github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #4105] firejail --x11=xorg result in unable to open display #2535

New issue
Open
opened 2026-05-05 09:12:34 -06:00 by gitea-mirror · 5 comments
gitea-mirror commented 2026-05-05 09:12:34 -06:00
Owner
Copy link

Originally created by @ckorder on GitHub (Mar 16, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4105

Bug and expected behavior
firejail --x11=xorg firefox result in unable to open display
x11=xorg isnt working for any application while xpra is working

No protocol specified
/usr/bin/xauth: (argv):1: unable to open display ":0".
Failed to create untrusted X cookie: xauth: exit 1

Reproduce
Using default profiles with sudo firecfg

im only getting this kind of errors with Intel © Core™ i7 and not with AMD.

  • What changed calling firejail --noprofile /path/to/program in a terminal? nothing beside not loading profile
    firejail --noprofile --x11=xorg firefox
Parent pid 607099, child pid 607100
No protocol specified
/usr/bin/xauth: (argv):1:  unable to open display ":0".
Failed to create untrusted X cookie: xauth: exit 1
Error: proc 607099 cannot sync with peer: unexpected EOF
Peer 607100 unexpectedly exited with status 1

firejail --noprofile --x11=xorg firefox
Parent pid 607099, child pid 607100
No protocol specified
/usr/bin/xauth: (argv):1: unable to open display ":0".
Failed to create untrusted X cookie: xauth: exit 1
Error: proc 607099 cannot sync with peer: unexpected EOF
Peer 607100 unexpectedly exited with status 1
user@pc:/opt$ firejail --x11=xorg firefox
Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 607408, child pid 607409
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Post-exec seccomp protector enabled
No protocol specified
/usr/bin/xauth: (argv):1: unable to open display ":0".
Failed to create untrusted X cookie: xauth: exit 1
Error: proc 607408 cannot sync with peer: unexpected EOF
Peer 607409 unexpectedly exited with status 1

Environment
Linux Mint 20.1
firejail version 0.9.62
Compile time support:
- AppArmor support is enabled
- AppImage support is enabled
- chroot support is enabled
- file and directory whitelisting support is enabled
- file transfer support is enabled
- firetunnel support is enabled
- networking support is enabled
- overlayfs support is enabled
- private-home support is enabled
- seccomp-bpf support is enabled
- user namespace support is enabled
- X11 sandboxing support is enabled

within virtual machine its working without these errors
used sudo firecfg as well, but window is showing everything is working.
rly weird like #4104 where the issue just does not occur in a virtual machine, but i don't get why

Reading profile /etc/firejail/firefox.profile
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: networking feature is disabled in Firejail configuration file
Parent pid 3738, child pid 3739
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Post-exec seccomp protector enabled
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Child process initialized in 130.06 ms
Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features
dpkg-query: error: failed to open package info file '/var/lib/dpkg/status' for reading: No such file or directory
[GFX1-]: glxtest: GLX extension missing
^C
Parent received signal 2, shutting down the child process...

Child received signal 2, shutting down the sandbox...

