Looks like it is easy to log keystrokes of all processes of the same user. A basic keylogger is 'xinput'.

xinput test-xi2

The command generates log of all key-presses. Unfortunately, this includes passwords in gnome-terminal. Googling suggested that grabbing keyboard may prevent other windows from capturing key strokes.

Is there a way to prevent XI2 logging in gnome-terminal? Or is there an X terminal that has this feature?


3 Answers 3


It's not possible as any keystrokes passed on to the X server, will be available for xinput/any arbitrary program. (In fact, it's part of the design). New display servers like Wayland and Mir are fixing such security problems in X. The only real solution would be to use Wayland or Mir instead of X. This blog post details this issue.

  • So input to gksu for password also goes to xinput?
    – yanychar
    Sep 24, 2013 at 18:11
  • 1
    @yanychar yup, actually I found out about this method of key logging through this blog post: theinvisiblethings.blogspot.in/2011/04/… (even I was surprised the first time I read the blog post) Sep 25, 2013 at 4:20
  • 3
    X11 actually has untrusted mode which you can use to prevent programs from accessing "bad" extensions - x.org/wiki/Development/Documentation/Security May 11, 2016 at 13:49
  • I found out this is incorrect: i3lock-color somehow prevents sniffing the password that is being typed via xi2.
    – L29Ah
    Sep 23, 2022 at 3:01

Not really. Even if you somehow manage to grab the keyboard within X (I don't know whether this is even possible, I doubt that), a keylogger utility running as root will always have access to the keyboard.

  • 4
    The command above grabs the keyboard within X without root privilege. So it is trivial to install a keylogger to an ubuntu desktop. The question is how to avoid this.
    – yanychar
    Jan 12, 2013 at 15:45

As others said here, it's not possible to protect only a program like gnome-terminal or other terminal from key logging, only if you restrict standard users to execute any key logger or if you stop/pause any key logger process.

Next I will show you how you can do these in case of xinput command, but the same methods can be used for any other key logger. If a key logger uses xinput command, it is not necessary to apply the method upon it as long as you apply it upon xinput.

1. Restrict standard users to use xinput command

You can restrict standard users to use xinput command using the following command:

sudo chmod go-x /usr/bin/xinput

2. Restrict standard users to use xinput command with test-xi2 argument

You can restrict standard users to use xinput command with test-xi2 argument by writing a wrapper for this command. To do this, go in terminal and follow the instructions below:

  • Get root privileges:

    sudo -i
  • Move xinput file in another directory which is not in any user's PATH (for example /opt):

    mv /usr/bin/xinput /new/path/to/xinput
  • Create your wrapper for xinput command in /usr/bin:

    gedit /usr/bin/xinput

    Add the following script inside:

    if [ "$@" != "${@/test-xi2/}" -a "$(whoami)" != "root" ]; then
        echo "`basename $0` $@: Permission denied"
        /new/path/to/xinput $@

    Save the file and close it.

  • Make the new wrapper executable:

    chmod +x /usr/bin/xinput

While first method is safety, using second method, the user may still circumvent it by calling the original xinput directly if he know its new location.

3. Stop/pause any xinput process

You can stop or pause any xinput process before to enter a password or anything else that you don't want to be logged. To do this, add the following bash function at the end of your ~/.bashrc file:

processof () {
    xinput_pids=" $(pidof $1) "
    if [ "$xinput_pids" = "  " ]; then
        echo "Nothing to stop/pause/continue. $1: no such process!"
    for pid in $xinput_pids; do
        case $2 in
            kill $pid
            echo "$1: stopped"
            kill -stop $pid
            echo "$1: paused"   
            kill -cont $pid
            echo "$1: continue"
            echo "$1 is runnig"

Now, after you reopen your terminal, anytime you want, using this function you can:

  • stop/kill all xinput processes:

    processof xinput stop
  • pause all xinput processes:

    processof xinput pause
  • resume all xinput processes:

    processof xinput continue

In fact, with this function you can stop/pause any process do you wish before to do something (such as entering the password):

processof [process_name] [stop|pause|continue]

If you don't know how to detect how to detect an active keylogger on your system, see:

These methods maybe are not the best solutions, but I hope to give you an idea about what you can do...

  • 5
    xinput is just an example of a keylogger. The question is about protecting input from every possible keylogger.
    – yanychar
    Sep 24, 2013 at 18:13
  • 5
    Any program can connect to the X server through sockets and keylog, it's not even required that the key logger uses an external program. Sep 25, 2013 at 4:21
  • 3
    @RaduRădeanu your solution is ineffective and useless. xinput isn't even SUID (-rwxr-xr-x 1 root root 48504 Aug 15 2012 /usr/bin/xinput) Sep 25, 2013 at 4:32
  • 1
    @RaduRădeanu Because you don't need xinput to keylog. (it doesn't need an external command nor does the malicious program need to be SUID) your solution will simply allow one to control the execution of xinput Sep 25, 2013 at 4:34
  • 3
    The most basic example to prove it ineffective: Copy a stock version of (ubuntu) xinput from a usb stick, download it from web or e-mail it to yourself and run it in your home folder. Same effect as using the unrestricted /usr/bin/xinput.
    – allo
    Apr 17, 2018 at 13:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .