Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

SteamOS bypasses Wayland's input isolation by granting uaccess to keyboards

Open
#2,823 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
linux
Domain
operating-systems, security

Research direction

Review /usr/lib/udev/rules.d/70-steamos-power-button.rules and 70-steam-jupiter-input.rules, then reproduce the report with evtest as an unprivileged user. Trace which keyboard devices receive uaccess and compare that with the intended Wayland input isolation. Done means the reported keyboards are no longer readable through /dev/input by unprivileged processes without breaking the relevant SteamOS input behavior.

Written by the indexing model from the issue text.

Description

Your system information
  • Steam client version: 1789781627
  • SteamOS version: SteamOS 3.9.1 Build: 20260914.100
  • Opted into Steam client beta?: Yes
  • Opted into SteamOS beta?: Yes
  • Have you checked for updates in Settings > System?: Yes
  • Device: Steam Deck LCD
Please describe your issue in as much detail as possible:

Expected behavior: Unprivileged users should not be able to read keyboard inputs through /dev/input. This is particularly important under Wayland because only focused foreground apps are expected to access the keyboard on Wayland sessions.
Actual behavior: Due to the way SteamOS grants uaccess via udev rules, many keyboards are exposed to unprivileged user processes. As far as I understand, this is caused by /usr/lib/udev/rules.d/70-steamos-power-button.rules for any Bluetooth or USB input device that is correctly or incorrectly labeled as a power button, which includes my Logitech K380s. Furthermore, there is another rule in /usr/lib/udev/rules.d/70-steam-jupiter-input.rules that grants uaccess to any USB device.

Steps for reproducing this issue:
  1. Switch to desktop mode.
  2. Connect a keyboard via Bluetooth or USB.
  3. Launch Konsole.
  4. Run evtest without sudo/root privileges.
  5. Select the device event number corresponding to the keyboard.
  6. Press any key on the keyboard to see the keystroke printed.
Dominant language
No language data
Stars
2.6k
Forks
83
Avg merge
4m
Merged PRs (30d)
3

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ValveSoftware/SteamOS

All issues in ValveSoftware/SteamOS

Similar issues

More Operating Systems issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.