6 files changed, 583 insertions, 508 deletions

diff --git a/README b/README
index 52c5f7dd2..b12ad7b59 100644
--- a/README
+++ b/README
@@ -104,7 +104,14 @@ valoq (https://github.com/valoq)
 Zack Weinberg (https://github.com/zackw)
         - removed libconnect
         - fixed memory corruption in noblacklist processing
-        - rework DISPLAY environment parsing, rework masking X11 sockets in /tmp/.X11-unix directory
+        - rework DISPLAY environment parsing
+        - rework masking X11 sockets in /tmp/.X11-unix directory
+        - rework xpra and xephyr detection
+        - rework abstract X11 socket detection
+        - rework X11 display number assignment
+        - rework X11 xorg processing
+        - rework fcopy, --follow-link support in fcopy
+        - follow link support in --private-bin
 Igor Bukanov (https://github.com/ibukanov)
         - found/fiixed privilege escalation in --hosts-file option
 Cat (https://github.com/ecat3)
diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index 43fc8fc99..9f19b6dd8 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -21,6 +21,9 @@
 #include "../include/common.h"
 #include <fcntl.h>
 #include <ftw.h>
+#include <errno.h>
+
+static int arg_follow_link = 0;
 
 
 #define COPY_LIMIT (500 * 1024 *1024)
@@ -34,245 +37,244 @@ static char *inpath = NULL;
 
 // modified version of the function from util.c
 static void copy_file(const char *srcname, const char *destname, mode_t mode, uid_t uid, gid_t gid) {
-        assert(srcname);
-        assert(destname);
-        mode &= 07777;
-        
-        // open source
-        int src = open(srcname, O_RDONLY);
-        if (src < 0) {
-                fprintf(stderr, "Warning fcopy: cannot open %s, file not copied\n", srcname);
-                return;
-        }
-
-        // open destination
-        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, 0755);
-        if (dst < 0) {
-                fprintf(stderr, "Warning fcopy: cannot open %s, file not copied\n", destname);
-                close(src);
-                return;
-        }
-
-        // copy
-        ssize_t len;
-        static const int BUFLEN = 1024;
-        unsigned char buf[BUFLEN];
-        while ((len = read(src, buf, BUFLEN)) > 0) {
-                int done = 0;
-                while (done != len) {
-                        int rv = write(dst, buf + done, len - done);
-                        if (rv == -1)
-                                goto errexit;
-                        done += rv;
-                }
-        }
-        fflush(0);
-
-        if (fchown(dst, uid, gid) == -1)
-                goto errexit;
-        if (fchmod(dst, mode) == -1)
-                goto errexit;
-
-        close(src);
-        close(dst);
-
-        return;
+        assert(srcname);
+        assert(destname);
+        mode &= 07777;
+
+        // open source
+        int src = open(srcname, O_RDONLY);
+        if (src < 0) {
+                fprintf(stderr, "Warning fcopy: cannot open %s, file not copied\n", srcname);
+                return;
+        }
+
+        // open destination
+        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, 0755);
+        if (dst < 0) {
+                fprintf(stderr, "Warning fcopy: cannot open %s, file not copied\n", destname);
+                close(src);
+                return;
+        }
+
+        // copy
+        ssize_t len;
+        static const int BUFLEN = 1024;
+        unsigned char buf[BUFLEN];
+        while ((len = read(src, buf, BUFLEN)) > 0) {
+                int done = 0;
+                while (done != len) {
+                        int rv = write(dst, buf + done, len - done);
+                        if (rv == -1)
+                                goto errexit;
+                        done += rv;
+                }
+        }
+        fflush(0);
+
+        if (fchown(dst, uid, gid) == -1)
+                goto errexit;
+        if (fchmod(dst, mode) == -1)
+                goto errexit;
+
+        close(src);
+        close(dst);
+
+        return;
 
 errexit:
-        close(src);
-        close(dst);
-        unlink(destname);
-        fprintf(stderr, "Warning fcopy: cannot copy %s\n", destname);
+        close(src);
+        close(dst);
+        unlink(destname);
+        fprintf(stderr, "Warning fcopy: cannot copy %s\n", destname);
 }
 
 
 
 // modified version of the function in firejail/util.c
 static void mkdir_attr(const char *fname, mode_t mode, uid_t uid, gid_t gid) {
-        assert(fname);
-        mode &= 07777;
-
-        if (mkdir(fname, mode) == -1 ||
-            chmod(fname, mode) == -1) {
-                fprintf(stderr, "Error fcopy: failed to create %s directory\n", fname);
-                errExit("mkdir/chmod");
-        }
-        if (chown(fname, uid, gid))
-                fprintf(stderr, "Warning fcopy: failed to change ownership of %s\n", fname);
+        assert(fname);
+        mode &= 07777;
+
+        if (mkdir(fname, mode) == -1 ||
+            chmod(fname, mode) == -1) {
+                fprintf(stderr, "Error fcopy: failed to create %s directory\n", fname);
+                errExit("mkdir/chmod");
+        }
+        if (chown(fname, uid, gid))
+                fprintf(stderr, "Warning fcopy: failed to change ownership of %s\n", fname);
 }
 
 void copy_link(const char *target, const char *linkpath, mode_t mode, uid_t uid, gid_t gid) {
-        (void) mode;
-        (void) uid;
-        (void) gid;
-        char *rp = realpath(target, NULL);
-        if (rp) {
-                if (symlink(rp, linkpath) == -1)
-                        goto errout;
-                free(rp);
-        }
-        else
-                goto errout;
-
-        return;
+        (void) mode;
+        (void) uid;
+        (void) gid;
+        char *rp = realpath(target, NULL);
+        if (rp) {
+                if (symlink(rp, linkpath) == -1)
+                        goto errout;
+                free(rp);
+        }
+        else
+                goto errout;
+
+        return;
 errout:
-        fprintf(stderr, "Warning fcopy: cannot create symbolic link %s\n", target);
+        fprintf(stderr, "Warning fcopy: cannot create symbolic link %s\n", target);
 }
 
 static int first = 1;
 static int fs_copydir(const char *infname, const struct stat *st, int ftype, struct FTW *sftw) {
-        (void) st;
-        (void) sftw;
-        assert(infname);
-        assert(*infname != '\0');
-        assert(outpath);
-        assert(*outpath != '\0');
-        assert(inpath);
-        
-        // check size limit
-        if (size_limit_reached)
-                return 0;
-
-
-        char *outfname;
-        if (asprintf(&outfname, "%s%s", outpath, infname + strlen(inpath)) == -1)
-                errExit("asprintf");
-
-//printf("outpaht %s\n", outpath);
-//printf("inpath %s\n", inpath);
-//printf("infname %s\n", infname);
-//printf("outfname %s\n\n", outfname);
-
-        // don't copy it if we already have the file
-        struct stat s;
-        if (stat(outfname, &s) == 0) {
-                if (first)
-                        first = 0;
-                else    
-                        fprintf(stderr, "Warning fcopy: skipping %s, file already present\n", infname);
-                free(outfname);
-                return 0;
-        }
-        
-        // extract mode and ownership
-        if (stat(infname, &s) != 0) {
-                fprintf(stderr, "Warning fcopy: skipping %s, cannot find inode\n", infname);
-                free(outfname);
-                return 0;
-        }
-        uid_t uid = s.st_uid;
-        gid_t gid = s.st_gid;
-        mode_t mode = s.st_mode;
-
-        // recalculate size
-        if ((s.st_size + size_cnt) > COPY_LIMIT) {
-                fprintf(stderr, "Error fcopy: size limit of %dMB reached\n", (COPY_LIMIT / 1024) / 1024);
-                size_limit_reached = 1;
-                free(outfname);
-                return 0;
-        }
-
-        file_cnt++;
-        size_cnt += s.st_size;
-
-        if(ftype == FTW_F) {
-                copy_file(infname, outfname, mode, uid, gid);
-        }
-        else if (ftype == FTW_D) {
-                mkdir_attr(outfname, mode, uid, gid);
-        }               
-        else if (ftype == FTW_SL) {
-                copy_link(infname, outfname, mode, uid, gid);
-        }               
-
-        return(0);
+        (void) st;
+        (void) sftw;
+        assert(infname);
+        assert(*infname != '\0');
+        assert(outpath);
+        assert(*outpath != '\0');
+        assert(inpath);
+
+        // check size limit
+        if (size_limit_reached)
+                return 0;
+
+
+        char *outfname;
+        if (asprintf(&outfname, "%s%s", outpath, infname + strlen(inpath)) == -1)
+                errExit("asprintf");
+
+        // don't copy it if we already have the file
+        struct stat s;
+        if (stat(outfname, &s) == 0) {
+                if (first)
+                        first = 0;
+                else
+                        fprintf(stderr, "Warning fcopy: skipping %s, file already present\n", infname);
+                free(outfname);
+                return 0;
+        }
+
+        // extract mode and ownership
+        if (stat(infname, &s) != 0) {
+                fprintf(stderr, "Warning fcopy: skipping %s, cannot find inode\n", infname);
+                free(outfname);
+                return 0;
+        }
+        uid_t uid = s.st_uid;
+        gid_t gid = s.st_gid;
+        mode_t mode = s.st_mode;
+
+        // recalculate size
+        if ((s.st_size + size_cnt) > COPY_LIMIT) {
+                fprintf(stderr, "Error fcopy: size limit of %dMB reached\n", (COPY_LIMIT / 1024) / 1024);
+                size_limit_reached = 1;
+                free(outfname);
+                return 0;
+        }
+
+        file_cnt++;
+        size_cnt += s.st_size;
+
+        if(ftype == FTW_F) {
+                copy_file(infname, outfname, mode, uid, gid);
+        }
+        else if (ftype == FTW_D) {
+                mkdir_attr(outfname, mode, uid, gid);
+        }
+        else if (ftype == FTW_SL) {
+                copy_link(infname, outfname, mode, uid, gid);
+        }
+
+        return(0);
 }
 
 static char *check(const char *src) {
-        struct stat s;
-        char *rsrc = realpath(src, NULL);
-        if (!rsrc || stat(rsrc, &s) == -1)
-                goto errexit;
-
-        // check uid
-        if (s.st_uid != getuid() || s.st_gid != getgid())
-                goto errexit;
-
-        // dir, link, regular file
-        if (S_ISDIR(s.st_mode) || S_ISREG(s.st_mode) || S_ISLNK(s.st_mode))
-                return rsrc;                      // normal exit from the function
-        
+        struct stat s;
+        char *rsrc = realpath(src, NULL);
+        if (!rsrc || stat(rsrc, &s) == -1)
+                goto errexit;
+
+        // check uid
+        if (s.st_uid != getuid() || s.st_gid != getgid())
+                goto errexit;
+
+        // dir, link, regular file
+        if (S_ISDIR(s.st_mode) || S_ISREG(s.st_mode) || S_ISLNK(s.st_mode))
+                return rsrc;                      // normal exit from the function
+
 errexit:
-        fprintf(stderr, "Error fcopy: invalid file %s\n", src);
-        exit(1);
+        fprintf(stderr, "Error fcopy: invalid file %s\n", src);
+        exit(1);
 }
 
 static void duplicate_dir(const char *src, const char *dest, struct stat *s) {
-        (void) s;
-        char *rsrc = check(src);
-        char *rdest = check(dest);
-        inpath = rsrc;
-        outpath = rdest;
-        
-        // walk
-        if(nftw(rsrc, fs_copydir, 1, FTW_PHYS) != 0) {
-                fprintf(stderr, "Error: unable to copy file\n");
-                exit(1);
-        }
-
-        free(rsrc);
-        free(rdest);
+        (void) s;
+        char *rsrc = check(src);
+        char *rdest = check(dest);
+        inpath = rsrc;
+        outpath = rdest;
+
+        // walk
+        if(nftw(rsrc, fs_copydir, 1, FTW_PHYS) != 0) {
+                fprintf(stderr, "Error: unable to copy file\n");
+                exit(1);
+        }
+
+        free(rsrc);
+        free(rdest);
 }
 
 static void duplicate_file(const char *src, const char *dest, struct stat *s) {
-        char *rsrc = check(src);
-        char *rdest = check(dest);
-        uid_t uid = s->st_uid;
-        gid_t gid = s->st_gid;
-        mode_t mode = s->st_mode;
-        
-        // build destination file name
-        char *name;
-        char *ptr = strrchr(rsrc, '/');
-        ptr++;
-        if (asprintf(&name, "%s/%s", rdest, ptr) == -1)
-                errExit("asprintf");
-        
-        // copy
-        copy_file(rsrc, name, mode, uid, gid);
-
-        free(name);
-        free(rsrc);
-        free(rdest);
+        char *rsrc = check(src);
+        char *rdest = check(dest);
+        uid_t uid = s->st_uid;
+        gid_t gid = s->st_gid;
+        mode_t mode = s->st_mode;
+
+        // build destination file name
+        char *name;
+        char *ptr = (arg_follow_link)? strrchr(src, '/'): strrchr(rsrc, '/');
+        ptr++;
+        if (asprintf(&name, "%s/%s", rdest, ptr) == -1)
+                errExit("asprintf");
+
+        // copy
+        copy_file(rsrc, name, mode, uid, gid);
+
+        free(name);
+        free(rsrc);
+        free(rdest);
 }
 
 static void duplicate_link(const char *src, const char *dest, struct stat *s) {
-        char *rsrc = check(src); // we drop the result and use the original name
-        char *rdest = check(dest);
-        uid_t uid = s->st_uid;
-        gid_t gid = s->st_gid;
-        mode_t mode = s->st_mode;
-        
-        // build destination file name
-        char *name;
-//      char *ptr = strrchr(rsrc, '/');
-        char *ptr = strrchr(src, '/');
-        ptr++;
-        if (asprintf(&name, "%s/%s", rdest, ptr) == -1)
-                errExit("asprintf");
-        
-        // copy
-        copy_link(rsrc, name, mode, uid, gid);
-
-        free(name);
-        free(rsrc);
-        free(rdest);
+        char *rsrc = check(src); // we drop the result and use the original name
+        char *rdest = check(dest);
+        uid_t uid = s->st_uid;
+        gid_t gid = s->st_gid;
+        mode_t mode = s->st_mode;
+
+        // build destination file name
+        char *name;
+//     char *ptr = strrchr(rsrc, '/');
+        char *ptr = strrchr(src, '/');
+        ptr++;
+        if (asprintf(&name, "%s/%s", rdest, ptr) == -1)
+                errExit("asprintf");
+
+        // copy
+        copy_link(rsrc, name, mode, uid, gid);
+
+        free(name);
+        free(rsrc);
+        free(rdest);
 }
 
 static void usage(void) {
-        printf("Usage: fcopy src dest\n");
-        printf("Copy src file in dest directory. If src is a directory, copy all the files in\n");
-        printf("src recoursively. If the destination directory does not exist, it will be created.\n");
+        fputs("Usage: fcopy [--follow-link] src dest\n"
+              "\n"
+              "Copy SRC to DEST/SRC. SRC may be a file, directory, or symbolic link.\n"
+              "If SRC is a directory it is copied recursively.  If it is a symlink,\n"
+              "the link itself is duplicated, unless --follow-link is given,\n"
+              "in which case the destination of the link is copied.\n"
+              "DEST must already exist and must be a directory.\n", stderr);
 }
 
 int main(int argc, char **argv) {
@@ -285,56 +287,70 @@ for (i = 0; i < argc; i++)
 printf("\n");
 }
 #endif  
-        if (argc != 3) {
-                fprintf(stderr, "Error fcopy: files missing\n");
-                usage();
-                exit(1);
-        }
-        
-        // check the two files; remove ending /
-        char *src = argv[1];
-        int len = strlen(src);
-        if (src[len - 1] == '/')
-                src[len - 1] = '\0';
-        if (strcspn(src, "\\*&!?\"'<>%^(){}[];,") != (size_t)len) {
-                fprintf(stderr, "Error fcopy: invalid file name %s\n", src);
-                exit(1);
-        }
-        
-        char *dest = argv[2];
-        len = strlen(dest);
-        if (dest[len - 1] == '/')
-                dest[len - 1] = '\0';
-        if (strcspn(dest, "\\*&!?\"'<>%^(){}[];,~") != (size_t)len) {
-                fprintf(stderr, "Error fcopy: invalid file name %s\n", dest);
-                exit(1);
-        }
-        
-
-        // the destination should be a directory; 
-        struct stat s;
-        if (stat(dest, &s) == -1 ||
-            !S_ISDIR(s.st_mode)) {
-                fprintf(stderr, "Error fcopy: invalid destination directory\n");
-                exit(1);
-        }
-        
-        // copy files
-        if (lstat(src, &s) == -1) {
-                fprintf(stderr, "Error fcopy: cannot find source file\n");
-                exit(1);
-        }
-
-        if (S_ISDIR(s.st_mode))
-                duplicate_dir(src, dest, &s);
-        else if (S_ISREG(s.st_mode))
-                duplicate_file(src, dest, &s);
-        else if (S_ISLNK(s.st_mode))
-                duplicate_link(src, dest, &s);
-        else {
-                fprintf(stderr, "Error fcopy: source file unsupported\n");
-                exit(1);
-        }
-                
-        return 0;
+        char *src;
+        char *dest;
+
+        if (argc == 3) {
+                src = argv[1];
+                dest = argv[2];
+                arg_follow_link = 0;
+        }
+        else if (argc == 4 && !strcmp(argv[1], "--follow-link")) {
+                src = argv[2];
+                dest = argv[3];
+                arg_follow_link = 1;
+        }
+        else {
+                    fprintf(stderr, "Error: arguments missing\n");
+                usage();
+                exit(1);
+        }
+
+        // check the two files; remove ending /
+        int len = strlen(src);
+        if (src[len - 1] == '/')
+                src[len - 1] = '\0';
+        if (strcspn(src, "\\*&!?\"'<>%^(){}[];,") != (size_t)len) {
+                fprintf(stderr, "Error fcopy: invalid source file name %s\n", src);
+                exit(1);
+        }
+
+        len = strlen(dest);
+        if (dest[len - 1] == '/')
+                dest[len - 1] = '\0';
+        if (strcspn(dest, "\\*&!?\"'<>%^(){}[];,~") != (size_t)len) {
+                fprintf(stderr, "Error fcopy: invalid dest file name %s\n", dest);
+                exit(1);
+        }
+
+
+        // the destination should be a directory;
+        struct stat s;
+        if (stat(dest, &s) == -1) {
+                fprintf(stderr, "Error fcopy: dest dir %s: %s\n", dest, strerror(errno));
+                exit(1);
+        }
+        if (!S_ISDIR(s.st_mode)) {
+                fprintf(stderr, "Error fcopy: dest %s is not a directory\n", dest);
+                exit(1);
+        }
+
+        // copy files
+        if ((arg_follow_link ? stat : lstat)(src, &s) == -1) {
+                fprintf(stderr, "Error fcopy: src %s: %s\n", src, strerror(errno));
+                exit(1);
+        }
+
+        if (S_ISDIR(s.st_mode))
+                duplicate_dir(src, dest, &s);
+        else if (S_ISREG(s.st_mode))
+                duplicate_file(src, dest, &s);
+        else if (S_ISLNK(s.st_mode))
+                duplicate_link(src, dest, &s);
+        else {
+                fprintf(stderr, "Error fcopy: src %s is an unsupported type of file\n", src);
+                exit(1);
+        }
+
+        return 0;
 }
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 547978b47..3473fca4c 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -111,7 +111,7 @@ static void duplicate(char *fname) {
                 errExit("asprintf");
         
         // copy the file
-        sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR);
+        sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", full_path, RUN_BIN_DIR);
         fs_logger2("clone", fname);
         free(full_path);
 }
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index b551a2d2a..0fa789ff1 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -20,6 +20,8 @@
 #include "firejail.h"
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/socket.h>
+#include <sys/un.h>
 #include <fcntl.h>
 #include <unistd.h>
 #include <signal.h>
@@ -31,80 +33,6 @@
 #include <limits.h>
 int mask_x11_abstract_socket = 0;
 
-#ifdef HAVE_X11
-// return 1 if xpra is installed on the system
-static int x11_check_xpra(void) {
-        struct stat s;
-        
-        // check xpra
-        if (stat("/usr/bin/xpra", &s) == -1)
-                return 0;
-
-        return 1;
-}
-
-// return 1 if xephyr is installed on the system
-static int x11_check_xephyr(void) {
-        struct stat s;
-        
-        // check xephyr
-        if (stat("/usr/bin/Xephyr", &s) == -1)
-                return 0;
-
-        return 1;
-}
-
-// check for X11 abstract sockets
-static int x11_abstract_sockets_present(void) {
-        char *path;
-
-        EUID_ROOT(); // grsecurity fix
-        FILE *fp = fopen("/proc/net/unix", "r");
-        EUID_USER();
-
-        if (!fp)
-                errExit("fopen");
-
-        while (fscanf(fp, "%*s %*s %*s %*s %*s %*s %*s %ms\n", &path) != EOF) {
-                if (path && strncmp(path, "@/tmp/.X11-unix/", 16) == 0) {
-                        free(path);
-                        fclose(fp);
-                        return 1;
-                }
-        }
-
-        free(path);
-        fclose(fp);
-
-        return 0;
-}
-
-static int random_display_number(void) {
-        int i;
-        int found = 1;
-        int display;
-        for (i = 0; i < 100; i++) {
-                display = rand() % 1024;
-                if (display < 10)
-                        continue;
-                char *fname;
-                if (asprintf(&fname, "/tmp/.X11-unix/X%d", display) == -1)
-                        errExit("asprintf");
-                struct stat s;
-                if (stat(fname, &s) == -1) {
-                        found = 1;
-                        break;
-                }
-        }
-        if (!found) {
-                fprintf(stderr, "Error: cannot pick up a random X11 display number, exiting...\n");
-                exit(1);
-        }
-        
-        return display;
-}
-#endif
-
 
 // Parse the DISPLAY environment variable and return a display number.
 // Returns -1 if DISPLAY is not set, or is set to anything other than :ddd.
@@ -145,116 +73,132 @@ int x11_display(void) {
         return (int)display;
 }
 
-void fs_x11(void) {
-#ifdef HAVE_X11
-        int display = x11_display();
-        if (display <= 0)
-                return;
 
-        char *x11file;
-        if (asprintf(&x11file, "/tmp/.X11-unix/X%d", display) == -1)
-                errExit("asprintf");
-        struct stat x11stat;
-        if (stat(x11file, &x11stat) == -1 || !S_ISSOCK(x11stat.st_mode)) {
-                free(x11file);
-                return;
-        }
-
-        if (arg_debug || arg_debug_whitelists)
-                fprintf(stderr, "Masking all X11 sockets except %s\n", x11file);
-
-               // Move the real /tmp/.X11-unix to a scratch location
-                // so we can still access x11file after we mount a
-                // tmpfs over /tmp/.X11-unix.
-                int rv = mkdir(RUN_WHITELIST_X11_DIR, 0700);
-                if (rv == -1)
-                        errExit("mkdir");
-                if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 0700))
-                        errExit("set_perms");
-
-                if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
-                        errExit("mount bind");
-
-                // This directory must be mode 1777, or Xlib will barf.
-                if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
-                          MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
-                          "mode=1777,uid=0,gid=0") < 0)
-                        errExit("mounting tmpfs on /tmp/.X11-unix");
-                fs_logger("tmpfs /tmp/.X11-unix");
+#ifdef HAVE_X11
+// check for X11 abstract sockets
+static int x11_abstract_sockets_present(void) {
 
-                // create an empty file which will have the desired socket bind-mounted over it
-                int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
-                if (fd < 0)
-                        errExit(x11file);
-                if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
-                        errExit("fchown");
-                close(fd);
+        EUID_ROOT(); // grsecurity fix
+        FILE *fp = fopen("/proc/net/unix", "r");
+        if (!fp)
+                errExit("fopen");
+        EUID_USER();
 
-                // do the mount
-                char *wx11file;
-                if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
-                        errExit("asprintf");
-                if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mount bind");
-                fs_logger2("whitelist", x11file);
+        char *linebuf = 0;
+        size_t bufsz = 0;
+        int found = 0;
+        errno = 0;
 
-                free(x11file);
-                free(wx11file);
+        for (;;) {
+                if (getline(&linebuf, &bufsz, fp) == -1) {
+                        if (errno)
+                                errExit("getline");
+                        break;
+                }
+                // The last space-separated field in 'linebuf' is the
+                // pathname of the socket.  Abstract sockets' pathnames
+                // all begin with '@/', normal ones begin with '/'.
+                char *p = strrchr(linebuf, ' ');
+                if (!p) {
+                        fputs("error parsing /proc/net/unix\n", stderr);
+                        exit(1);
+                }
+                if (strncmp(p+1, "@/tmp/.X11-unix/", 16) == 0) {
+                        found = 1;
+                        break;
+                }
+        }
 
-                // block access to RUN_WHITELIST_X11_DIR
-                if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
-                        errExit("mount");
-                fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
+        free(linebuf);
+        fclose(fp);
+        return found;
+}
 
+// Choose a random, unallocated display number.  This has an inherent
+// and unavoidable TOCTOU race, since we cannot create either the
+// socket or a lockfile ourselves.
+static int random_display_number(void) {
+        int display;
+        int found = 0;
+        int i;
 
-#if 0
-        // keep a copy of real /tmp/.X11-unix directory in WHITELIST_TMP_DIR
-        int rv = mkdir(RUN_WHITELIST_X11_DIR, 1777);
-        if (rv == -1)
-                errExit("mkdir");
-        if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 1777))
-                errExit("set_perms");
+        struct sockaddr_un sa;
+        // The -1 here is because we need space to inject a
+        // leading nul byte.
+        int sun_pathmax = (int)(sizeof sa.sun_path - 1);
+        assert((size_t)sun_pathmax == sizeof sa.sun_path - 1);
+        int sun_pathlen;
 
-        if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mount bind");
+        int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sockfd == -1)
+                errExit("socket");
 
-        // mount tmpfs on /tmp/.X11-unix
-        if (arg_debug || arg_debug_whitelists)
-                printf("Mounting tmpfs on /tmp/.X11-unix directory\n");
-        if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=1777,gid=0") < 0)
-                errExit("mounting tmpfs on /tmp");
-        fs_logger("tmpfs /tmp/.X11-unix");
+        for (i = 0; i < 100; i++) {
+                // We try display numbers in the range 21 through 1000.
+                // Normal X servers typically use displays in the 0-10 range;
+                // ssh's X11 forwarding uses 10-20, and login screens
+                // (e.g. gdm3) may use displays above 1000.
+                display = rand() % 979 + 21;
+
+                // The display number might be claimed by a server listening
+                // in _either_ the normal or the abstract namespace; they
+                // don't necessarily do both.  The easiest way to check is
+                // to try to connect, both ways.
+                memset(&sa, 0, sizeof sa);
+                sa.sun_family = AF_UNIX;
+                sun_pathlen = snprintf(sa.sun_path, sun_pathmax,
+                                       "/tmp/.X11-unix/X%d", display);
+                if (sun_pathlen >= sun_pathmax) {
+                        fprintf(stderr, "sun_path too small for display :%d"
+                                " (only %d bytes usable)\n", display, sun_pathmax);
+                        exit(1);
+                }
+
+                if (connect(sockfd, (struct sockaddr *)&sa,
+                            offsetof(struct sockaddr_un, sun_path) + sun_pathlen + 1) == 0) {
+                        close(sockfd);
+                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                        if (sockfd == -1)
+                                errExit("socket");
+                        continue;
+                }
+                if (errno != ECONNREFUSED && errno != ENOENT)
+                        errExit("connect");
+
+                // Name not claimed in the normal namespace; now try it
+                // in the abstract namespace.  Note that abstract-namespace
+                // names are NOT nul-terminated; they extend to the length
+                // specified as the third argument to 'connect'.
+                memmove(sa.sun_path + 1, sa.sun_path, sun_pathlen + 1);
+                sa.sun_path[0] = '\0';
+                if (connect(sockfd, (struct sockaddr *)&sa,
+                            offsetof(struct sockaddr_un, sun_path) + 1 + sun_pathlen) == 0) {
+                        close(sockfd);
+                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                        if (sockfd == -1)
+                                errExit("socket");
+                        continue;
+                }
+                if (errno != ECONNREFUSED && errno != ENOENT)
+                        errExit("connect");
+
+                // This display number is unclaimed.  Of course, it could
+                // be claimed before we get around to doing it...
+                found = 1;
+                break;
+        }
+        close(sockfd);
 
-        // create an empty file
-        /* coverity[toctou] */
-        FILE *fp = fopen(x11file, "w");
-        if (!fp) {
-                fprintf(stderr, "Error: cannot create empty file in x11 directory\n");
+        if (!found) {
+                fputs("Error: cannot find an unallocated X11 display number, "
+                      "exiting...\n", stderr);
                 exit(1);
         }
-        // set file properties
-        SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
-        fclose(fp);
-
-        // mount
-        char *wx11file;
-        if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
-                errExit("asprintf");
-        if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mount bind");
-         fs_logger2("whitelist", x11file);
-
-        free(x11file);
-        free(wx11file);
-        
-        // block access to RUN_WHITELIST_X11_DIR
-         if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, "none", MS_BIND, "mode=400,gid=0") == -1)
-                errExit("mount");
-         fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
+        return display;
+}
 #endif
 
-#endif
-}
+
 
 
 #ifdef HAVE_X11
@@ -277,7 +221,7 @@ void x11_start_xephyr(int argc, char **argv) {
         drop_privs(0);
 
         // check xephyr
-        if (x11_check_xephyr() == 0) {
+        if (!program_in_path("Xephyr")) {
                 fprintf(stderr, "\nError: Xephyr program was not found in /usr/bin directory, please install it:\n");
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xserver-xephyr\n");
                 fprintf(stderr, "   Arch: sudo pacman -S xorg-server-xephyr\n");
@@ -477,7 +421,7 @@ void x11_start_xpra(int argc, char **argv) {
         drop_privs(0);
 
         // check xpra
-        if (x11_check_xpra() == 0) {
+        if (!program_in_path("xpra")) {
                 fprintf(stderr, "\nError: Xpra program was not found in /usr/bin directory, please install it:\n");
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xpra\n");
                 exit(0);
@@ -670,9 +614,9 @@ void x11_start(int argc, char **argv) {
         }
 
         // check xpra
-        if (x11_check_xpra() == 1)
+        if (program_in_path("xpra"))
                 x11_start_xpra(argc, argv);
-        else if (x11_check_xephyr() == 1)
+        else if (program_in_path("Xephyr"))
                 x11_start_xephyr(argc, argv);
         else {
                 fprintf(stderr, "\nError: Xpra or Xephyr not found in /usr/bin directory, please install one of them:\n");
@@ -684,58 +628,39 @@ void x11_start(int argc, char **argv) {
 
 #endif
 
-void x11_block(void) {
+// Porting notes:
+// 
+// 1. merge #1100 from zackw:
+//     Attempting to run xauth -f directly on a file in /run/firejail/mnt/ directory fails on Debian 8
+//     with this message:
+//            xauth:  timeout in locking authority file /run/firejail/mnt/sec.Xauthority-Qt5Mu4
+//            Failed to create untrusted X cookie: xauth: exit 1
+//     For this reason we run xauth on a file in a tmpfs filesystem mounted on /tmp. This was
+//     a partial merge.
+//
+// 2. Since we cannot deal with the TOCTOU condition when mounting .Xauthority in user home
+// directory, we need to make sure /usr/bin/xauth executable is the real thing, and not
+// something picked up on $PATH.
+//
+void x11_xorg(void) {
 #ifdef HAVE_X11
-        mask_x11_abstract_socket = 1;
 
-        // check abstract socket presence and network namespace options
-        if ((!arg_nonetwork && !cfg.bridge0.configured && !cfg.interface0.configured)
-                && x11_abstract_sockets_present()) {
-                fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n"
-                                                "Additional setup required. To block abstract X11 socket you can either:\n"
-                                                " * use network namespace in firejail (--net=none, --net=...)\n"
-                                                " * add \"-nolisten local\" to xserver options\n"
-                                                "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
+        // check xauth utility is present in the system
+        struct stat s;
+        if (stat("/usr/bin/xauth", &s) == -1) {
+                fprintf(stderr, "Error: xauth utility not found in PATH.  Please install it:\n"
+                                "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n");
                 exit(1);
         }
-
-        // blacklist sockets
-        profile_check_line("blacklist /tmp/.X11-unix", 0, NULL);
-        profile_add(strdup("blacklist /tmp/.X11-unix"));
-
-        // blacklist .Xauthority
-        profile_check_line("blacklist ${HOME}/.Xauthority", 0, NULL);
-        profile_add(strdup("blacklist ${HOME}/.Xauthority"));
-        char *xauthority = getenv("XAUTHORITY");
-        if (xauthority) {
-                char *line;
-                if (asprintf(&line, "blacklist %s", xauthority) == -1)
-                        errExit("asprintf");
-                profile_check_line(line, 0, NULL);
-                profile_add(line);
-        }
-
-        // clear environment
-        env_store("DISPLAY", RMENV);
-        env_store("XAUTHORITY", RMENV);
-#endif
-}
-
-void x11_xorg(void) {
-#ifdef HAVE_X11
-        // destination - create an empty ~/.Xauthotrity file if it doesn't exist already, and use it as a mount point
-        char *dest;
-        if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
-                errExit("asprintf");
-        struct stat s;
-        if (stat(dest, &s) == -1) {
-                // create an .Xauthority file
-                touch_file_as_user(dest, getuid(), getgid(), 0600);
+        if (s.st_uid != 0 && s.st_gid != 0) {
+                fprintf(stderr, "Error: invalid /usr/bin/xauth executable\n");
+                exit(1);
         }
 
-        // check xauth utility is present in the system
-        if (stat("/usr/bin/xauth", &s) == -1) {
-                fprintf(stderr, "Error: cannot find /usr/bin/xauth executable\n");
+        // get DISPLAY env
+        char *display = getenv("DISPLAY");
+        if (!display) {
+                fputs("Error: --x11=xorg requires an 'outer' X11 server to use.\n", stderr);
                 exit(1);
         }
 
@@ -743,7 +668,9 @@ void x11_xorg(void) {
         if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=777,gid=0") < 0)
                 errExit("mounting /tmp");
 
-        // create a temporary .Xauthority file
+        // create the temporary .Xauthority file
+        if (arg_debug)
+                printf("Generating a new .Xauthority file\n");
         char tmpfname[] = "/tmp/.tmpXauth-XXXXXX";
         int fd = mkstemp(tmpfname);
         if (fd == -1) {
@@ -758,38 +685,48 @@ void x11_xorg(void) {
         if (child < 0)
                 errExit("fork");
         if (child == 0) {
-                // generate the new .Xauthority file using xauth utility
-                if (arg_debug)
-                        printf("Generating a new .Xauthority file\n");
                 drop_privs(1);
-
-                char *display = getenv("DISPLAY");
-                if (!display)
-                        display = ":0.0";
-                
                 clearenv();
-                execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", tmpfname,
-                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL); 
-                
 #ifdef HAVE_GCOV
                 __gcov_flush();
 #endif
-                _exit(0);
+                execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", tmpfname,
+                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL); 
+                
+                _exit(127);
+        }
+
+        // wait for the xauth process to finish
+        int status;
+        if (waitpid(child, &status, 0) != child)
+                errExit("waitpid");
+        if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
+                 /* success */
+        } else if (WIFEXITED(status)) {
+                fprintf(stderr, "Failed to create untrusted X cookie: xauth: exit %d\n",
+                        WEXITSTATUS(status));
+                exit(1);
+        } else if (WIFSIGNALED(status)) {
+                fprintf(stderr, "Failed to create untrusted X cookie: xauth: %s\n",
+                        strsignal(WTERMSIG(status)));
+                exit(1);
+        } else {
+                fprintf(stderr, "Failed to create untrusted X cookie: "
+                        "xauth: un-decodable exit status %04x\n", status);
+                exit(1);
         }
 
-        // wait for the child to finish
-        waitpid(child, NULL, 0);
-
-        // check the file was created and set mode and ownership
+        // ensure the file has the correct permissions and move it
+        // into the correct location.
         if (stat(tmpfname, &s) == -1) {
-                fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
+                fprintf(stderr, "Error: .Xauthority file was mpt created\n");
                 exit(1);
         }
         if (set_perms(tmpfname, getuid(), getgid(), 0600))
                 errExit("set_perms");
         
         // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted
-        // automatically when the sandbox is closed
+        // automatically when the sandbox is closed (rename doesn't work)
         if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) { // root needed
                 fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
                 exit(1);
@@ -798,17 +735,132 @@ void x11_xorg(void) {
                 errExit("set_perms");
         /* coverity[toctou] */
         unlink(tmpfname);
+        umount("/tmp");
         
+
+        // Ensure there is already a file in the usual location, so that bind-mount below will work.
+        // todo: fix TOCTOU races, currently managed by imposing /usr/bin/xauth as executable
+        char *dest;
+        if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
+                errExit("asprintf");
+        if (stat(dest, &s) == -1) {
+                // create an .Xauthority file
+                touch_file_as_user(dest, getuid(), getgid(), 0600);
+        }
+        if (is_link(dest)) {
+                fprintf(stderr, "Error: .Xauthority is a symbolic link\n");
+                exit(1);
+        }
+
         // mount
         if (mount(RUN_XAUTHORITY_SEC_FILE, dest, "none", MS_BIND, "mode=0600") == -1) {
                 fprintf(stderr, "Error: cannot mount the new .Xauthority file\n");
                 exit(1);
         }
+        // just  in case...
         if (set_perms(dest, getuid(), getgid(), 0600))
                 errExit("set_perms");
         free(dest);
-        
-        // unmount /tmp
-        umount("/tmp");
 #endif  
 }
+
+void fs_x11(void) {
+#ifdef HAVE_X11
+        int display = x11_display();
+        if (display <= 0)
+                return;
+
+        char *x11file;
+        if (asprintf(&x11file, "/tmp/.X11-unix/X%d", display) == -1)
+                errExit("asprintf");
+        struct stat x11stat;
+        if (stat(x11file, &x11stat) == -1 || !S_ISSOCK(x11stat.st_mode)) {
+                free(x11file);
+                return;
+        }
+
+        if (arg_debug || arg_debug_whitelists)
+                fprintf(stderr, "Masking all X11 sockets except %s\n", x11file);
+
+               // Move the real /tmp/.X11-unix to a scratch location
+                // so we can still access x11file after we mount a
+                // tmpfs over /tmp/.X11-unix.
+                int rv = mkdir(RUN_WHITELIST_X11_DIR, 0700);
+                if (rv == -1)
+                        errExit("mkdir");
+                if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 0700))
+                        errExit("set_perms");
+
+                if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
+                        errExit("mount bind");
+
+                // This directory must be mode 1777, or Xlib will barf.
+                if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
+                          MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
+                          "mode=1777,uid=0,gid=0") < 0)
+                        errExit("mounting tmpfs on /tmp/.X11-unix");
+                fs_logger("tmpfs /tmp/.X11-unix");
+
+                // create an empty file which will have the desired socket bind-mounted over it
+                int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
+                if (fd < 0)
+                        errExit(x11file);
+                if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
+                        errExit("fchown");
+                close(fd);
+
+                // do the mount
+                char *wx11file;
+                if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
+                        errExit("asprintf");
+                if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
+                        errExit("mount bind");
+                fs_logger2("whitelist", x11file);
+
+                free(x11file);
+                free(wx11file);
+
+                // block access to RUN_WHITELIST_X11_DIR
+                if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
+                        errExit("mount");
+                fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
+#endif
+}
+
+void x11_block(void) {
+#ifdef HAVE_X11
+        mask_x11_abstract_socket = 1;
+
+        // check abstract socket presence and network namespace options
+        if ((!arg_nonetwork && !cfg.bridge0.configured && !cfg.interface0.configured)
+                && x11_abstract_sockets_present()) {
+                fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n"
+                                                "Additional setup required. To block abstract X11 socket you can either:\n"
+                                                " * use network namespace in firejail (--net=none, --net=...)\n"
+                                                " * add \"-nolisten local\" to xserver options\n"
+                                                "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
+                exit(1);
+        }
+
+        // blacklist sockets
+        profile_check_line("blacklist /tmp/.X11-unix", 0, NULL);
+        profile_add(strdup("blacklist /tmp/.X11-unix"));
+
+        // blacklist .Xauthority
+        profile_check_line("blacklist ${HOME}/.Xauthority", 0, NULL);
+        profile_add(strdup("blacklist ${HOME}/.Xauthority"));
+        char *xauthority = getenv("XAUTHORITY");
+        if (xauthority) {
+                char *line;
+                if (asprintf(&line, "blacklist %s", xauthority) == -1)
+                        errExit("asprintf");
+                profile_check_line(line, 0, NULL);
+                profile_add(line);
+        }
+
+        // clear environment
+        env_store("DISPLAY", RMENV);
+        env_store("XAUTHORITY", RMENV);
+#endif
+}
+
diff --git a/test/fcopy/cmdline.exp b/test/fcopy/cmdline.exp
index 3ea33b01b..10dd8da58 100755
--- a/test/fcopy/cmdline.exp
+++ b/test/fcopy/cmdline.exp
@@ -10,7 +10,7 @@ match_max 100000
 send -- "/usr/lib/firejail/fcopy\r"
 expect {
         timeout {puts "TESTING ERROR 0\n";exit}
-        "files missing"
+        "arguments missing"
 }
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
@@ -21,7 +21,7 @@ after 100
 send -- "/usr/lib/firejail/fcopy foo\r"
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
-        "files missing"
+        "arguments missing"
 }
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
@@ -32,14 +32,14 @@ after 100
 send -- "/usr/lib/firejail/fcopy f%oo1 foo2\r"
 expect {
         timeout {puts "TESTING ERROR 4\n";exit}
-        "invalid file name"
+        "invalid source file name"
 }
 after 100
 
 send -- "/usr/lib/firejail/fcopy foo1 f,oo2\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
-        "invalid file name"
+        "invalid dest file name"
 }
 after 100
 
diff --git a/test/fs/private-home.exp b/test/fs/private-home.exp
index f2f30914d..259eb4f9e 100755
--- a/test/fs/private-home.exp
+++ b/test/fs/private-home.exp
@@ -89,7 +89,7 @@ expect {
         "Child process initialized"
 }
 after 100
-send -- "file file ~/_firejail_test_link2\r"
+send -- "file ~/_firejail_test_link2\r"
 expect {
         timeout {puts "TESTING ERROR 11\n";exit}
         "broken symbolic link"