ferrokey

Ferrokey: A Novel On-Screen Keyboard Solution

Ferrokey is an innovative on-screen keyboard (OSK) designed to maintain the focused state of target applications while ensuring seamless input interaction. Unlike traditional OSKs that take over keyboard focus, Ferrokey injects key events at the kernel level using /dev/uinput, thus preserving the application’s keyboard focus throughout the user’s interaction. This approach eliminates common issues such as focus-grab races and the need for the target application to regain focus after each keystroke.

Key Features

• Kernel-Level Event Injection: Utilizes a unique method where key events interact with the Linux input core as if they were coming from a physical keyboard, allowing focused applications to receive input without losing focus.
• Unprivileged UI: Built with Slint, the Ferrokey interface is designed to operate unprivileged, providing enhanced security and simplicity.
• Constrained Broker: The ferrokeyd daemon is a non-root, constrained broker that operates with strict security measures, including zero capabilities and an allowlist for operations, ensuring a secure interaction layer.
• Support for Multiple Backends: Designed to detect surface backends at runtime, it supports both Wayland and X11, adapting its behavior to each environment’s requirements.
• Enhanced Key Management: Hosts a pure state machine for managing keyboard actions, which includes features like modifiers, repeat, layouts, and a dead-key/compose engine for complex character input.
• Flexible Keyboard Views: Allows users to switch between different keyboard layouts (e.g., compact and full) without affecting the underlying key state machine.
• Robust Testing and Security Measures: Automated testing environments and thorough security audits ensure that the keyboard operates reliably and securely, mitigating various attack vectors.

Architecture Overview

The architecture of Ferrokey comprises several key components:

                 ┌──────────────────────────────┐
                 │  ferrokey (unprivileged UI)  │
                 │  Slint + ferrokey-surface    │
                 └──────────────┬───────────────┘
                                │ FK01 v2 binary protocol (AF_UNIX, SO_PEERCRED, rate-limited)
                 ┌──────────────▼───────────────┐
                 │  ferrokeyd serve (constrained│
                 │  broker: non-root, zero caps,│
                 │  NO_NEW_PRIVS, seccomp,      │
                 │  no core dumps, non-dumpable)│
                 └──────────────┬───────────────┘
                                │ EV_KEY writes to the ONE pre-created virtual keyboard (fd adopted from the bootstrap, ferrokeyd init)
                 ┌──────────────▼───────────────┐
                 │  Linux input core (uinput)   │
                 └──────────────┬───────────────┘
                                ▼
                 focused application keeps focus

Additional Considerations

• Touch and Pen Input: Supports touchscreen and pen input, allowing for first-class interaction on touch enabled devices.
• Hostile-Input Resistance: The protocol decoder is fuzzed, ensuring that malicious input is handled effectively.
• Comprehensive Testing Suites: Extensive testing in controlled environments to validate the integrity and security of the application.

Ferrokey exemplifies a modern approach to on-screen keyboards, focusing on preserving application interaction fidelity while providing a user-friendly, secure, and efficient input method.