github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #736] what to do if --x11 wont work, and which browser? #496

New issue

Closed

opened 2026-05-05 05:58:56 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 05:58:56 -06:00

Owner

Originally created by @xahare on GitHub (Aug 21, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/736

Is there anything you can do for gui isolation (short of virtual machines) if xpra wont work? for example with Xwayland in fedra24.

also, in this context, do firefox or chrome try to anything to mitigate or at least prevent itself from abusing x11? would -net still help given that the browser already has access to the x server?

it seems like chrome(ium) is safer, but i could be missing something.

Originally created by @xahare on GitHub (Aug 21, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/736 Is there anything you can do for gui isolation (short of virtual machines) if xpra wont work? for example with Xwayland in fedra24. also, in this context, do firefox or chrome try to anything to mitigate or at least prevent itself from abusing x11? would -net still help given that the browser already has access to the x server? it seems like chrome(ium) is safer, but i could be missing something.

gitea-mirror

2026-05-05 05:58:56 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:59:04 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 22, 2016):

Hopefully they will bring Xpra in Fedora. I can see a package in Copr: https://copr.fedorainfracloud.org/coprs/jgu/xpra/

You can try Xephyr, is not as nice as Xpra, but it will do the job.

also, in this context, do firefox or chrome try to anything to mitigate or at least prevent itself from abusing x11? would -net still help given that the browser already has access to the x server?

No, they just disregard any X11 problems. Chrome sandbox disables X11, but only a portion of Chrome code runs in the sandbox.

@netblue30 commented on GitHub (Aug 22, 2016): Hopefully they will bring Xpra in Fedora. I can see a package in Copr: https://copr.fedorainfracloud.org/coprs/jgu/xpra/ You can try Xephyr, is not as nice as Xpra, but it will do the job. > also, in this context, do firefox or chrome try to anything to mitigate or at least prevent itself from abusing x11? would -net still help given that the browser already has access to the x server? No, they just disregard any X11 problems. Chrome sandbox disables X11, but only a portion of Chrome code runs in the sandbox.

gitea-mirror commented

2026-05-05 05:59:06 -06:00

Author

Owner

@xahare commented on GitHub (Aug 22, 2016):

i tried xpra from the main and winswitch.org repos. both crashed when using xwayland. xephyr worked as expected, but could use a -resizable flag.

@xahare commented on GitHub (Aug 22, 2016): i tried xpra from the main and winswitch.org repos. both crashed when using xwayland. xephyr worked as expected, but could use a -resizable flag.

gitea-mirror commented

2026-05-05 05:59:09 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 22, 2016):

I've tried --resize, it crashes.

@netblue30 commented on GitHub (Aug 22, 2016): I've tried --resize, it crashes.

gitea-mirror commented

2026-05-05 05:59:11 -06:00

Author

Owner

@xahare commented on GitHub (Aug 22, 2016):

How do you know what they sandbox? did you trace them? or some other way?

@xahare commented on GitHub (Aug 22, 2016): How do you know what they sandbox? did you trace them? or some other way?

gitea-mirror commented

2026-05-05 05:59:15 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 22, 2016):

@xahare If I'm not mistaken, the design of the Google Chrome/Chromium sandbox is given here and the Firefox one is given here. Basically, the Firefox one relies heavily on the Chromium one for Windows and on seccomp-bpf for Linux. Neither of these actually address the huge glaring security vulnerabilities in X11 that are too hard to fix given the way it's been designed, hence the need for extra filtering through something like firejail (or a redesign of the graphical subsystem such as Wayland).

@chiraag-nataraj commented on GitHub (Aug 22, 2016): @xahare If I'm not mistaken, the design of the Google Chrome/Chromium sandbox is given [here](https://chromium.googlesource.com/chromium/src/+/master/docs/linux_sandboxing.md) and the Firefox one is given [here](https://wiki.mozilla.org/Security/Sandbox). Basically, the Firefox one relies heavily on the Chromium one for Windows and on seccomp-bpf for Linux. Neither of these actually address the huge glaring security vulnerabilities in X11 that are too hard to fix given the way it's been designed, hence the need for extra filtering through something like firejail (or a redesign of the graphical subsystem such as Wayland).

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#496

No description provided.

Rows
Columns