Detections
Analytics

2.1.22 Ensure Xwayland is not in use

Information

Xwayland is a compatibility X server that allows legacy X11 (Xorg) applications to run within a Wayland session by enabling the X11 protocol for the applications that use it. It is provided by the xorg-x11-server-Xwayland package and is started on demand by the Wayland compositor when an X11 client requests a display.

Xwayland reintroduces the X11 protocol. The X11 protocol provides no isolation between clients: any application connected to the X server can read another client's keystrokes, capture the contents of other windows, and inject synthetic input events. Removing Xwayland reduces the X11 attack surface and ensures all graphical applications run under the isolated Wayland protocol.

Solution

- Run the following command to confirm removal is limited to the xorg-x11-server-Xwayland package:

# dnf remove --assumeno xorg-x11-server-Xwayland

Only xorg-x11-server-Xwayland should be listed. To intentionally remove a graphical environment, remove the environment group (see the graphical user interface recommendation).

 - Run the following command to remove the xorg-x11-server-Xwayland package:

# dnf remove xorg-x11-server-Xwayland

Impact:

Legacy applications that rely on the X11 protocol will not run once Xwayland is removed. Where xorg-x11-server-Xwayland is a required dependency of the graphical environment, dnf remove does not remove it in isolation - it cascades to the display manager and the rest of the desktop stack (dozens of packages on a GNOME install), disabling the graphical user interface.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, 800-53|CM-11, CSCv7|9.2

Plugin: Unix

Control ID: d70640e298b672e7c1123cec68143d7f6b3f5898e331d3669a313f4641000c38