After a lot of work, I believe I have an approximately beta-quality version of kloak-v2 ready for review and testing. The current state of the project is at GitHub - ArrayBolt3/kloak at arraybolt3/trixie. I ended up effectively rewriting the core source code because interfacing with Wayland ended up being a massive amount of work.
The main issue remaining with this version of the project is that the kloak binary runs as root (sandboxed, but root nonetheless), and interfaces directly with the Wayland compositor. The Wayland protocol is very complex, and I would not be surprised if there were vulnerabilities in libwayland-client that could result in kloak being compromised if it connects to a malicious compositor. Due to the inherently race-prone nature of detecting the “right” Wayland compositor and connecting to it, an attacker who can execute code on the local machine as a standard user could potentially spawn a malicious compositor, get kloak to connect to it, and then compromise it that way. Due to the sandbox, the attacker probably wouldn’t be able to do much if they succeeded at this attack (though sandbox escapes are a thing), but they would be able to view the stream of raw input events from the user’s devices and deanonymize them that way.
I have started some work in splitting kloak into two executables, a “core” that interacts with the input devices, and an “adapter” that talks to Wayland, in order to mitigate this. It might not be finished in time for the release of Whonix 18, but it should happen eventually.
@vmonaco If you’re interested, I’d really appreciate your review on the kloak rewrite.