[GH-ISSUE #4793] docs: Why not recommend disabling X11 abstract socket? #2780

New issue

Open

opened 2026-05-05 09:26:26 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 09:26:26 -06:00

Owner

Originally created by @tomjaguarpaw on GitHub (Dec 23, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4793

The firejail documentation explains that a new network namespace is needed to prevent access to the X11 server abstract socket, e.g.

A network namespace initialized with --net is necessary in order to disable the abstract X11 socket. If for any reasons you cannot use a network namespace, the socket will still be visible inside the sandbox, and hackers can attach keylogger and screenshot programs to this socket.

-- https://firejail.wordpress.com/documentation-2/firefox-guide/

whenever we are dealing with X11 we also need to install a new network namespace. This is the only way to block access to the abstract Unix socket opened by the main X11 server already running on your box

-- https://firejail.wordpress.com/documentation-2/basic-usage/

But instead it would seem to be simpler for users to tell X11 not to listen on the abstract socket. Perhaps you could recommend that instead or as an alternative?

(There may be other reasons to create a new network namespace of course, but preventing access to the abstract socket shouldn't be one.)

Originally created by @tomjaguarpaw on GitHub (Dec 23, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4793 The firejail documentation explains that a new network namespace is needed to prevent access to the X11 server abstract socket, e.g. > A network namespace initialized with --net is necessary in order to disable the abstract X11 socket. If for any reasons you cannot use a network namespace, the socket will still be visible inside the sandbox, and hackers can attach keylogger and screenshot programs to this socket. -- https://firejail.wordpress.com/documentation-2/firefox-guide/ > whenever we are dealing with X11 we also need to install a new network namespace. This is the only way to block access to the abstract Unix socket opened by the main X11 server already running on your box -- https://firejail.wordpress.com/documentation-2/basic-usage/ But instead it would seem to be simpler for users to [tell X11 not to listen on the abstract socket](https://unix.stackexchange.com/questions/112316/is-it-possible-to-tell-xorg-not-to-listen-on-the-abstract-socket). Perhaps you could recommend that instead or as an alternative? (There may be other reasons to create a new network namespace of course, but preventing access to the abstract socket shouldn't be one.)