mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #1197] --x11=xorg couldn't query Security extension #820
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#820
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @l29ah on GitHub (Apr 6, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1197
master here
@gso commented on GitHub (Apr 7, 2017):
Is the extension installed? Included with
libxext6on Ubuntu.@l29ah commented on GitHub (Apr 7, 2017):
On Thu, Apr 06, 2017 at 10:43:05PM -0700, gso wrote:
I didn't have it installed, but after i installed it and rebuilt firejail nothing changed.
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@gso commented on GitHub (Apr 7, 2017):
It's the extensions that the sandbox server itself actually supports by the looks. If you have logged in as another user with
suthen it may be X Windows authorisation that is the problem?@l29ah commented on GitHub (Apr 7, 2017):
On Fri, Apr 07, 2017 at 09:18:22AM -0700, gso wrote:
I didn't. Also this way no --x11 and --x11=xpra won't work, and they do work.
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@netblue30 commented on GitHub (Apr 9, 2017):
I put out on Sourceforge a new release, can you give it a try? There have been quite a number of fixes in x11 area.
https://sourceforge.net/projects/firejail/files/firejail/
@l29ah commented on GitHub (Apr 9, 2017):
I'm on
519c68b857, so i guess this doesn't apply to me.@netblue30 commented on GitHub (Apr 9, 2017):
Yes, all the fixes should be in your version.
X11 security extension disables a number of regular X11 extensions. If your application uses one of them, the application will freeze. For example I start Chromium:
The browser comes up, but the mouse doesn't work. On Debian jessie I get about half the programs working (including Firefox), the rest behave strangely.
@l29ah commented on GitHub (Apr 9, 2017):
On Sun, Apr 09, 2017 at 06:12:40AM -0700, netblue30 wrote:
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@netblue30 commented on GitHub (Apr 9, 2017):
This is the command firejail is trying to run:
:0.0 is the display on my system:
Try to run xauth command in a terminal, replace :0.0 with your display number.
@gso commented on GitHub (Apr 9, 2017):
Have just built Lumina Desktop, same issue, I'm not a sys. admn. however it was evident that access control was not configured (see
man xhost),xhost- without args, whether or not access control is currently enabledxhost +- disables access control (no restriction on connections)xhost + local:- all local connectionsxhost + si:localuser:[username]- specify a local userxhost - ...- removes access@netblue30 commented on GitHub (Apr 9, 2017):
If you use xhost to configure it, is it working?
@l29ah commented on GitHub (Apr 9, 2017):
On Sun, Apr 09, 2017 at 08:39:20AM -0700, gso wrote:
‰ xhost
access control enabled, only authorized clients can connect
SI:localuser:root
SI:localuser:googleearth
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@l29ah commented on GitHub (Apr 9, 2017):
On Sun, Apr 09, 2017 at 08:40:37AM -0700, netblue30 wrote:
Yes.
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@l29ah commented on GitHub (Apr 12, 2017):
Huh?
@netblue30 commented on GitHub (Apr 12, 2017):
xhost config is a desktop problem.
@l29ah commented on GitHub (Apr 12, 2017):
On Wed, Apr 12, 2017 at 08:40:20AM -0700, netblue30 wrote:
What do you mean? Have i misconfigured anything?
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@netblue30 commented on GitHub (Apr 12, 2017):
xhost configuration is set by the guys building the distro. It all depends how X11 was set by them. If it is too restrictive, xorg will kill all kind of requests.
@l29ah commented on GitHub (Apr 12, 2017):
On Wed, Apr 12, 2017 at 09:13:13AM -0700, netblue30 wrote:
I've posted mine. Is it somehow incompatible with firejail?
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@netblue30 commented on GitHub (Apr 14, 2017):
Could also be the way they compiled xorg to begin with. It is working fine on Debian and Ubuntu.
@l29ah commented on GitHub (Apr 14, 2017):
On Fri, Apr 14, 2017 at 09:52:25AM -0700, netblue30 wrote:
I did, it's Gentoo after all. Don't see nothing wrong:
--
() ascii ribbon campaign - against html mail
/\ http://arc.pasp.de/ - against proprietary attachments
@netblue30 commented on GitHub (Apr 17, 2017):
I'll keep an eye on it, so far I couldn't reproduce it on any of my systems.
@amtlib-dot-dll commented on GitHub (Jun 10, 2017):
On Fedora 25, when the default Wayland session is being used, the corresponding Xwayland server seems to have no such security extension.
It is all the same when selecting the GNOME Classic session, where pure X is used and Wayland is bypassed.
@amtlib-dot-dll commented on GitHub (Jun 10, 2017):
There is even no "security" string in the output of
xdpyinfo -queryExtensions -ext all@amtlib-dot-dll commented on GitHub (Jun 10, 2017):
Note that the Security extension is by default disabled in https://github.com/mirror/xserver/blob/master/configure.ac#L564
@l29ah commented on GitHub (Jun 13, 2017):
And it's really disabled in Gentoo. I've rebuilt it properly and now it works. Thank you!
@yogesh-desai commented on GitHub (Sep 15, 2017):
I have an identical problem. I am trying to set up go-selenium repository on my machine. Installed dependencies mentioned on the GitHub repo page but getting the error as below while I run the test.
$ go testxauth: (argv):1: couldn't query Security extension on display ":11"--- FAIL: Example (0.09s)panic: error starting frame buffer: exit status 1 [recovered]panic: error starting frame buffer: exit status 1I am using Fedora 26:
The commands given above by other users and it's output in my case:
@netblue30 :
$ /usr/bin/xauth -v -f /tmp/testxauth generate :0.0 MIT-MAGIC-COOKIE-1 untrusted/usr/bin/xauth: file /tmp/testxauth does not existUsing authority file /tmp/testxauth/usr/bin/xauth: (argv):1: couldn't query Security extension on display ":0.0"$ env | grep DISPLAYDISPLAY=:0WAYLAND_DISPLAY=wayland-0@amtlib-dot-dll :
$ xauth -v generate $DISPLAY . trustedxauth: file /home/yogesh/.Xauthority does not existUsing authority file /home/yogesh/.Xauthorityxauth: (argv):1: couldn't query Security extension on display ":0"$ xauth -v generate $DISPLAY . untrustedxauth: file /home/yogesh/.Xauthority does not existUsing authority file /home/yogesh/.Xauthorityxauth: (argv):1: couldn't query Security extension on display ":0"@Kalle72 commented on GitHub (Aug 31, 2020):
@ l29ah: I am on Gentoo too and oberserved the same problem you did today. Your post on 13 Jun 2017 looks like you know how to circumvent the problem on gentoo. Would be extremely nice if you could tell me ;-)
Thanks in advance
@l29ah commented on GitHub (Sep 3, 2020):
@Kalle72 USE=xcsecurity emerge x11-base/xorg-server
Probably should be the default.