renamed --x11=block to --x11=none, brought back the requirement for network namespaces for x11 sandboxing

3 files changed, 4 insertions, 7 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index 91ea523ab..c4b7ce4dc 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2208,7 +2208,7 @@ int main(int argc, char **argv) {
                                 return 1;
                         }
                 }
-                else if (strcmp(argv[i], "--x11=block") == 0) {
+                else if (strcmp(argv[i], "--x11=none") == 0) {
                         arg_x11_block = 1;
                 }
                 else if (strncmp(argv[i], "--join-or-start=", 16) == 0) {
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 36023e067..def1dd324 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -52,7 +52,6 @@ static int x11_check_xephyr(void) {
         return 1;
 }
 
-#if 0
 // check for X11 abstract sockets
 static int x11_abstract_sockets_present(void) {
         char *path;
@@ -77,7 +76,6 @@ static int x11_abstract_sockets_present(void) {
 
         return 0;
 }
-#endif
 
 static int random_display_number(void) {
         int i;
@@ -598,18 +596,17 @@ void x11_start(int argc, char **argv) {
 void x11_block(void) {
 #ifdef HAVE_X11
         mask_x11_abstract_socket = 1;
-#if 0
+
         // check abstract socket presence and network namespace options
         if ((!arg_nonetwork && !cfg.bridge0.configured && !cfg.interface0.configured)
                 && x11_abstract_sockets_present()) {
-                fprintf(stderr, "ERROR: --x11=block specified, but abstract X11 socket still accessible.\n"
+                fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n"
                                                 "Additional setup required. To block abstract X11 socket you can either:\n"
                                                 " * use network namespace in firejail (--net=none, --net=...)\n"
                                                 " * add \"-nolisten local\" to xserver options\n"
                                                 "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
                 exit(1);
         }
-#endif
 
         // blacklist sockets
         profile_check_line("blacklist /tmp/.X11-unix", 0, NULL);
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 3ceb21e78..aadc54677 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1713,7 +1713,7 @@ Example:
 $ firejail \-\-x11=xephyr --net=eth0 openbox
 
 .TP
-\fB\-\-x11=block
+\fB\-\-x11=none
 Blacklist /tmp/.X11-unix directory, ${HOME}/.Xauthority and file specified in ${XAUTHORITY} environment variable.
 Remove DISPLAY and XAUTHORITY environment variables.
 Stop with error message if X11 abstract socket will be accessible in jail.