5 files changed, 119 insertions, 25 deletions

diff --git a/README.md b/README.md
index 11ee02118..9b69753ed 100644
--- a/README.md
+++ b/README.md
@@ -41,13 +41,51 @@ FAQ: https://firejail.wordpress.com/support/frequently-asked-questions/
 
 ## X11 sandboxing support
 
-X11 support is built around Xpra (http://xpra.org/).
-So far I've seen it working on Debian 7 and 8, and Ubuntu 14.04. If you manage to run it on another
-distribution, please let me know. Example:
+X11 support is built around Xpra (http://xpra.org/) of Xephyr.
 `````
-$ firejail --x11 --net=eth0 firefox
+       --x11  Start a new X11 server using Xpra or Xephyr and attach the sand‐
+              box to this server.  The regular X11 server (display 0)  is  not
+              visible  in  the sandbox. This prevents screenshot and keylogger
+              applications started in the sandbox  from  accessing  other  X11
+              displays.  A network namespace needs to be instantiated in order
+              to deny access to X11 abstract Unix domain socket.
+
+              Firejail will try first Xpra, and if Xpra is  not  installed  on
+              the  system,  it  will  try to find Xephyr.  This feature is not
+              available when running as root.
+
+              Example:
+              $ firejail --x11 --net=eth0 firefox
+
+       --x11=xpra
+              Start a new X11 server using Xpra (http://xpra.org)  and  attach
+              the sandbox to this server.  Xpra is a persistent remote display
+              server and client for forwarding X11  applications  and  desktop
+              screens.  On Debian platforms Xpra is installed with the command
+              sudo apt-get install xpra.  This feature is not  available  when
+              running as root.
+
+              Example:
+              $ firejail --x11 --net=eth0 firefox
+
+       --x11=xephyr
+              Start  a  new  X11 server using Xephyr and attach the sandbox to
+              this server.  Xephyr is a display server  implementing  the  X11
+              display  server protocol.  It runs in a window just like other X
+              applications, but it is an X server itself in which you can  run
+              other software.  The default Xephyr window size is 800x600. This
+              can be modified in /etc/firejail/firejail.config file, see man 5
+              firejail-config for more details.
+
+              The  recommended way to use this feature is to run a window man‐
+              ager inside the sandbox.  A security profile for OpenBox is pro‐
+              vided.  On Debian platforms Xephyr is installed with the command
+              sudo apt-get install xserver-xephyr.  This feature is not avail‐
+              able when running as root.
+
+              Example:
+              $ firejail --x11 --net=eth0 openbox
 `````
---x11 starts the server, --net is required in order to remove the main X11 server socket from the sandbox.
 More information here: https://firejail.wordpress.com/documentation-2/x11-guide/
 
 ## File transfers
diff --git a/RELNOTES b/RELNOTES
index 78ed8ac5a..0b5ea924d 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,8 +1,8 @@
 firejail (0.9.39) baseline; urgency=low
-  * default seccomp filter update
-  * disable STUN/WebRTC in default netfilter configuration
   * added --nice option
   * added --x11 option
+  * added --x11=xpra option
+  * added --x11=xephyr option
   * added filetransfer options --ls and --get
   * added mkdir, ipc-namespace and nosound profile commands
   * --version also prints compile options
@@ -10,10 +10,12 @@ firejail (0.9.39) baseline; urgency=low
   * added compile-time option to restrict --net= to root only
   * run time config support, man firejail-config
   * added firecfg utility
-  * build rpm packages using "make rpms"
+  * default seccomp filter update
+  * disable STUN/WebRTC in default netfilter configuration
   * new profiles: lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril
   * new profiles: qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars
-  * new profiles: qTox
+  * new profiles: qTox, OpenSSH client, OpenBox
+  * build rpm packages using "make rpms"
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Wed, 16 Mar 2016 08:00:00 -0500
 
diff --git a/etc/firejail.config b/etc/firejail.config
index 8333c26ba..41cd08e68 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -3,14 +3,14 @@
 # Most features are enabled by default. Use 'yes' or 'no' as configuration
 # values.
 
-# Enable or disable seccomp support, default enabled.
-# seccomp yes
+# Enable or disable bind support, default enabled.
+# bind yes
 
 # Enable or disable chroot support, default enabled.
 # chroot yes
 
-# Enable or disable bind support, default enabled.
-# bind yes
+# Enable or disable file transfer support, default enabled.
+# file-transfer yes
 
 # Enable or disable networking features, default enabled.
 # network yes
@@ -21,17 +21,17 @@
 # only to root user. Regular users are only allowed --net=none.
 # restricted-network no
 
+# Enable or disable seccomp support, default enabled.
+# seccomp yes
+
 # Enable or disable user namespace support, default enabled.
 # userns yes
 
 # Enable or disable X11 sandboxing support, default enabled.
 # x11 yes
 
-# Enable or disable file transfer support, default enabled.
-# file-transfer yes
-
 # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
-# a full list of resolutions available on your specifc setup.
+# a full list of resolutions available on your specific setup.
 # xephyr-screen 640x480
 # xephyr-screen 800x600
 # xephyr-screen 1024x768
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt
index 687aedf59..fcf4109ee 100644
--- a/src/man/firejail-config.txt
+++ b/src/man/firejail-config.txt
@@ -14,16 +14,16 @@ time. Most features are enabled by default both at compile time and
 at run time.
 
 .TP
-\fBsecomp
-Enable or disable seccomp support, default enabled.
+\fBbind
+Enable or disable bind support, default enabled.
 
 .TP
 \fBchroot
 Enable or disable chroot support, default enabled.
 
 .TP
-\fBbind
-Enable or disable bind support, default enabled.
+\fBfile-transfer
+Enable or disable file transfer support, default enabled.
 
 .TP
 \fBnetwork
@@ -37,6 +37,10 @@ Restricted networking grants access to --interface and --net=ethXXX
 only to root user. Regular users are only allowed --net=none.
 
 .TP
+\fBsecomp
+Enable or disable seccomp support, default enabled.
+
+.TP
 \fBuserns
 Enable or disable user namespace support, default enabled.
 
@@ -45,8 +49,19 @@ Enable or disable user namespace support, default enabled.
 Enable or disable X11 sandboxing support, default enabled.
 
 .TP
-\fBfile-transfer
-Enable or disable file transfer support, default enabled.
+\fBxephyr-screen
+Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
+a full list of resolutions available on your specific setup. Examples:
+.br
+
+.br
+xephyr-screen 640x480
+.br
+xephyr-screen 800x600
+.br
+xephyr-screen 1024x768
+.br
+xephyr-screen 1280x1024
 
 .SH FILES
 /etc/firejail/firejail.config
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 6eb7c3ff7..a3c39a82b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1513,10 +1513,28 @@ $ firejail "\-\-whitelist=/home/username/My Virtual Machines"
 
 .TP
 \fB\-\-x11
+Start a new X11 server using Xpra or Xephyr and attach the sandbox to this server.
+The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger
+applications started in the sandbox from accessing other X11 displays.
+A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket.
+.br
+
+.br
+Firejail will try first Xpra, and if Xpra is not installed on the system, it will try to find Xephyr.
+This feature is not available when running as root. 
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-x11 --net=eth0 firefox
+
+.TP
+\fB\-\-x11=xpra
 Start a new X11 server using Xpra (http://xpra.org) and attach the sandbox to this server.
 Xpra is a persistent remote display server and client for forwarding X11 applications and desktop screens.
-The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger
-applications started in the sandbox from accessing display 0. This feature is not available when running as root. 
+On Debian platforms Xpra is installed with the command \fBsudo apt-get install xpra\fR.
+This feature is not available when running as root.
 .br
 
 .br
@@ -1525,6 +1543,27 @@ Example:
 $ firejail \-\-x11 --net=eth0 firefox
 
 .TP
+\fB\-\-x11=xephyr
+Start a new X11 server using Xephyr and attach the sandbox to this server.
+Xephyr is a display server implementing the X11 display server protocol.
+It runs in a window just like other X applications, but it is an X server itself in which you can run other software.
+The default Xephyr window size is 800x600. This can be modified in /etc/firejail/firejail.config file,
+see \fBman 5 firejail-config\fR for more details.
+.br
+
+.br
+The recommended way to use this feature is to run a window manager inside the sandbox.
+A security profile for OpenBox is provided.
+On Debian platforms Xephyr is installed with the command \fBsudo apt-get install xserver-xephyr\fR.
+This feature is not available when running as root. 
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-x11 --net=eth0 openbox
+
+.TP
 \fB\-\-zsh
 Use /usr/bin/zsh as default user shell.
 .br