github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1462] Unable to --join to -x11 firefox #982

New issue

Closed

opened 2026-05-05 07:15:35 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 07:15:35 -06:00

Owner

Originally created by @Boruch-Baum on GitHub (Aug 11, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1462

For the following command sequence:

    firejail --name=firefox --x11 firefox google.com
    firejail --join=firefox firefox github.com

The second command recognizes that an instance of firefox exists, but won't join to it. What it does is say that the default firefox profile (not firejail profile) is being used, and prompts to choose another.

On the other hand, without --x11, the sequence works fine:

    firejail --name=firefox firefox google.com
    firejail --join=firefox firefox github.com

Now, checking other scenarios, the situation is worst than I thought. --join isn't even needed to join the sandboxed firefox, in the following:

    firejail firefox google.com
    firejail firefox github.com

It seems I don't even need to use firejail at all to enter the sandboxed instance:

    firejail firefox google.com
    /usr/bin/firefox github.com

And it is getting more confusing. The firefox instance does seem to be sandboxed, because it doesn't see my entire local filesystem, but the following commands don't list a firejailed firefox

    firejail --list
    firejail --top
    firejail --tree

Originally created by @Boruch-Baum on GitHub (Aug 11, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1462 For the following command sequence: ~~~~ firejail --name=firefox --x11 firefox google.com firejail --join=firefox firefox github.com ~~~~ The second command recognizes that an instance of firefox exists, but won't join to it. What it does is say that the default firefox profile (not firejail profile) is being used, and prompts to choose another. On the other hand, without --x11, the sequence works fine: ~~~~ firejail --name=firefox firefox google.com firejail --join=firefox firefox github.com ~~~~ Now, checking other scenarios, the situation is worst than I thought. --join isn't even needed to join the sandboxed firefox, in the following: ~~~~ firejail firefox google.com firejail firefox github.com ~~~~ It seems I don't even need to use firejail at all to enter the sandboxed instance: ~~~~ firejail firefox google.com /usr/bin/firefox github.com ~~~~ And it is getting more confusing. The firefox instance does seem to be sandboxed, because it doesn't see my entire local filesystem, but the following commands don't list a firejailed firefox ~~~~ firejail --list firejail --top firejail --tree ~~~~

gitea-mirror

2026-05-05 07:15:35 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 07:15:39 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (Aug 12, 2017):

I'm not sure about the whole join stuff. But with regards to firefox, that is expected behavior:

Note: by default, a single Firefox process instance handles multiple browser windows. If you already have Firefox running, you would need to use -no-remote command line option, otherwise you end up with a new tab or a new window attached to the existing Firefox process:

(from https://firejail.wordpress.com/documentation-2/firefox-guide/#run)

As for why it's not listed in those commands...that also doesn't make much sense. Can you see a firejail firefox process in top or ps?

@chiraag-nataraj commented on GitHub (Aug 12, 2017): I'm not sure about the whole `join` stuff. But with regards to `firefox`, that is expected behavior: > Note: by default, a single Firefox process instance handles multiple browser windows. If you already have Firefox running, you would need to use -no-remote command line option, otherwise you end up with a new tab or a new window attached to the existing Firefox process: (from https://firejail.wordpress.com/documentation-2/firefox-guide/#run) As for why it's not listed in those commands...that also doesn't make much sense. Can you see a `firejail firefox` process in top or ps?

gitea-mirror commented

2026-05-05 07:15:42 -06:00

Author

Owner

@Boruch-Baum commented on GitHub (Aug 13, 2017):

Yes @chiraag-nataraj, "firejail firefox" appears in output for both "htop" and "pgrep -a". In both cases, two processes are shown.

@Boruch-Baum commented on GitHub (Aug 13, 2017): Yes @chiraag-nataraj, "firejail firefox" appears in output for both "htop" and "pgrep -a". In both cases, two processes are shown.

gitea-mirror commented

2026-05-05 07:15:45 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 13, 2017):

I'll try to reproduce it here, thanks.

@netblue30 commented on GitHub (Aug 13, 2017): I'll try to reproduce it here, thanks.

gitea-mirror commented

2026-05-05 07:15:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 13, 2017):

Quite easy to reproduce:

$ firejail --name=test --x11 xterm
$ firejail --join=test env | grep DISPLAY
DISPLAY=:0.0

The x11 display number is not restored by --join command. It seems firefox uses x11 socket to detect other instances, and the instance we are interested in is running on a different x11 server. Thanks for the bug!

@netblue30 commented on GitHub (Aug 13, 2017): Quite easy to reproduce: ````` $ firejail --name=test --x11 xterm $ firejail --join=test env | grep DISPLAY DISPLAY=:0.0 ````` The x11 display number is not restored by --join command. It seems firefox uses x11 socket to detect other instances, and the instance we are interested in is running on a different x11 server. Thanks for the bug!

gitea-mirror commented

2026-05-05 07:15:48 -06:00

Author

Owner

@startx2017 commented on GitHub (Aug 15, 2017):

I have a fix in git, thank you for the bug.

@startx2017 commented on GitHub (Aug 15, 2017): I have a fix in git, thank you for the bug.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#982

No description provided.

Rows
Columns