Как устроен захват экрана в x11?

--- Xext/security.c.orig	2016-07-19
+++ Xext/security.c	2019-08-12
@@ -41,6 +41,10 @@
 #include "extinit.h"
 #include "protocol-versions.h"
 
+#define IsWManager(pCl) (((pCl)->clientPtr != NULL) && \
+	(EventMaskForClient(GetCurrentRootWindow((pCl)->clientPtr), (pCl)) \
+	& (SubstructureRedirectMask | ResizeRedirectMask)))
+
 /* Extension stuff */
 static int SecurityErrorBase;   /* first Security error number */
 static int SecurityEventBase;   /* first Security event number */
@@ -61,6 +65,7 @@
     unsigned int live       :1;
     unsigned int trustLevel :2;
     XID authId;
+	XID group;
 } SecurityStateRec;
 
 /* Extensions that untrusted clients shouldn't have access to */
@@ -117,9 +122,14 @@
 SecurityDoCheck(SecurityStateRec * subj, SecurityStateRec * obj,
                 Mask requested, Mask allowed)
 {
+	unsigned int subjTrust = subj->trustLevel;
+
+	if (obj->group != None && subj->group != obj->group)
+		subjTrust = XSecurityClientUntrusted;
+
     if (!subj->haveState || !obj->haveState)
         return Success;
-    if (subj->trustLevel == XSecurityClientTrusted)
+    if (subjTrust == XSecurityClientTrusted)
         return Success;
     if (obj->trustLevel != XSecurityClientTrusted)
         return Success;
@@ -142,6 +152,7 @@
     state->trustLevel = XSecurityClientTrusted;
     state->haveState = TRUE;
     state->live = FALSE;
+    state->group = None;
 }
 
 /*
@@ -770,6 +781,8 @@
             allowed |= DixReadAccess;
     }
 
+	if (IsWManager(rec->client)) allowed = requested;
+
     if (clients[cid] != NULL) {
         obj = dixLookupPrivate(&clients[cid]->devPrivates, stateKey);
         if (SecurityDoCheck(subj, obj, requested, allowed) == Success)
@@ -836,6 +849,8 @@
     subj = dixLookupPrivate(&rec->client->devPrivates, stateKey);
     obj = dixLookupPrivate(&rec->target->devPrivates, stateKey);
 
+	if (IsWManager(rec->client)) allowed = requested;
+
     if (SecurityDoCheck(subj, obj, requested, allowed) != Success) {
         SecurityAudit("Security: denied client %d access to client %d on "
                       "request %s\n", rec->client->index, rec->target->index,
@@ -856,6 +871,8 @@
     subj = dixLookupPrivate(&rec->client->devPrivates, stateKey);
     obj = dixLookupPrivate(&wClient(rec->pWin)->devPrivates, stateKey);
 
+	if (IsWManager(rec->client)) allowed = requested;
+
     if (SecurityDoCheck(subj, obj, requested, allowed) != Success) {
         SecurityAudit("Security: denied client %d access to property %s "
                       "(atom 0x%x) window 0x%lx of client %d on request %s\n",
@@ -878,6 +895,8 @@
         subj = dixLookupPrivate(&rec->client->devPrivates, stateKey);
         obj = dixLookupPrivate(&wClient(rec->pWin)->devPrivates, stateKey);
 
+		if (IsWManager(rec->client)) return;
+
         if (SecurityDoCheck(subj, obj, DixSendAccess, 0) == Success)
             return;
 
@@ -907,6 +926,8 @@
     subj = dixLookupPrivate(&rec->client->devPrivates, stateKey);
     obj = dixLookupPrivate(&wClient(rec->pWin)->devPrivates, stateKey);
 
+	if (IsWManager(rec->client)) return;
+
     if (SecurityDoCheck(subj, obj, DixReceiveAccess, 0) == Success)
         return;
 
@@ -970,6 +991,7 @@
                 TimerCancel(pAuth->timer);
 
             state->trustLevel = pAuth->trustLevel;
+			state->group = pAuth->group;
         }
         break;

--- Xext/xace.c.orig	2016-07-19
+++ Xext/xace.c	2019-08-12
@@ -24,6 +24,7 @@
 #include <stdarg.h>
 #include "scrnintstr.h"
 #include "extnsionst.h"
+#include "windowstr.h"
 #include "pixmapstr.h"
 #include "regionstr.h"
 #include "gcstruct.h"
@@ -264,6 +265,40 @@
 
