mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #7062] xorg: Authorization required, but no authorization protocol specified #3473
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#3473
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @kmille on GitHub (Feb 15, 2026).
Original GitHub issue: https://github.com/netblue30/firejail/issues/7062
Hey,
I'm using firejail-git version 0.9.78.r114.g88652cdb3-1 on Arch Linux (just built it a few seconds ago). I cannot start Thunderbird. I have the same problem with firefox:
Regarding the AppArmor thing (I'm running
6.17.13-hardened1-3-hardened):@kmk3 commented on GitHub (Feb 17, 2026):
Basic debugging information is missing; please follow the bug report template:
@kmille commented on GitHub (Feb 17, 2026):
I have the same error on signal... I tried fixing it there but no luck....
logs
Expected behavior
Also having
Authorization required, but no authorization protocol specified. Signal window does not appear.Behavior without a profile
logs
kmille@spring:~# firejail --noprofile signal-desktop
firejail version 0.9.79
Parent pid 806471, child pid 806472
Warning: not remounting /var/lib/docker/overlay2/10950d58944a0d72af6ce02aca10872ed2967202eb4ee4d85d1c56d3494bd7c3/merged
Warning: not remounting /var/lib/docker/overlay2/da069ff799aaedf82f7e0882511f4a91b071044edae2604e19684bae4c07d215/merged
Warning: not remounting /var/lib/docker/overlay2/10950d58944a0d72af6ce02aca10872ed2967202eb4ee4d85d1c56d3494bd7c3/merged
Warning: not remounting /var/lib/docker/overlay2/da069ff799aaedf82f7e0882511f4a91b071044edae2604e19684bae4c07d215/merged
Base filesystem installed in 0.12 ms
Child process initialized in 41.40 ms
NODE_ENV production
NODE_CONFIG_DIR /usr/lib/signal-desktop/resources/app.asar/config
NODE_CONFIG {}
ALLOW_CONFIG_MUTATIONS undefined
HOSTNAME somesishi
NODE_APP_INSTANCE undefined
SUPPRESS_NO_CONFIG_WARNING undefined
SIGNAL_ENABLE_HTTP undefined
userData: /home/kmille/.config/Signal
Authorization required, but no authorization protocol specified
[3:0217/094319.831299:ERROR:ui/ozone/platform/x11/ozone_platform_x11.cc:249] Missing X server or $DISPLAY
[3:0217/094319.831404:ERROR:ui/aura/env.cc:257] The platform failed to initialize. Exiting.
FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal
----- Native stack trace -----
----- JavaScript stack trace -----
1: read (node:internal/modules/package_json_reader:116:33)
2: _readPackage (node:internal/modules/cjs/loader:475:55)
3: resolveExports (node:internal/modules/cjs/loader:653:15)
4: Module._findPath (node:internal/modules/cjs/loader:724:31)
5: Module._resolveFilename (node:internal/modules/cjs/loader:1376:27)
6: defaultResolveImpl (node:internal/modules/cjs/loader:1032:19)
7: resolveForCJSWithHooks (node:internal/modules/cjs/loader:1037:22)
8: Module._load (node:internal/modules/cjs/loader:1199:37)
9: c._load (node:electron/js2c/node_init:2:17993)
10: traceSync (node:diagnostics_channel:328:14)
Additional context
It works without firejail:
Any other detail that may help to understand/debug the problem
Environment
uname -srm): Linux 6.17.13-hardened1-3-hardened x86_64mesa 1:24.3.3-2"): signal-desktop 7.88.0-1
firejail --version): firejail-git 0.9.78.r114.g88652cdb3-1Checklist
firejail /usr/bin/vlcinstead offirejail vlc; seehttps://github.com/netblue30/firejail/issues/2877) => also tried this/usr/bin/vlc) "fixes" it).https://github.com/netblue30/firejail/issues/1139)browser-allow-drm yes/browser-disable-u2f noinfirejail.configto allow DRM/U2F in browsers.--profile=PROFILENAMEto set the right profile. (Only relevant for AppImages)@kmille commented on GitHub (Feb 17, 2026):
Looks like it's a X11 issue. I also commented out the whole profile without luck. But that's probably the same like "--noprofile".
@kmk3 commented on GitHub (Feb 17, 2026):
Are you using the standard xorg packages?
Which DE/WM?
What is the output of the following?
What happens with the following?
@kmk3 commented on GitHub (Feb 17, 2026):
When did this start happening?
Does it work if you disable apparmor completely and reboot?
@kmille commented on GitHub (Feb 17, 2026):
recent days, maybe during last week.
Can try this later, am currently working.
@kmk3 commented on GitHub (Feb 18, 2026):
What is the output of the following?
What happens if you enable it?
@kmk3 commented on GitHub (Feb 18, 2026):
I'm getting this error on Artix as well now.
It seems to happen for multiple programs on xorg but not on wayland (firefox
works on wayland).
Happens with both gtk-based and qt-based programs and even with
--profile=noprofile.No idea what caused it, but it was probably a package upgrade.
In the pacman log, I don't see any upgrades for xorg-specific packages though.
@rusty-snake commented on GitHub (Feb 18, 2026):
@kmk3 check
$XAUTHORITY@kmk3 commented on GitHub (Feb 18, 2026):
What do you mean?
It points to ~/.Xauthority.
Same inside the sandbox.
@kmk3 commented on GitHub (Feb 18, 2026):
Note that xterm still opens just fine, so I would guess that it's due to adependency that is shared by many GUI apps but that is not from xorg itself.
Edit: Nevermind, I was opening it outside of firejail.
xterm also breaks in firejail, so the problem might actually be inside an xorg
library or something close to it.
@kmk3 commented on GitHub (Feb 18, 2026):
Every program seems to open just fine if I use
--keep-hostname.@kmille
Does that also fix it on Arch?
Cc: @netblue30
@kmille commented on GitHub (Feb 19, 2026):
confirm:
--keep-hostnamefixes the issue on Arch.@kmk3 commented on GitHub (Feb 19, 2026):
The issue does not happen with 0.9.78.
Bisected and found the problematic commit:
6f164f415("--keep-hostname part 2 (#7048)", 2026-02-03)@kmille commented on GitHub (Feb 19, 2026):
The are still the question how to fix this. And what's the underlying problem.
On February 19, 2026 1:00:09 PM GMT+01:00, "Kelvin M. Klann" @.***> wrote:
@kmk3 commented on GitHub (Feb 20, 2026):
Yes, but for now as a workaround you can add the following to
/etc/firejail/globals.local:
@kmk3 commented on GitHub (Feb 24, 2026):
The issue also happens when using
--hostname=(both on 0.9.78 and onec36880659):xauth listshows the hostname, so it might be related:Networking
Without firejail:
With firejail:
Note that the line of the real host is removed from /etc/hosts inside of the
sandbox (see also #7048).
Xorg
If changing the hostname in the sandbox, it might be necessary to allow that
new hostname to connect to the X server (such as by using
xhostorxauth).Though the sandbox might need to know the real hostname in order to find the
host and connect to the X server.
Which looks like it would defeat the purpose of using a separate hostname (or
at least of trying to hide the real hostname).
Also, the xauth list might be global regardless of user or sandbox, in which
case adding an ever-increasing amount of random hostnames by default would seem
counter-productive.
Testing
I tested adding the real hostname in /etc/hosts in the sandbox, in which case
pinging the real hostname works but connecting to the X server still fails. So
X might be checking the hostname specifically (such as with
gethostnameor byreading /etc/hostname).
Diff for testing:
diff