#2022 Added user-defined mitigation from Mic-E-Mouse attacks

[GermanAizek]

Referer this issue: #2022

Subject links:

• https://arxiv.org/html/2509.13581v1
• https://cyberpress.org/new-mic-e-mouse-attack/
• https://sites.google.com/view/mic-e-mouse
• https://github.com/AICPS/Mic-E-Mouse

[cepelinas9000]

really sqrt? we should get away with dx^2+dy^2 < threshold^2

[GermanAizek]

really sqrt? we should get away with dx^2+dy^2 < threshold^2

Many thanks. Yep it is indeed possible to discard sqrt, such accuracy is not needed.

[cepelinas9000]

Sorry for @itz-me-zappex, i think this one should be combination with #1751 , to have single option something like :
Option InputProtection "keyboard, lowpass-mouse"

I don't know how it is complicated and is not directly tied for this problem (mitigate problem when driver slow, for example #1723 ), i think mouse update should be tied to monitor refresh rate (remember hardware cursor can be updated midscan).

I was thinking update algorithm with low pass filter like this: allow movement/update on screen twice during frame with small step (like second movement 2-3 ms timeout) - update last position of cursor only after timeout, maybe on next vblank start.

[metux]

@X11Libre/dev not sure yet whether this should be globally or tied to namespaces.

[itz-me-zappex]

Sorry for @itz-me-zappex, i think this one should be combination with #1751 , to have single option something like :
Option InputProtection "keyboard, lowpass-mouse"

No need to sorry, everything is fine. I don't have time right now, so I'll be back a "bit" later, to add log message to parsing of IsolateKeyboard at least.

[itz-me-zappex]

By the way, MicemouseProtection here is tunable, I doubt you can easily put both, it and IsolateKeyboard into single option, otherwise that will be kinda ugly, e.g. Option InputProtection "keyboard, lowpass-mouse=0.5".

UPD: Also, then it is needed to parse this combined value "somehow". Not worth it, especially looking at how this is done will other options available in xorg.conf.

P.S.: IMHO, MicEMouseProtection config key should look better than MicemouseProtection, just personal preference and that won't look like two words "mouse" in plural and single form respectively.

[tseli0s]

Inspired by the Linux kernel "mitigations" option, maybe this config style will be much cleaner and future-proof:

Section "Mitigations"
	Option "KeyboardIsolation" "true"
	Option "MiceMouseProtection" "true"
	Option "LowpassMouse" "0.5"
	# ...and so on
EndSection

Because if there are, say, 20 mitigations available in the future, I wouldn't like a huge string that I separate using commas and equal signs.

[cepelinas9000]

Inspired by the Linux kernel "mitigations" option, maybe this config style will be much cleaner and future-proof:

Section "Mitigations"
	Option "KeyboardIsolation" "true"
	Option "MiceMouseProtection" "true"
	Option "LowpassMouse" "0.5"
	# ...and so on
EndSection

Because if there are, say, 20 mitigations available in the future, I wouldn't like a huge string that I separate using commas and equal signs.

Then ok by me - leaving for config style.