x11 work

6 files changed, 56 insertions, 1 deletions

diff --git a/configure b/configure
index 06642abb6..16c62e731 100755
--- a/configure
+++ b/configure
@@ -629,6 +629,7 @@ EGREP
 GREP
 CPP
 HAVE_FATAL_WARNINGS
+HAVE_X11
 HAVE_USERNS
 HAVE_NETWORK
 HAVE_BIND
@@ -691,6 +692,7 @@ enable_chroot
 enable_bind
 enable_network
 enable_userns
+enable_x11
 enable_fatal_warnings
 '
       ac_precious_vars='build_alias
@@ -1316,6 +1318,7 @@ Optional Features:
   --disable-bind          disable bind
   --disable-network       disable network
   --disable-userns        disable user namespace
+  --disable-x11           disable X11 support
   --enable-fatal-warnings -W -Wall -Werror
 
 Some influential environment variables:
@@ -3119,6 +3122,19 @@ if test "x$enable_userns" != "xno"; then :
 
 fi
 
+HAVE_X11=""
+# Check whether --enable-x11 was given.
+if test "${enable_x11+set}" = set; then :
+  enableval=$enable_x11;
+fi
+
+if test "x$enable_x11" != "xno"; then :
+
+        HAVE_X11="-DHAVE_X11"
+
+
+fi
+
 HAVE_FATAL_WARNINGS=""
 # Check whether --enable-fatal_warnings was given.
 if test "${enable_fatal_warnings+set}" = set; then :
@@ -4777,6 +4793,7 @@ echo "   chroot: $HAVE_CHROOT"
 echo "   bind: $HAVE_BIND"
 echo "   network: $HAVE_NETWORK"
 echo "   user namespace: $HAVE_USERNS"
+echo "   X11 support: $HAVE_X11"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo
 
diff --git a/configure.ac b/configure.ac
index f9d0a3f65..b5dcd6855 100644
--- a/configure.ac
+++ b/configure.ac
@@ -49,6 +49,14 @@ AS_IF([test "x$enable_userns" != "xno"], [
         AC_SUBST(HAVE_USERNS)
 ])
 
+HAVE_X11=""
+AC_ARG_ENABLE([x11],
+    AS_HELP_STRING([--disable-x11], [disable X11 support]))
+AS_IF([test "x$enable_x11" != "xno"], [
+        HAVE_X11="-DHAVE_X11"
+        AC_SUBST(HAVE_X11)
+])
+
 HAVE_FATAL_WARNINGS=""
 AC_ARG_ENABLE([fatal_warnings],
     AS_HELP_STRING([--enable-fatal-warnings], [-W -Wall -Werror]))
@@ -81,6 +89,7 @@ echo "   chroot: $HAVE_CHROOT"
 echo "   bind: $HAVE_BIND"
 echo "   network: $HAVE_NETWORK"
 echo "   user namespace: $HAVE_USERNS"
+echo "   X11 support: $HAVE_X11"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo
 
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in
index cf57d96d5..ba6bda0a5 100644
--- a/src/firejail/Makefile.in
+++ b/src/firejail/Makefile.in
@@ -14,13 +14,14 @@ HAVE_BIND=@HAVE_BIND@
 HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
 HAVE_NETWORK=@HAVE_NETWORK@
 HAVE_USERNS=@HAVE_USERNS@
+HAVE_X11=@HAVE_X11@
 
 
 H_FILE_LIST       = $(sort $(wildcard *.[h]))
 C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_SECCOMP) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_SECCOMP) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/pid.h
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2a5ded984..d2a093520 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -261,12 +261,17 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
 #ifndef HAVE_CHROOT
                 printf("Chroot support is disabled.\n");
 #endif
+#ifndef HAVE_X11
+                printf("X11 support is disabled.\n");
+#endif
                 exit(0);
         }
+#ifdef HAVE_X11
         else if (strcmp(argv[i], "--x11") == 0) {
                 x11_start(argc, argv);
                 exit(0);
         }
+#endif
 #ifdef HAVE_NETWORK     
         else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
                 logargs(argc, argv);
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 5e8fb9bbd..218113f46 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -27,6 +27,7 @@
 #include <sys/mount.h>
 
 void fs_x11(void) {
+#ifdef HAVE_X11
         // extract display
         char *d = getenv("DISPLAY");
         if (!d)
@@ -94,9 +95,11 @@ void fs_x11(void) {
          if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, "none", MS_BIND, "mode=400,gid=0") == -1)
                 errExit("mount");
          fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
+#endif
 }
 
 
+#ifdef HAVE_X11
 void x11_start(int argc, char **argv) {
         EUID_ASSERT();
         int i;
@@ -215,3 +218,4 @@ void x11_start(int argc, char **argv) {
                 printf("Xpra server pid %d, client pid %d\n", server, client);
         exit(0);
 }
+#endif
diff --git a/test/compile/compile.sh b/test/compile/compile.sh
index 789ebbf28..d191b4d2b 100755
--- a/test/compile/compile.sh
+++ b/test/compile/compile.sh
@@ -6,6 +6,7 @@ arr[3]="TEST 3: compile chroot disabled"
 arr[4]="TEST 4: compile bind disabled"
 arr[5]="TEST 5: compile user namespace disabled"
 arr[6]="TEST 6: compile network disabled"
+arr[7]="TEST 7: compile X11 disabled"
 
 
 # remove previous reports and output file
@@ -146,6 +147,23 @@ grep Warning output-configure output-make > ./report-test6
 grep Error output-configure output-make >> ./report-test6
 rm output-configure output-make
 
+#*****************************************************************
+# TEST 7
+#*****************************************************************
+# - disable X11 support
+# - check compilation
+#*****************************************************************
+print_title "${arr[6]}"
+# seccomp
+cd firejail
+make distclean
+./configure --prefix=/usr --disable-x11  --enable-fatal-warnings 2>&1 | tee ../output-configure
+make -j4 2>&1 | tee ../output-make
+cd ..
+grep Warning output-configure output-make > ./report-test7
+grep Error output-configure output-make >> ./report-test7
+rm output-configure output-make
+
 
 #*****************************************************************
 # PRINT REPORTS
@@ -167,3 +185,4 @@ echo ${arr[3]}
 echo ${arr[4]}
 echo ${arr[5]}
 echo ${arr[6]}
+echo ${arr[7]}