x11 xorg: blacklist non-default Xauthority file

fixes #1652

1 files changed, 14 insertions, 0 deletions

diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 0927593b0..e707ab8bd 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -1238,6 +1238,20 @@ void x11_xorg(void) {
                 errLogExit("invalid .Xauthority mount");
 
         ASSERT_PERMS(dest, getuid(), getgid(), 0600);
+        
+        // blacklist .Xauthority file if it is not masked already
+        char *envar = getenv("XAUTHORITY");
+        if (envar) {
+                char *rp = realpath(envar, NULL);
+                if (rp) {
+                        if (strcmp(rp, dest) != 0)
+                                disable_file_or_dir(rp);
+                        free(rp);
+                }
+                // update environment variable, so our new .Xauthority file is used
+                if (setenv("XAUTHORITY", dest, 1) < 0)
+                        errExit("setenv");
+        }
         free(dest);
 #endif
 }