dropping requirement for network namespace when using --x11

3 files changed, 15 insertions, 3 deletions

diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 3dbfe3909..b40f8a3fa 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1143,6 +1143,7 @@ int fs_check_chroot_dir(const char *rootdir) {
 
         // check x11 socket directory
         if (getenv("FIREJAIL_X11")) {
+                mask_x11_abstract_socket = 1;
                 char *name;
                 if (asprintf(&name, "%s/tmp/.X11-unix", rootdir) == -1)
                         errExit("asprintf");
@@ -1173,6 +1174,7 @@ void fs_chroot(const char *rootdir) {
                 
                 // x11
                 if (getenv("FIREJAIL_X11")) {
+                        mask_x11_abstract_socket = 1;
                         char *newx11;
                         if (asprintf(&newx11, "%s/tmp/.X11-unix", rootdir) == -1)
                                 errExit("asprintf");
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 8576c9ee4..91ea523ab 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2266,6 +2266,10 @@ int main(int argc, char **argv) {
                         fprintf(stderr, "Warning: --trace and --tracelog are mutually exclusive; --tracelog disabled\n");
         }
         
+        // disable x11 abstract socket
+        if (getenv("FIREJAIL_X11"))
+                mask_x11_abstract_socket = 1;
+        
         // check user namespace (--noroot) options
         if (arg_noroot) {
                 if (arg_overlay) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 079324f14..faf6c49b6 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -667,8 +667,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
-                        if (x11env && strcmp(x11env, "yes") == 0)
+                        if (x11env && strcmp(x11env, "yes") == 0) {
+                                mask_x11_abstract_socket = 1;
                                 return 0;
+                        }
                         else {
                                 // start x11
                                 x11_start_xephyr(cfg.original_argc, cfg.original_argv);
@@ -683,8 +685,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
-                        if (x11env && strcmp(x11env, "yes") == 0)
+                        if (x11env && strcmp(x11env, "yes") == 0) {
+                                mask_x11_abstract_socket = 1;
                                 return 0;
+                        }
                         else {
                                 // start x11
                                 x11_start_xpra(cfg.original_argc, cfg.original_argv);
@@ -699,8 +703,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
-                        if (x11env && strcmp(x11env, "yes") == 0)
+                        if (x11env && strcmp(x11env, "yes") == 0) {
+                                mask_x11_abstract_socket = 1;
                                 return 0;
+                        }
                         else {
                                 // start x11
                                 x11_start(cfg.original_argc, cfg.original_argv);