Arch Linux

moy0

Member

Registered: 2021-02-16

Posts: 23

[Unsolved upstream] firejail and --x11=xorg

1 (works). If I run an application as follows

firejail --x11 firefox

then firejail uses xpra and runs firefox successfully.

2 (fails). But xpra is a bit heavy-weight and for some applications I'd like to use X11's untrusted mode instead. If I try:

firejail --x11=xorg firefox

I get

Authorization required, but no authorization protocol specified
/run/firejail/mnt/xauth: (argv):1:  unable to open display ":0.0".

3 (fails).I tried adding my local user on all DISPLAYs with

xhost +si:localuser:moy0

but (a) I'm not sure if this is secure, and (b) the firejail command fails anyway with:

[195 12:13:09.406592] [glfw error 65544]: X11: Failed to load Xkb extension
GLFW initialization failed

So two questions: first, does --x11=xorg give secure sandboxing? Second, how do I run it?

Also, FYI, I don't use a display-manager, I just log in on a tty and startx.

Last edited by moy0 (2023-08-02 13:40:28)

moy0

Member

Registered: 2021-02-16

Posts: 23

Re: [Unsolved upstream] firejail and --x11=xorg

Update: this is an old, known, and apparently unsolved issue :-(.

xerxes_

Member

Registered: 2018-04-29

Posts: 1,065

Re: [Unsolved upstream] firejail and --x11=xorg

Did you tried xephyr? It seems to be more lightweight. You may try like this:

firejail --x11=xephyr --xephyr-screen=WIDTHxHEIGHT firefox

moy0

Member

Registered: 2021-02-16

Posts: 23

Re: [Unsolved upstream] firejail and --x11=xorg

Thanks, xerxes_. Yes, I've tried xephyr. You're right that it's more lightweight, but it's also a lot more fiddly to get things like randr working, plus windows don't interact seamlessly with other windows on the desktop (of course this can also be a positive if you want clearer mental separation between the two X servers). Thanks again.

growler

Member

Registered: 2022-09-26

Posts: 25

Re: [Unsolved upstream] firejail and --x11=xorg

Thanks, xerxes_. Yes, I've tried xephyr. You're right that it's more lightweight, but it's also a lot more fiddly to get things like randr working, plus windows don't interact seamlessly with other windows on the desktop (of course this can also be a positive if you want clearer mental separation between the two X servers). Thanks again.

(Other)

Command:
sudo firecfg
The applications / packages that appear in the list will start in a sandbox - if you start them.
Control:
firejail --list
kill:
sudo firecfg --clean

moy0

Member

Registered: 2021-02-16

Posts: 23

Re: [Unsolved upstream] firejail and --x11=xorg

Command:
sudo firecfg
...

Thanks, growler, but FYI that doesn't solve the Xorg problem that we're talking about here.

Last edited by moy0 (2023-08-02 13:39:35)