add HAS_X11 conditional, disconnect session manager - #2205

3 files changed, 11 insertions, 1 deletions

diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 68176e9e0..35789df2e 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -62,6 +62,10 @@ blacklist /etc/X11/Xsession.d
 blacklist /etc/xdg/autostart
 read-only ${HOME}/.Xauthority
 
+# Session manager
+?HAS_X11: blacklist ${HOME}/.ICEauthority
+?HAS_X11: blacklist /tmp/.ICE-unix
+
 # KDE config
 blacklist ${HOME}/.config/khotkeysrc
 blacklist ${HOME}/.config/krunnerrc
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 7303d30f8..40f3c3be7 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -147,6 +147,10 @@ static int check_nodbus(void) {
         return arg_nodbus != 0;
 }
 
+static int check_x11(void) {
+        return (arg_x11_block || getenv("FIREJAIL_X11"));
+}
+
 static int check_disable_u2f(void) {
         return checkcfg(CFG_BROWSER_DISABLE_U2F) != 0;
 }
@@ -158,6 +162,7 @@ static int check_allow_drm(void) {
 Cond conditionals[] = {
         {"HAS_APPIMAGE", check_appimage},
         {"HAS_NODBUS", check_nodbus},
+        {"HAS_X11", check_x11},
         {"BROWSER_DISABLE_U2F", check_disable_u2f},
         {"BROWSER_ALLOW_DRM", check_allow_drm},
         { NULL, NULL }
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 82ca103c9..4a84cc828 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -103,7 +103,8 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir"
 
 This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line.
 
-Currently the only conditionals supported are HAS_APPIMAGE, HAS_NODBUS, BROWSER_DISABLE_U2F, and BROWSER_ALLOW_DRM.
+Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NODBUS and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM
+can be enabled or disabled globally in Firejail's configuration file.
 
 The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines.