github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1368] Allow Xephyr server dimensions as a command or profile option. #938

New issue

Closed

opened 2026-05-05 07:11:40 -06:00 by gitea-mirror · 7 comments

gitea-mirror commented

2026-05-05 07:11:40 -06:00

Owner

Originally created by @caoliver on GitHub (Jul 8, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1368

Having a fixed size from /etc/firejail/firejail.config that needs adjusting via xrandr is a significant nuisance given that different apps might show best on different screens. While there might be some sanity constraints (i.e. width in [wmin,wmax], height in [hmin,hmax]), shouldn't this be a default overridable in the profile or command line?

Also Xephyr has an option -resizable which enables window manager/mouse-drag resizing of the Xephyr window. This is buggy in Xorg 1.18.3, but there's an easy fix.* In any case this should be a build enabled option for profiles and commands. The default should be here false. Perhaps like the max/min idea, this should be explicitly allowed in the firejail.config.

Maybe I'm missing something about X11 vulnerabilities, but why are the size settings restricted to something that isn't user writable? I'd write these features myself, but as firejail is setuid code, I'm very nervous about touching anything.

https://lists.x.org/archives/xorg-devel/2016-June/050158.html

Originally created by @caoliver on GitHub (Jul 8, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1368 Having a fixed size from /etc/firejail/firejail.config that needs adjusting via xrandr is a significant nuisance given that different apps might show best on different screens. While there might be some sanity constraints (i.e. width in [wmin,wmax], height in [hmin,hmax]), shouldn't this be a default overridable in the profile or command line? Also Xephyr has an option -resizable which enables window manager/mouse-drag resizing of the Xephyr window. This is buggy in Xorg 1.18.3, but there's an easy fix.* In any case this should be a build enabled option for profiles and commands. The default should be here false. Perhaps like the max/min idea, this should be explicitly allowed in the firejail.config. Maybe I'm missing something about X11 vulnerabilities, but why are the size settings restricted to something that isn't user writable? I'd write these features myself, but as firejail is setuid code, I'm very nervous about touching anything. * https://lists.x.org/archives/xorg-devel/2016-June/050158.html

gitea-mirror

2026-05-05 07:11:40 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:11:44 -06:00

Author

Owner

@startx2017 commented on GitHub (Jul 10, 2017):

Take a look in /etc/firejail/firejail.config:

# Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
# a full list of resolutions available on your specific setup.
# xephyr-screen 640x480
# xephyr-screen 800x600
# xephyr-screen 1024x768
# xephyr-screen 1280x1024

So, you need to add a "xephyr-screen widthxheight" in that file, or uncomment an existing one. Unfortunately, the setting is global, all sandboxes will use it. I would say we should look into implementing resizable as sugested by @caoliver .

@startx2017 commented on GitHub (Jul 10, 2017): Take a look in /etc/firejail/firejail.config: ````` # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for # a full list of resolutions available on your specific setup. # xephyr-screen 640x480 # xephyr-screen 800x600 # xephyr-screen 1024x768 # xephyr-screen 1280x1024 ````` So, you need to add a "xephyr-screen widthxheight" in that file, or uncomment an existing one. Unfortunately, the setting is global, all sandboxes will use it. I would say we should look into implementing resizable as sugested by @caoliver .

gitea-mirror commented

2026-05-05 07:11:47 -06:00

Author

Owner

@caoliver commented on GitHub (Jul 10, 2017):

"Unfortunately, the setting is global..." Bingo!

Also, some applications (e.g. firefox) set their window size based on the initial screen if it's smaller than expected. Thus, resize-enable and initial screen dimensions should be per-profile options. This should be an easy hack, but again really nothing's easy when writing SUID code. I may take a stab at this, but whether I can come up with something that passes muster for safety is a whole different question. I did make a clone, so I may send you a pull to review. I won't guarantee it will be worthy of anything but contempt though.

@caoliver commented on GitHub (Jul 10, 2017): "Unfortunately, the setting is global..." Bingo! Also, some applications (e.g. firefox) set their window size based on the initial screen if it's smaller than expected. Thus, resize-enable and initial screen dimensions should be per-profile options. This _should_ be an easy hack, but again really nothing's easy when writing SUID code. I may take a stab at this, but whether I can come up with something that passes muster for safety is a whole different question. I did make a clone, so I may send you a pull to review. I won't guarantee it will be worthy of anything but contempt though.

gitea-mirror commented

2026-05-05 07:11:48 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 13, 2017):

In /etc/firejail/firejail.config add "xephyr-extra-params -resizeable". You'll be able to resize the xephyr window. Somehow this information doesn't get forwarded to the application. For example, Firefox still thinks is running on 800x600, something is missing. I've played also with some window manager, in order to have them pick up the new screen dimension you would have to restart them.

@netblue30 commented on GitHub (Jul 13, 2017): In /etc/firejail/firejail.config add "xephyr-extra-params -resizeable". You'll be able to resize the xephyr window. Somehow this information doesn't get forwarded to the application. For example, Firefox still thinks is running on 800x600, something is missing. I've played also with some window manager, in order to have them pick up the new screen dimension you would have to restart them.

gitea-mirror commented

2026-05-05 07:11:50 -06:00

Author

Owner

@caoliver commented on GitHub (Jul 13, 2017):

I must be being unclear. Let me explain again. I strongly believe that while it's fine to have window size parameters in /etc/firejail/firejail.config, these are global setting, and without good security reasons, it is a poor choice not to permit overriding this in the profile or on the command line. Why should I need to become root the change the initial window size for a program? Why should all jailed applications share the same initial size or resizability? For these things /etc/firejail/firejail.config settings should be overridable defaults without good security reasons to the contrary.

@caoliver commented on GitHub (Jul 13, 2017): I must be being unclear. Let me explain again. I strongly believe that while it's fine to have window size parameters in /etc/firejail/firejail.config, these are global setting, and without good security reasons, it is a poor choice not to permit overriding this in the profile or on the command line. Why should I need to become root the change the initial window size for a program? Why should all jailed applications share the same initial size or resizability? For these things /etc/firejail/firejail.config settings should be overridable defaults without good security reasons to the contrary.

gitea-mirror commented

2026-05-05 07:11:51 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 16, 2017):

OK, so if I understand correctly, you need a command line option like "--xephyr-screen=..." to overwrite the default in /etc/firejail/firejail.config.

@netblue30 commented on GitHub (Jul 16, 2017): OK, so if I understand correctly, you need a command line option like "--xephyr-screen=..." to overwrite the default in /etc/firejail/firejail.config.

gitea-mirror commented

2026-05-05 07:11:52 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 19, 2017):

All set, use --xephyr-screen=WIDTHxHEIGHT on command line, or "xephyr-screen WIDTHxHEIGHT" in a profile file.

@netblue30 commented on GitHub (Jul 19, 2017): All set, use --xephyr-screen=WIDTHxHEIGHT on command line, or "xephyr-screen WIDTHxHEIGHT" in a profile file.

gitea-mirror commented

2026-05-05 07:11:53 -06:00

Author

Owner

@caoliver commented on GitHub (Jul 27, 2017):

Thank you.

@caoliver commented on GitHub (Jul 27, 2017): Thank you.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#938

No description provided.

Rows
Columns