X11 Guide

This is a basic version that needs some polishing and fixing of the clipboard/resize issue.

Why should I use this?

X11 was not designed with security in mind, has a huge code base and thus should be considered as to be avoided for security.

Abstract unix sockets

Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set.

This is a very commonly seen warning. Abstract unix sockets (see man unix) have a path name starting with the NUL character, effectively zeroing their path length. As such they are not represented in the file system. Note that these are not the regular unix sockets found in /tmp/.X11-unix/*.

On normal usage of firejail netstat a | grep X11 shows abstract sockets @/tmp/.X11-unix/X0 that hackers can use to attach keylogger and screenshot programs to.

Mitigations:

• Pass -nolisten local to Xorg

Trivial to add to ~/.xserverrc, cfr. https://wiki.archlinux.org/title/Xinit#xserverrc. The problem is usually with login managers (GDM) not supporting this option directly and also making it hard to pass additional arguments to the X server. Lightdm can be easily configured to disable both TCP connections + abstract X11 socket via its xserver-command configuration option.

• Use a firejailed x11 server or Wayland

Sanboxing servers

Supported ways to firejail X11 servers and their limitations.

General

Exchanging clipboard content with X server is cumbersome and may give false sense of security.

xephyr

There are no known performance issues apart from the issue that mouse cursor occasionally stutters. Use ctrl+shift to move mouse outside of sandbox. Applications need openbox with configuration and scripting for proper alignment and resizing.

xpra

Many dependencies, 2 python environments running and on idle 3-4% CPU usage.

xvfb

TODO testing

Usage

firejail --x11=[xpra|xephyr|xvfb] --net=NETWORKADAPTER PROGRAM

Installation

$PREFIX is typically / or /usr/local/.

1. Install xephyr,openbox, (optionally tcl,tk,xclip) XOR xpra. When you installed xpra you only need to set the network adapter as explained in step 4.

2. Create an openbox configuration file, ie in $HOME/.config/openbox/rc.xml with content

<application class="*">
  <decor>no</decor>
  <maximized>yes</maximized>
</application>

3. Adjust $PREFIX/etc/firejail/firejail.config (firejail configuration) by the according output of setxkbmap -query on your main session ie

xephyr-screen 950x1024
xephyr-extra-paramts -resizeable -keybd ephyr,xkbmodel=evdev,xkblayout=de

4. Create aliases for shell portability (functions are not portable)

Create .config/shells/aliases with entries NET being one of your network adapter (output of ip addr show or ls /sys/class/net, falkla means falkon and lan):

alias falkla='mkdir -p "$HOME/tmpFalk" ; firejail --x11=xephyr --net=NET \
  --whitelist="$HOME/tmpFalk" --whitelist="$HOME/.config/openbox/rc.xml" \
  --profile="$PREFIX/etc/firejail/falkon.profile" openbox \
  --config-profile="$HOME/.config/openbox/rc.xml" --startup "falkon"; \
  rm -fr "$HOME/tmpFalk"'

alias firela='mkdir -p "$HOME/tmpsecFire" ; firejail --x11=xephyr --net=NET \
  --private="$HOME/tmpsecFire" --whitelist="$HOME/.config/openbox/rc.xml" \
  --profile="$PREFIX/etc/firejail/firefox.profile" openbox \
  --config-profile="$HOME/.config/openbox/rc.xml" --startup "firefox --no-remote"; \
  rm -fr "$HOME/tmpsecFire"' \

5. Source your aliases ie in .bashrc:

. "$HOME/.config/shells/aliases"

6. Insert this resizing script into your autostart folder (usually called like $HOME/.config/autostart) or use a complete copy-paste approach:

#!/bin/bash
# credits sakaki, GPLv3
declare -a XEPHYRS
rescale_displays() {
  declare -a xephyrs
  local display
  xephyrs=($(pgrep -u "$(id -u)" -a Xephyr | egrep -o "[[:digit:]]+$"))
  for display in "${XEPHYRS[@]}"; do
    xrandr --display ":$display" &> /dev/null
  done
}
renice -n 19 $$ &> /dev/null
while true; do
  rescale_displays
  sleep 1
done

Read the man pages for further configuration.

Advanced configuration

1. Attaching to existing x11 server

Attach any additional program by the display number given in firemon --x11 ie

DISPLAY=:150 PROGRAM

2. TODO: xclipsync appears not to work or write cli for clipboard handling?
3. TODO: Better handling of resizing