     /* censorRegion = imageRegion - visibleRegion */
     RegionSubtract(&censorRegion, &imageRegion, pVisibleRegion);
+
+	/* process secured windows */
+	if (pDraw->type == DRAWABLE_WINDOW && ((WindowPtr)pDraw)->parent == NULL)
+	{
+		WindowPtr pTemp, pWin;
+		BoxPtr pBoxVR = RegionExtents(pVisibleRegion);
+		pTemp = pDraw->pScreen->root;
+		while (1)
+		{
+			if ((pWin = pTemp->firstChild) == NULL &&
+				(pWin = pTemp->nextSib) == NULL)
+				while (pTemp->parent != NULL &&
+						(pWin = pTemp->parent->nextSib) == NULL)
+					pTemp = pTemp->parent;
+			if (pWin == NULL)
+				break;
+			pTemp = pWin;
+
+			if ((pWin->visibility == VisibilityUnobscured ||
+				pWin->visibility == VisibilityPartiallyObscured) &&
+				(XaceHook(XACE_RESOURCE_ACCESS, client, pWin->drawable.id, RT_WINDOW,
+					pWin, RT_NONE, NULL, DixUseAccess) != Success))
+			{
+				RegionPtr pRegWin = RegionCreate(NullBox, 1);
+				RegionCopy(pRegWin, &pWin->clipList);
+				/* need more investigation... xex */
+				if (pBoxVR->x1 < x)
+					RegionTranslate(pRegWin, pBoxVR->x1 - x, 0);
+				RegionUnion(&censorRegion, &censorRegion, pRegWin);
+				RegionDestroy(pRegWin);
+			}
+		}
+	}
+
     nRects = RegionNumRects(&censorRegion);
     if (nRects > 0) {           /* we have something to censor */
         GCPtr pScratchGC = NULL;

--- dix/dispatch.c.orig	2016-07-19
+++ dix/dispatch.c	2019-08-12
@@ -1668,6 +1668,67 @@
     else
         pSrc = pDst;
 
+	if (pSrc->type == DRAWABLE_WINDOW && ((WindowPtr)pSrc)->parent == NULL)
+	{
+		long widthBytesLine, linesPerBuf, nlines, height, width, srcX, srcY,
+			dstX, dstY, length;
+		char *pBuf;
+		PixmapPtr pPix;
+		RegionPtr pRgnCopy, pVisibleRegion;
+		height = stuff->height, width = stuff->width, srcX = stuff->srcX,
+			srcY= stuff->srcY, dstX = stuff->dstX, dstY = stuff->dstY;
+		pVisibleRegion = NotClippedByChildren((WindowPtr)pSrc);
+		if (pVisibleRegion)
+			RegionTranslate(pVisibleRegion, -pSrc->x, -pSrc->y);
+
+		widthBytesLine = PixmapBytePad(width, pSrc->depth);
+		if (widthBytesLine == 0 || height == 0)
+			linesPerBuf = 0;
+		else if (widthBytesLine >= IMAGE_BUFSIZE)
+			linesPerBuf = 1;
+		else
+		{
+			linesPerBuf = IMAGE_BUFSIZE / widthBytesLine;
+			if (linesPerBuf > height)
+				linesPerBuf = height;
+		}
+		length = linesPerBuf * widthBytesLine;
+		if (linesPerBuf < height)
+		{
+			while ((linesPerBuf > 1) &&
+				(length & ((1L << LOG2_BYTES_PER_SCANLINE_PAD) - 1)))
+			{
+				linesPerBuf--;
+				length -= widthBytesLine;
+			}
+			while (length & ((1L << LOG2_BYTES_PER_SCANLINE_PAD) - 1))
+			{
+				linesPerBuf++;
+				length += widthBytesLine;
+			}
+		}
+		pBuf = calloc(1, length);
+
+		for (long linesDone = 0; height - linesDone > 0; linesDone += nlines)
+		{
+			nlines = min(linesPerBuf, height - linesDone);
+			(pSrc->pScreen->GetImage) (pSrc, srcX, srcY + linesDone, width,
+				nlines, ZPixmap, ((unsigned long)~0L), (void*)pBuf);
+			if (pVisibleRegion)
+				XaceCensorImage(client, pVisibleRegion, widthBytesLine, pSrc,
+					srcX, srcY + linesDone, width, nlines, ZPixmap, pBuf);
+			pPix = GetScratchPixmapHeader(pSrc->pScreen, width, nlines,
+				pSrc->depth, pSrc->bitsPerPixel, widthBytesLine, (void *)pBuf);
+			pRgnCopy = (*pGC->ops->CopyArea) (&pPix->drawable, pDst, pGC, 0, 0,
+				width, nlines, dstX, dstY + linesDone);
+			if(pRgnCopy)
+				RegionDestroy(pRgnCopy);
+			FreeScratchPixmapHeader(pPix);
+		}
+
+		free(pBuf);
+	}
+	else
     pRgn = (*pGC->ops->CopyArea) (pSrc, pDst, pGC, stuff->srcX, stuff->srcY,
                                   stuff->width, stuff->height,
                                   stuff->dstX, stuff->dstY);

