[GH-ISSUE #2897] Firejail can't handle Xauthority correctly if it isn't in $HOME/.Xauthority #1812

New issue

Open

opened 2026-05-05 08:28:58 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:28:58 -06:00

Owner

Originally created by @Edu4rdSHL on GitHub (Aug 10, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2897

Firejail can't launch applications if the Xauthority file isn't in $HOME/.Xauthority, it happens for example when using sx (https://github.com/Earnestly/sx) instead of xinit that put Xauthority file under $HOME/.local/share/sx/xauthority (see https://github.com/Earnestly/sx/blob/master/sx#L30) but it works changing that line for export XAUTHORITY=${XAUTHORITY:-$HOME/.Xauthority}.

It ends in the following error:

sechacklabs@SecHackLabs ~> firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/globals.local
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/firefox-common.local
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Parent pid 6794, child pid 6795
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Post-exec seccomp protector enabled
Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @default-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,finit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,ioperm,iopl,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,userfaultfd,vhangup,vmsplice,
Child process initialized in 85.05 ms
No protocol specified
Unable to init server: Could not connect: Connection refused
Error: cannot open display: :1

Parent is shutting down, bye...
sechacklabs@SecHackLabs ~> echo $DISPLAY 
:1

Originally created by @Edu4rdSHL on GitHub (Aug 10, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2897 Firejail can't launch applications if the Xauthority file isn't in `$HOME/.Xauthority`, it happens for example when using `sx` (https://github.com/Earnestly/sx) instead of `xinit` that put Xauthority file under `$HOME/.local/share/sx/xauthority` (see https://github.com/Earnestly/sx/blob/master/sx#L30) but it works changing that line for `export XAUTHORITY=${XAUTHORITY:-$HOME/.Xauthority}`. It ends in the following error: ``` sechacklabs@SecHackLabs ~> firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/globals.local Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/firefox-common.local Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 6794, child pid 6795 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Post-exec seccomp protector enabled Seccomp list in: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice, check list: @default-keep, prelist: adjtimex,clock_adjtime,clock_settime,settimeofday,modify_ldt,lookup_dcookie,perf_event_open,process_vm_writev,delete_module,finit_module,init_module,_sysctl,afs_syscall,create_module,get_kernel_syms,getpmsg,putpmsg,query_module,security,sysfs,tuxcall,uselib,ustat,vserver,ioperm,iopl,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount2,userfaultfd,vhangup,vmsplice, Child process initialized in 85.05 ms No protocol specified Unable to init server: Could not connect: Connection refused Error: cannot open display: :1 Parent is shutting down, bye... sechacklabs@SecHackLabs ~> echo $DISPLAY :1 ```

gitea-mirror added the

bug

workaround

labels 2026-05-05 08:28:58 -06:00

gitea-mirror commented

2026-05-05 08:29:00 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 18, 2019):

possible workarounds (not testet)

symlink: $HOME/.Xauthority -> $XDG_CONIG_DIR/sx/xauthority
whitelist ${HOME}/.config/sx/xauthority

@rusty-snake commented on GitHub (Aug 18, 2019): possible workarounds (not testet) 1. symlink: $HOME/.Xauthority -> $XDG_CONIG_DIR/sx/xauthority 2. `whitelist ${HOME}/.config/sx/xauthority`

gitea-mirror commented

2026-05-05 08:29:01 -06:00

Author

Owner

@Edu4rdSHL commented on GitHub (Aug 18, 2019):

@rusty-snake the symlink method doesn't work because firejail apps still can't access to $HOME/.local/share/sx/xauthority. I have been using the following lines in /etc/firejail/globals.local

# Whitelist sx xauthority
whitelist ${HOME}/.local/share/sx/xauthority

It seems to be a clean workaround.

@Edu4rdSHL commented on GitHub (Aug 18, 2019): @rusty-snake the symlink method doesn't work because firejail apps still can't access to $HOME/.local/share/sx/xauthority. I have been using the following lines in `/etc/firejail/globals.local` ``` # Whitelist sx xauthority whitelist ${HOME}/.local/share/sx/xauthority ``` It seems to be a clean workaround.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1812

No description provided.

Rows
Columns