github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #4282] chromium: Unable to open X display (missing whitelist) #2605

New issue
Closed
opened 2026-05-05 09:16:30 -06:00 by gitea-mirror · 5 comments
gitea-mirror commented 2026-05-05 09:16:30 -06:00
Owner
Copy link

Originally created by @Xwang1976 on GitHub (May 15, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4282

Bug and expected behavior
When I run firejail chromium

I get the following messages:

Reading profile /etc/firejail/chromium.profile
Reading profile /etc/firejail/chromium-common.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-xdg.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-usr-share-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Warning: Warning: NVIDIA card detected, nogroups command disabled
Parent pid 9083, child pid 9084
Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.
Warning: /sbin directory link was not blacklisted
Warning: /usr/sbin directory link was not blacklisted
Warning: Cannot confine the application using AppArmor.
Maybe firejail-default AppArmor profile is not loaded into the kernel.
As root, run "aa-enforce firejail-default" to load it.
Child process initialized in 185.45 ms
No protocol specified
[6:6:0516/013812.224391:ERROR:browser_main_loop.cc(1386)] Unable to open X display.

Parent is shutting down, bye...

No profile and disabling firejail
Nothing changes calling firejail /usr/bin/chromium.

Calling firejail --noprofile /usr/bin/chromium opens the program correctly.

I've noted that executing xhost + before running firejail chromium solves the issue, but I'm not sure if it is safe to do.

Environment
I'm running archlinux, with rootless xorg using sddm-git and kde.
firejail version 0.9.64.4

Additional context
The same issue happens with other programs too.
It seems as the only way to have it working correctly is by setting xhost +

Edit: Formatting.

Originally created by @Xwang1976 on GitHub (May 15, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4282 **Bug and expected behavior** When I run `firejail chromium` I get the following messages: ``` Reading profile /etc/firejail/chromium.profile Reading profile /etc/firejail/chromium-common.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Warning: Warning: NVIDIA card detected, nogroups command disabled Parent pid 9083, child pid 9084 Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: Cannot confine the application using AppArmor. Maybe firejail-default AppArmor profile is not loaded into the kernel. As root, run "aa-enforce firejail-default" to load it. Child process initialized in 185.45 ms No protocol specified [6:6:0516/013812.224391:ERROR:browser_main_loop.cc(1386)] Unable to open X display. Parent is shutting down, bye... ``` **No profile and disabling firejail** Nothing changes calling `firejail /usr/bin/chromium`. Calling `firejail --noprofile /usr/bin/chromium` opens the program correctly. I've noted that executing `xhost +` before running `firejail chromium` solves the issue, but I'm not sure if it is safe to do. **Environment** I'm running archlinux, with rootless xorg using sddm-git and kde. firejail version 0.9.64.4 **Additional context** The same issue happens with other programs too. It seems as the only way to have it working correctly is by setting `xhost +` Edit: Formatting.
gitea-mirror commented 2026-05-05 09:16:33 -06:00
Author
Owner
Copy link

@Xwang1976 commented on GitHub (May 16, 2021):

Running xhost SI:localuser:myusername solves the issue too and maybe it is safer tha xhost +
The fact is that till yesterday everything was working correctly.
I've "only" removed GDM and installed SDDM.
With GDM Xorg was alredy runned rootlessy

<!-- gh-comment-id:841743122 --> @Xwang1976 commented on GitHub (May 16, 2021): Running xhost SI:localuser:myusername solves the issue too and maybe it is safer tha xhost + The fact is that till yesterday everything was working correctly. I've "only" removed GDM and installed SDDM. With GDM Xorg was alredy runned rootlessy
gitea-mirror commented 2026-05-05 09:16:34 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 16, 2021):

Where is your Xauthority file (echo $XAUTHORITY)?

<!-- gh-comment-id:841777221 --> @rusty-snake commented on GitHub (May 16, 2021): Where is your Xauthority file (`echo $XAUTHORITY`)?
gitea-mirror commented 2026-05-05 09:16:35 -06:00
Author
Owner
Copy link

@Xwang1976 commented on GitHub (May 16, 2021):

When using sddm, echo $XAUTHORITY gives /run/user/1000/c04e4bb9-0531-4ab3-86a8-caaa6f30a661 with the file name changingat every reboot
Using GDM echo $XAUTHORITY gives /run/user/1000/gdm/Xauthority

Moreover when I look at the Xorg process it is runned by sddm as:
/usr/lib/Xorg -nolisten tcp -background none -seat seat0 -noreset -keeptty -novtswitch -verbose 3 -auth /run/user/1000/c04e4bb9-0531-4ab3-86a8-caaa6f30a661 -displayfd 8 vt1 -logfile /dev/null

GDM instead runs Xorg in this way:
/usr/lib/Xorg vt2 -displayfd 3 -auth run run/user/1000/gdm/Xauthority -nolisten tcp -background none -noreset -keeptty -novtswitch -verbose 3

Finally running xauth when started by sddm I get:
access control enabled, only authorized clients can connect

Whereas running when uning GDM I get:
access control enabled, only authorized clients can connect
SI:localuser:andreak

<!-- gh-comment-id:841802612 --> @Xwang1976 commented on GitHub (May 16, 2021): When using sddm, echo $XAUTHORITY gives /run/user/1000/c04e4bb9-0531-4ab3-86a8-caaa6f30a661 with the file name changingat every reboot Using GDM echo $XAUTHORITY gives /run/user/1000/gdm/Xauthority Moreover when I look at the Xorg process it is runned by sddm as: /usr/lib/Xorg -nolisten tcp -background none -seat seat0 -noreset -keeptty -novtswitch -verbose 3 -auth /run/user/1000/c04e4bb9-0531-4ab3-86a8-caaa6f30a661 -displayfd 8 vt1 -logfile /dev/null GDM instead runs Xorg in this way: /usr/lib/Xorg vt2 -displayfd 3 -auth run run/user/1000/gdm/Xauthority -nolisten tcp -background none -noreset -keeptty -novtswitch -verbose 3 Finally running xauth when started by sddm I get: access control enabled, only authorized clients can connect Whereas running when uning GDM I get: access control enabled, only authorized clients can connect SI:localuser:andreak
gitea-mirror commented 2026-05-05 09:16:36 -06:00
Author
Owner
Copy link

@rusty-snake commented on GitHub (May 16, 2021):

Can you try to add this line to /etc/firejail/whitelist-runuser-common.inc

whitelist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]
<!-- gh-comment-id:841839316 --> @rusty-snake commented on GitHub (May 16, 2021): Can you try to add this line to `/etc/firejail/whitelist-runuser-common.inc` ``` whitelist ${RUNUSER}/[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]]-[[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]][[:xdigit:]] ```
gitea-mirror commented 2026-05-05 09:16:37 -06:00
Author
Owner
Copy link

@Xwang1976 commented on GitHub (May 16, 2021):

Adding that line solves the issue.

<!-- gh-comment-id:841840646 --> @Xwang1976 commented on GitHub (May 16, 2021): Adding that line solves the issue.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2605
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?