5 files changed, 20 insertions, 38 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index b37c3aba8..1fcb92fea 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -526,6 +526,8 @@ void fs_mkdir(const char *name);
 void fs_x11(void);
 void x11_start(int argc, char **argv);
 int x11_display(void);
+// return 1 if xpra is installed on the system
+int x11_check_xpra(void);
 
 #endif
 
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index ba287027c..8771a7fa8 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -102,13 +102,13 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        // mkdir 
         if (strncmp(ptr, "mkdir ", 6) == 0) {
                 fs_mkdir(ptr + 6);
                 return 0;
         }
-
         // sandbox name
-        if (strncmp(ptr, "name ", 5) == 0) {
+        else if (strncmp(ptr, "name ", 5) == 0) {
                 cfg.name = ptr + 5;
                 if (strlen(cfg.name) == 0) {
                         fprintf(stderr, "Error: invalid sandbox name\n");
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 980a4dbca..8f9a4c11f 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -26,6 +26,17 @@
 #include <dirent.h>
 #include <sys/mount.h>
 
+// return 1 if xpra is installed on the system
+int x11_check_xpra(void) {
+        struct stat s;
+        
+        // check xpra
+        if (stat("/usr/bin/xpra", &s) == -1)
+                return 0;
+
+        return 1;
+}
+
 // return display number, -1 if not configured
 int x11_display(void) {
         // extract display
@@ -117,7 +128,7 @@ void x11_start(int argc, char **argv) {
         pid_t server = 0;
         
         // check xpra
-        if (stat("/usr/bin/xpra", &s) == -1) {
+        if (x11_check_xpra() == 0) {
                 fprintf(stderr, "\nError: Xpra program was not found in /usr/bin directory, please install it:\n");
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xpra\n");
                 exit(0);
@@ -127,6 +138,8 @@ void x11_start(int argc, char **argv) {
         int found = 1;
         for (i = 0; i < 100; i++) {
                 display = rand() % 1024;
+                if (display < 10)
+                        continue;
                 char *fname;
                 if (asprintf(&fname, "/tmp/.X11-unix/X%d", display) == -1)
                         errExit("asprintf");
diff --git a/src/firemon/firemon.c b/src/firemon/firemon.c
index c19c344b0..0e38696ac 100644
--- a/src/firemon/firemon.c
+++ b/src/firemon/firemon.c
@@ -224,7 +224,7 @@ int main(int argc, char **argv) {
         if (arg_x11)
                 x11((pid_t) pid);
         
-        if (!arg_route && !arg_arp && !arg_interface && !arg_tree && !arg_caps && !arg_seccomp)
+        if (!arg_route && !arg_arp && !arg_interface && !arg_tree && !arg_caps && !arg_seccomp && !arg_x11)
                 procevent((pid_t) pid); // never to return
                 
         return 0;
diff --git a/todo b/todo
index 438637d24..78b49dde6 100644
--- a/todo
+++ b/todo
@@ -1,34 +1 @@
-1. Disable /dev/tcp in bash. Compiled time: --enable-net-redirections, --disable-net-redirections
-ksh and zsh seem to have it.
-
-Tests:
-a)
-cat </dev/tcp/time.nist.gov/13
-
-b)
-exec 3<>/dev/tcp/www.google.com/80
-echo -e "GET / HTTP/1.1\r\nhost: http://www.google.com\r\nConnection: close\r\n\r\n" >&3
-cat <&3
-
-c) A list of attacks
-http://www.lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/
-
-2. SELinux integration
-
-Firefox selinux disabled (RedHat): http://danwalsh.livejournal.com/72697.html
-Firefox selinux enabled (Gentoo hardened): http://blog.siphos.be/2015/08/why-we-do-confine-firefox/
-"desktops are notoriously difficult to use a mandatory access control system on"
-
-3. abstract unix socket bridge, example for ibus:
-
-before the sandbox is started
-socat UNIX-LISTEN:/tmp/mysoc,fork ABSTRACT-CONNECT:/tmp/dbus-awBoQTCc &
-in sandbox
-socat ABSTRACT-LISTEN:/tmp/dbus-awBoQTCc,fork UNIX-CONNECT:/tmp/mysock
-
-5. add support for --ip, --iprange, --mac and --mtu for --interface option
-
-6. --shutdown does not clear sandboxes started with --join
-
-7. profile for okular
-
+firejail --noprofile --net=eth0 --x11 xterm -fg white -bg black