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <X11/Xlib.h>
#include <X11/extensions/security.h>
#include <xcb/xcb.h>
#include <iconv.h>

#define PROTO "MIT-MAGIC-COOKIE-1"
#define HELLO "Цой жив!"

int main(int argc, char* argv[])
{
	Display *dpy = XOpenDisplay(NULL);

	int maj, mi;
	if (!XSecurityQueryExtension(dpy, &maj, &mi))
	{
		fprintf(stderr, "Couldn't query Security extension\n");
		return 2;
	}

	Xauth *xin = XSecurityAllocXauth();
	xin->name = PROTO;
	xin->name_length = strlen(PROTO);
	xin->data = HELLO;
	xin->data_length = strlen(HELLO);
	
	XSecurityAuthorizationAttributes xsat = {600, XSecurityClientTrusted, 14};
	XSecurityAuthorization ret;
	Xauth *xout = XSecurityGenerateAuthorization(dpy, xin,
		XSecurityTimeout | XSecurityTrustLevel | XSecurityGroup, &xsat, &ret);

	xcb_auth_info_t auth = {.name = xout->name, .namelen = xout->name_length,
		.data = xout->data, .datalen = xout->data_length};

	xcb_connection_t *connec = xcb_connect_to_display_with_auth_info(NULL, &auth, NULL);
	xcb_screen_t *screen = xcb_setup_roots_iterator(xcb_get_setup(connec)).data;
	XSecurityFreeXauth(xin);
	XSecurityFreeXauth(xout);
	XCloseDisplay(dpy);

	xcb_drawable_t window = xcb_generate_id(connec);
	xcb_create_window(connec, XCB_COPY_FROM_PARENT, window, screen->root,
		0, 0, 200, 100, 0, XCB_WINDOW_CLASS_INPUT_OUTPUT,
		screen->root_visual, XCB_CW_BACK_PIXEL | XCB_CW_EVENT_MASK,
		(uint32_t[]){screen->white_pixel, XCB_EVENT_MASK_EXPOSURE});
	xcb_map_window(connec, window);

	char font_name[] = "-*-fixed-medium-r-normal--18-*-iso10646-1";
	xcb_font_t font = xcb_generate_id(connec);
	xcb_open_font(connec, font, strlen(font_name), font_name);

	xcb_gcontext_t gc = xcb_generate_id(connec);
	xcb_create_gc(connec, gc, window,
		XCB_GC_FOREGROUND | XCB_GC_BACKGROUND | XCB_GC_FONT,
		(uint32_t[]){screen->black_pixel, screen->white_pixel, font});

	iconv_t cd = iconv_open("UCS-2BE", "UTF-8");
	size_t sz = strlen(HELLO), szout = sz * sizeof(xcb_char2b_t), szlen = szout;
	char *temp = HELLO;
	xcb_char2b_t *buffer = calloc(sz + 1, sizeof(xcb_char2b_t)), *bout = buffer;
	iconv(cd, &temp, &sz, (char**)&bout, &szout);
	iconv_close(cd);
	szlen -= szout, szlen /= sizeof(xcb_char2b_t);

	xcb_query_text_extents_cookie_t ecook = xcb_query_text_extents(connec,
		gc, szlen, buffer);
	xcb_query_text_extents_reply_t *ext = xcb_query_text_extents_reply(connec,
		ecook, NULL);

	xcb_flush(connec);

	xcb_generic_event_t *event = 0;
	xcb_get_geometry_cookie_t gcook;
	xcb_get_geometry_reply_t *geom;
	while (free(event), event = xcb_wait_for_event(connec))
	{
		switch (event->response_type & ~0x80)
		{
			case XCB_EXPOSE:
			gcook = xcb_get_geometry(connec, window);
			geom  = xcb_get_geometry_reply(connec, gcook, NULL);
			xcb_image_text_16(connec, szlen, window, gc,
				(geom->width - ext->overall_width) / 2,
				(geom->height - ext->font_descent + ext->font_ascent) / 2, buffer);
			free(geom);
			xcb_flush(connec);
			break;
		}
	}
	return 0;
}

-> apt-cache search XSelinux | grep ".*" || echo "FAIL"
FAIL

xdpyinfo -display :0 -queryExtensions