Xterm does not allow isolation unless you set it to run as another user, in another tty. Gksu and Gksudo do not provide any sort of isolation at all. The same applies to all other password entry utilities, like kdesu/kdesudo, pinentry, etc. They are regular windows, like any others.
Wayland supports isolating Windows, but only for applications which support the protocol, which Truecrypt does not. All programs which do not support Wayland fall back to the legacy X11 protocol, which Wayland supports as a fallback, but which it cannot provide any window isolation for. As a result, using it with a bunch of legacy applications does not provide you with extra security, and your Truecrypt password can still be snooped.
There are two viable solutions I can think of:
- Open a new Xorg session in a new tty as a new user, and open Truecrypt there.
- Go into a tty without Xorg running, log in as root, and mount Truecrypt using command line.
Note that unless you are very careful, a determined attacker can almost always gain such a password if they have access to your regular user. For example, if you ever use sudo or su to get root, they can keylog that. If you do not do it in an X session, they can still hijack it using functions, aliases, LD_PRELOAD on your shell, etc. If you are ever root and you use su to lower yourself to your regular user, then root can be hijacked with a tty pushback attack. If you try to switch to a different tty to log in as root so your possibly compromised regular user can't sniff your Truecrypt password as you enter it as root or a safe user, you might actually be presented with a fake login console where you give it your root password, instead of agetty (or logind). The only way to mitigate that is by remembering to use the SAK combo every single time you switch to a new tty to log in as root. So you see, there are a lot of things you will have to remember, and you only have to slip up once for a determined attacker who has access to your regular user to grab your Truecrypt password.
My personal security procedures are very robust but can be a bit tiring if you are very GUI-oriented. I do almost everything in the terminal, without using Xorg. I use grsecurity with RBAC to isolate individual programs so they cannot mess with my $HOME or any configuration files if they get hijacked, I always use SAK when switching to a different tty to log in, and when I do need to use Xorg, I only keep one or two programs open at a time. I only ever need to use a browser, a few video games I run under Wine, and Gimp for photo editing. Xorg runs under a different user. This may seem excessive, but it's pretty much the minimum that assures that, if my regular user is compromised, then nothing short of me slipping up and forgetting to use SAK or using su to get root instead of logging in as root in a new tty, or a kernel 0day will be able to initiate keylogging to get something like my encryption key.
