github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #767] --x11=xpra still has full access to host X server #519

New issue

Closed

opened 2026-05-05 06:02:10 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 06:02:10 -06:00

Owner

Originally created by @klampworks on GitHub (Sep 6, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/767

If I run the following:

firejail --x11=xpra xterm

And inside my sandboxed xterm do:

DISPLAY=:0 xterm

Then a new xterm window pops up on the host X server.

I noticed that Firejail will not allow /usr/bin/xinput to be executed inside the sandbox. If we rename it to xinput2 for the sake of demonstration and then do the following (your device number may vary):

DISPLAY=:0 xinput2 test 10

Then I can capture all keystrokes from the host X server from inside the sandbox. In other words, using Firejail with Xpra is providing no GUI isolation at all.

Is this intentional? I think this should merit at least a warning message to the user that malicious X11 applications can still steal all your internet banking passwords even if you "isolate" them with Firejail.

Or have I just not set up Firejail correctly?

Thanks.

Originally created by @klampworks on GitHub (Sep 6, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/767 If I run the following: ``` firejail --x11=xpra xterm ``` And inside my sandboxed xterm do: ``` DISPLAY=:0 xterm ``` Then a new xterm window pops up on the host X server. I noticed that Firejail will not allow `/usr/bin/xinput` to be executed inside the sandbox. If we rename it to xinput2 for the sake of demonstration and then do the following (your device number may vary): ``` DISPLAY=:0 xinput2 test 10 ``` Then I can capture all keystrokes from the host X server from inside the sandbox. In other words, using Firejail with Xpra is providing no GUI isolation at all. Is this intentional? I think this should merit at least a warning message to the user that malicious X11 applications can still steal all your internet banking passwords even if you "isolate" them with Firejail. Or have I just not set up Firejail correctly? Thanks.

gitea-mirror closed this issue

2026-05-05 06:02:12 -06:00

gitea-mirror commented

2026-05-05 06:02:15 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 6, 2016):

I checked this with xephyr, and the same holds true there as well. One way, of course, is to completely prevent access to the sockets of the host X server (using private-tmp and net=none).

[EDIT]
Never mind. Using those options prevents me from connecting to the child X server as well, as least with xephyr.

@chiraag-nataraj commented on GitHub (Sep 6, 2016): I checked this with xephyr, and the same holds true there as well. One way, of course, is to completely prevent access to the sockets of the host X server (using `private-tmp` and `net=none`). [EDIT] Never mind. Using those options prevents me from connecting to the child X server as well, as least with xephyr.

gitea-mirror commented

2026-05-05 06:02:17 -06:00

Author

Owner

@klampworks commented on GitHub (Sep 6, 2016):

Ah yes, using --net=none fixes the problem for me with Xpra.

Ideally I would like my Firejailed application to have regular internet access though.

@klampworks commented on GitHub (Sep 6, 2016): Ah yes, using `--net=none` fixes the problem for me with Xpra. Ideally I would like my Firejailed application to have regular internet access though.

gitea-mirror commented

2026-05-05 06:02:19 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 6, 2016):

Okay. So it works with Xpra but not with Xephyr and prevents actual internet access. You could also disable the abstract socket, which would obviate the necessity of using --net=none. You can do so by adding the parameter -nolisten local in the command in /etc/X11/xinit/xserverrc. If you're not using startx as your command, you can find more details here: http://tstarling.com/blog/2016/06/x11-security-isolation/

@chiraag-nataraj commented on GitHub (Sep 6, 2016): Okay. So it works with Xpra but not with Xephyr and prevents actual internet access. You could also disable the abstract socket, which would obviate the necessity of using `--net=none`. You can do so by adding the parameter `-nolisten local` in the command in `/etc/X11/xinit/xserverrc`. If you're not using `startx` as your command, you can find more details here: http://tstarling.com/blog/2016/06/x11-security-isolation/

gitea-mirror commented

2026-05-05 06:02:20 -06:00

Author

Owner

@klampworks commented on GitHub (Sep 6, 2016):

Starting X with -nolisten local fixes the problem.

I'm on Gentoo so this is entirely my fault for not configuring X correctly.

If this is the default behaviour for other distros it might be worth adding a word about it to the Firejail documentation though.

Thank you very much for your help.

@klampworks commented on GitHub (Sep 6, 2016): Starting X with `-nolisten local` fixes the problem. I'm on Gentoo so this is entirely my fault for not configuring X correctly. If this is the default behaviour for other distros it might be worth adding a word about it to the Firejail documentation though. Thank you very much for your help.

gitea-mirror commented

2026-05-05 06:02:22 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Sep 6, 2016):

The default is to enable the abstract socket in most distros (at least Debian and Ubuntu). @netblue30, you should add a note that you can disable the abstract socket using -nolisten local :)

@chiraag-nataraj commented on GitHub (Sep 6, 2016): The default is to enable the abstract socket in most distros (at least Debian and Ubuntu). @netblue30, you should add a note that you can disable the abstract socket using `-nolisten local` :)

gitea-mirror referenced this issue

2026-05-05 10:05:26 -06:00

[PR #519] [MERGED] cmus.profile: use empty /etc #3653

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#519

No description provided.

Rows
Columns