Parent is shutting down, bye...
Originally created by @ckorder on GitHub (Mar 16, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4105 **Bug and expected behavior** firejail --x11=xorg firefox result in unable to open display x11=xorg isnt working for any application while xpra is working **No protocol specified /usr/bin/xauth: (argv):1: unable to open display ":0". Failed to create untrusted X cookie: xauth: exit 1** **Reproduce** Using default profiles with sudo firecfg **im only getting this kind of errors with Intel © Core™ i7 and not with AMD.** - What changed calling `firejail --noprofile /path/to/program` in a terminal? nothing beside not loading profile firejail --noprofile --x11=xorg firefox ``` Parent pid 607099, child pid 607100 No protocol specified /usr/bin/xauth: (argv):1: unable to open display ":0". Failed to create untrusted X cookie: xauth: exit 1 Error: proc 607099 cannot sync with peer: unexpected EOF Peer 607100 unexpectedly exited with status 1 ``` firejail --noprofile --x11=xorg firefox Parent pid 607099, child pid 607100 No protocol specified /usr/bin/xauth: (argv):1: unable to open display ":0". Failed to create untrusted X cookie: xauth: exit 1 Error: proc 607099 cannot sync with peer: unexpected EOF Peer 607100 unexpectedly exited with status 1 user@pc:/opt$ firejail --x11=xorg firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Warning: networking feature is disabled in Firejail configuration file Parent pid 607408, child pid 607409 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Post-exec seccomp protector enabled No protocol specified /usr/bin/xauth: (argv):1: unable to open display ":0". **Failed to create untrusted X cookie: xauth: exit 1** Error: proc 607408 cannot sync with peer: unexpected EOF Peer 607409 unexpectedly exited with status 1 **Environment** Linux Mint 20.1 firejail version 0.9.62 Compile time support: - AppArmor support is enabled - AppImage support is enabled - chroot support is enabled - file and directory whitelisting support is enabled - file transfer support is enabled - firetunnel support is enabled - networking support is enabled - overlayfs support is enabled - private-home support is enabled - seccomp-bpf support is enabled - user namespace support is enabled - X11 sandboxing support is enabled **within virtual machine its working without these errors** used sudo firecfg as well, but window is showing everything is working. rly weird like #4104 where the issue just does not occur in a virtual machine, but i don't get why ```firejail --x11=xorg firefox Reading profile /etc/firejail/firefox.profile Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Warning: networking feature is disabled in Firejail configuration file Parent pid 3738, child pid 3739 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Post-exec seccomp protector enabled Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Child process initialized in 130.06 ms Warning: an existing sandbox was detected. /usr/bin/firefox will run without any additional sandboxing features dpkg-query: error: failed to open package info file '/var/lib/dpkg/status' for reading: No such file or directory [GFX1-]: glxtest: GLX extension missing ^C Parent received signal 2, shutting down the child process... Child received signal 2, shutting down the sandbox... Parent is shutting down, bye... ```
gitea-mirror commented 2026-05-05 09:12:36 -06:00
Author
Owner
Copy link

@ghost commented on GitHub (Mar 16, 2021):

firejail version 0.9.62

Please update this 0.9.62 version as soon as possible. Besides being outdated it is vulnerable to CVE-2021-26910, which is fixed in 0.9.64.4. You can install/update firejail from this PPA, which happens to be maintained by one of our collaborators.

It could be that you'll encounter the reported issue on the latest stable release too, but at least we then have a sound 'base' to start looking at it in detail.

<!-- gh-comment-id:800691219 --> @ghost commented on GitHub (Mar 16, 2021): > firejail version 0.9.62 Please update this `0.9.62` version as soon as possible. Besides being outdated it is vulnerable to [CVE-2021-26910](https://github.com/netblue30/firejail#security-vulnerabilities), which is fixed in `0.9.64.4.` You can install/update firejail from [this PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail), which happens to be maintained by one of our collaborators. It could be that you'll encounter the reported issue on the latest stable release too, but at least we then have a sound 'base' to start looking at it in detail.
gitea-mirror commented 2026-05-05 09:12:37 -06:00
Author
Owner
Copy link

@ckorder commented on GitHub (Mar 17, 2021):

official-package-repositories.list:
ubuntu focal main restricted universe multiverse

who's responsible for... never mind, i dont care its ubuntu anyway 🗑️ 😄

<!-- gh-comment-id:800694022 --> @ckorder commented on GitHub (Mar 17, 2021): ``` official-package-repositories.list: ubuntu focal main restricted universe multiverse ``` who's responsible for... never mind, i dont care its ubuntu anyway 🗑️ 😄
gitea-mirror commented 2026-05-05 09:12:38 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (Mar 17, 2021):

Duplicate of #1741

<!-- gh-comment-id:801159288 --> @rusty-snake commented on GitHub (Mar 17, 2021): Duplicate of #1741
gitea-mirror commented 2026-05-05 09:12:39 -06:00
Author
Owner
Copy link

@ckorder commented on GitHub (Mar 23, 2021):

@eevee
any one else please respond if the circumstances are equal or different

im only getting this kind of errors with Intel © Core™ i7 and not with AMD.

<!-- gh-comment-id:804543206 --> @ckorder commented on GitHub (Mar 23, 2021): @eevee any one else please respond if the circumstances are equal or different > im only getting this kind of errors with Intel © Core™ i7 and not with AMD.
gitea-mirror commented 2026-05-05 09:12:40 -06:00
Author
Owner
Copy link

@u132 commented on GitHub (Jan 2, 2022):

Try running xhost si:localuser:username

<!-- gh-comment-id:1003730570 --> @u132 commented on GitHub (Jan 2, 2022): Try running `xhost si:localuser:username`
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2535
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?