How does the DRI handle security issues ?
The DRI establishes a direct connection between the application and the graphics hardware. This potentially exposes the hardware to many client applications that could have security problems. Indirect rendering through the X Server allows a single process (the X Server) to control hardware access, thereby reducing the risk of an errant or malicious program locking up or mis-using the hardware. PI has carefully separated innocuous hardware operations from potentially hazardous operations, giving client programs access only to those operations that can be safely used. Access to the DRI is also limited to client applications that have the same priveleges necessary to control the X Server. This prevents untrusted users from accessing resources such as the memory space of potentially sensitive applications. Finally, PI has opted to keep as much code in the X Server as possible and to minimize the kernal code. This reduces the probability of software bugs crashing the kernel.
