[GH-ISSUE #6767] ssh: --net=(none|interface) breaks ssh -X #3362

New issue

Open

opened 2026-05-05 09:56:35 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:56:35 -06:00

Owner

Originally created by @mabra on GitHub (Jun 2, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6767

Description

Networked applications (seen with icecat) cannot be started using "ssh -X" because a wrong display is recognized.

Steps to Reproduce

$ ssh -X user1@host

> mousepad
(works)

> firejail --net=eth1 (or none) icecat
[...]
Parent pid 3092463, child pid 3092464

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP    
eth0-3092463     16:64:37:ae:66:cd  192.168.6.244   255.255.255.0    UP    
Default gateway 192.168.6.1

Child process initialized in 1195.31 ms
Unable to init server: Broadway display type not supported: localhost:14.0
Error: cannot open display: localhost:14.0

firejail version: 0.9.72 (on destination)
uname: Linux host 5.10.0-34-amd64

Expected behavior

The window of the application (here: icecat) should appear.

Actual behavior

The error message (shown above)

Behavior without a profile

Is the same.

Additional context

Dont know.
Happens also using this invocation:

workstation> ssh -X user1@host firejail --net=eth1 icecat

Environment

Debian 11
Kernel 5.10.0-34-amd64
firejail version 0.9.72

Checklist

The issues is caused by firejail (i.e. running the program by path (e.g. /usr/bin/vlc) "fixes" it).
I can reproduce the issue without custom modifications (e.g. globals.local).
The program has a profile. (If not, request one in https://github.com/netblue30/firejail/issues/1139)
The profile (and redirect profile if exists) hasn't already been fixed upstream.
I have performed a short search for similar issues (to avoid opening a duplicate).
I'm aware of browser-allow-drm yes/browser-disable-u2f no in firejail.config to allow DRM/U2F in browsers.
I used --profile=PROFILENAME to set the right profile. (Only relevant for AppImages)

Log

Output of LC_ALL=C firejail /path/to/program

ncu1@deb11c1:~$ LC_ALL=C firejail --net=enp3s0 icecat
Reading profile /etc/firejail/icecat.profile
Reading profile /etc/firejail/firefox-common.profile
Reading profile /etc/firejail/firefox-common.local
Reading profile /etc/firejail/allow-ssh.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-devel.inc
Reading profile /etc/firejail/disable-exec.inc
Reading profile /etc/firejail/disable-interpreters.inc
Reading profile /etc/firejail/disable-proc.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/whitelist-common.inc
Reading profile /etc/firejail/whitelist-run-common.inc
Reading profile /etc/firejail/whitelist-runuser-common.inc
Reading profile /etc/firejail/whitelist-var-common.inc
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Parent pid 3148235, child pid 3148239

Interface        MAC                IP               Mask             Status
lo                                  127.0.0.1        255.0.0.0        UP    
eth0-3148235     76:b4:11:cd:20:b5  192.168.6.198   255.255.255.0    UP    
Default gateway 192.168.6.1

Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Warning: cleaning all supplementary groups
Seccomp list in: !chroot, check list: @default-keep, prelist: unknown,
Warning: cleaning all supplementary groups
Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior.
Child process initialized in 1415.54 ms
Unable to init server: Broadway display type not supported: localhost:14.0
Error: cannot open display: localhost:14.0

Output of LC_ALL=C firejail --debug /path/to/program

output goes here

Originally created by @mabra on GitHub (Jun 2, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6767  ### Description Networked applications (seen with icecat) cannot be started using "ssh -X" because a wrong display is recognized. ### Steps to Reproduce Login to a remote box using ssh: ```console $ ssh -X user1@host > mousepad (works) > firejail --net=eth1 (or none) icecat [...] Parent pid 3092463, child pid 3092464 Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP eth0-3092463 16:64:37:ae:66:cd 192.168.6.244 255.255.255.0 UP Default gateway 192.168.6.1 Child process initialized in 1195.31 ms Unable to init server: Broadway display type not supported: localhost:14.0 Error: cannot open display: localhost:14.0 ``` --- * firejail version: 0.9.72 (on destination) * uname: Linux host 5.10.0-34-amd64 ### Expected behavior The window of the application (here: icecat) should appear. ### Actual behavior The error message (shown above) ### Behavior without a profile Is the same. ### Additional context Dont know. Happens also using this invocation: ```sh workstation> ssh -X user1@host firejail --net=eth1 icecat ``` ### Environment * Debian 11 * Kernel 5.10.0-34-amd64 * firejail version 0.9.72 ### Checklist - [x] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). - [x] I can reproduce the issue without custom modifications (e.g. globals.local). - [x] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). - [x] I have performed a short search for similar issues (to avoid opening a duplicate). - [x] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. - [ ] I used `--profile=PROFILENAME` to set the right profile. (Only relevant for AppImages) ### Log <details> <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> <p> ``` ncu1@deb11c1:~$ LC_ALL=C firejail --net=enp3s0 icecat Reading profile /etc/firejail/icecat.profile Reading profile /etc/firejail/firefox-common.profile Reading profile /etc/firejail/firefox-common.local Reading profile /etc/firejail/allow-ssh.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-proc.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-run-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 3148235, child pid 3148239 Interface MAC IP Mask Status lo 127.0.0.1 255.0.0.0 UP eth0-3148235 76:b4:11:cd:20:b5 192.168.6.198 255.255.255.0 UP Default gateway 192.168.6.1 Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: cleaning all supplementary groups Warning: Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior. Child process initialized in 1415.54 ms Unable to init server: Broadway display type not supported: localhost:14.0 Error: cannot open display: localhost:14.0 ``` </p> </details> <details> <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> <p>  ``` output goes here ``` </p> </details>