root<br>namespace (superpower) and an untrusted sandbox, each bound to its<br>own random MIT-MAGIC-COOKIE-1. launch a client with a separate<br>XAUTHORITY and it lands isolated. -nonamespace turns it all off.
* input is decoupled from superpower. upstream treated "using the<br>keyboard/pointer" as a superpower-only privilege, so the default<br>(anonymous) namespace could not even register for XI2 events and<br>typing died. hook-device.c now gates XInput on the allowXInput flag,<br>and the anonymous namespace gets baseline input while staying<br>non-superpower. isolation no longer means unusable.
* per-phase boot timing. dix/main.c logs one scalar per boot phase<br>(output / extensions / screens / input) in seconds plus a cumulative<br>total, so boot is a number you can diff across servers and kernels<br>instead of a guess. the log is never silent-empty.
* module fallback survives the rename. the loader tries xblade-25,<br>then xlibre-25.0, then xlibre-25, then unversioned, so the existing<br>libinput/nvidia/modesetting modules keep loading after the identity<br>change. you do not rebuild every driver to switch servers.
where this passes xorg
xorg has none of the isolation layer and a removable-input failure<br>mode that boots quiet, so xlibre inherits that by default.<br>xblade makes a no-input boot an immediate error, and makes per-client<br>isolation a shipped default instead of a lego set.<br>the total boot here is about 1.28 seconds on this machine and<br>dominated by the real (now succeeding) device init, which<br>is the next thing on the bench.
namespace isolation and x11 forwarding
classic x11 forwarding (ssh -X / -Y) is untrusted because a remote app<br>joins the SAME authority as your local apps: it can read your screen<br>and, via XTEST/grab, inject input into every window. that single<br>shared authority is why we get the -X/-Y split and why -Y is unsafe.<br>xblade hosts the isolation on the SERVER instead. a client lands in a<br>namespace whose virtual root is its own logical session, and per-client<br>pixel isolation means a non-owner can never GetImage another client's<br>window or pixmap (copy-bypass included) - wayland-parity-plus, enforced<br>server-side. an untrusted/forwarded client therefore...