[GH-ISSUE #3838] --x11=none --netns=isolated invalidly errors on the abstract X11 socket being accessible #2416

New issue

Closed

opened 2026-05-05 09:05:38 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:05:38 -06:00

Owner

Originally created by @faern on GitHub (Dec 19, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3838

Scenario + use case

I'm want to run a native Wayland program under firejail. Since it uses Wayland only I want to disable all X11 access so it can't possibly talk to XWayland to get information about running XWayland programs. My sandbox is using a separate network namespace so it can't reach other localhost sockets in any way and is also forced out via a VPN.

Problem

$ firejail --noprofile --netns=isolated --x11=none
ERROR: --x11=none specified, but abstract X11 socket still accessible.
Additional setup required. To block abstract X11 socket you can either:
 * use network namespace in firejail (--net=none, --net=...)
 * add "-nolisten local" to xserver options
   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)

But since I'm assigning it a separate namespace the abstract socket is not accessible:

$ firejail --noprofile --netns=isolated
$ netstat -a | grep X11
$

Expected outcome

When --netns=something is given, --x11=none should not complain about the abstract X11 socket being accessible to the jail.

Environment
Fedora 33 Workstation

$ firejail --version
firejail version 0.9.64

Compile time support:
	- AppArmor support is disabled
	- AppImage support is enabled
	- chroot support is enabled
	- D-BUS proxy support is enabled
	- file and directory whitelisting support is enabled
	- file transfer support is enabled
	- firetunnel support is enabled
	- networking support is enabled
	- overlayfs support is enabled
	- private-home support is enabled
	- SELinux support is enabled
	- user namespace support is enabled
	- X11 sandboxing support is enabled

Checklist

A short search for duplicates was performed.

Originally created by @faern on GitHub (Dec 19, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3838 **Scenario + use case** I'm want to run a native Wayland program under firejail. Since it uses Wayland only I want to disable all X11 access so it can't possibly talk to XWayland to get information about running XWayland programs. My sandbox is using a separate network namespace so it can't reach other localhost sockets in any way and is also forced out via a VPN. **Problem** ``` $ firejail --noprofile --netns=isolated --x11=none ERROR: --x11=none specified, but abstract X11 socket still accessible. Additional setup required. To block abstract X11 socket you can either: * use network namespace in firejail (--net=none, --net=...) * add "-nolisten local" to xserver options (eg. to your display manager config, or /etc/X11/xinit/xserverrc) ``` But since I'm assigning it a separate namespace the abstract socket **is not accessible**: ``` $ firejail --noprofile --netns=isolated $ netstat -a | grep X11 $ ``` **Expected outcome** When `--netns=something` is given, `--x11=none` should not complain about the abstract X11 socket being accessible to the jail. **Environment** Fedora 33 Workstation ``` $ firejail --version firejail version 0.9.64 Compile time support: - AppArmor support is disabled - AppImage support is enabled - chroot support is enabled - D-BUS proxy support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - SELinux support is enabled - user namespace support is enabled - X11 sandboxing support is enabled ``` **Checklist** - [x] A short search for duplicates was performed.

gitea-mirror closed this issue

2026-05-05 09:05:39 -06:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2416

No description provided.

Rows
Columns