36 files changed, 833 insertions, 324 deletions

diff --git a/README b/README
index 71e329792..277d686ac 100644
--- a/README
+++ b/README
@@ -126,6 +126,7 @@ Zack Weinberg (https://github.com/zackw)
         - rework fcopy, --follow-link support in fcopy
         - follow link support in --private-bin
         - wait_for_other function rewrite
+        - xvfb X11 server support
 Austin S. Hemmelgarn (https://github.com/Ferroin)
         - unbound profile update
 Igor Bukanov (https://github.com/ibukanov)
diff --git a/README.md b/README.md
index 687877c73..20d624243 100644
--- a/README.md
+++ b/README.md
@@ -145,6 +145,43 @@ Added AppImage type 2 support, and support for passing command line arguments to
 
               $ firejail --git-uninstall
 
+       --x11=xvfb
+              Start  Xvfb  X11  server  and attach the sandbox to this server.
+              Xvfb, short for X virtual framebuffer,  performs  all  graphical
+              operations  in memory without showing any screen output. Xvfb is
+              mainly used for remote access and software testing  on  headless
+              servers.
+
+              On Debian platforms Xvfb is installed with the command sudo apt-
+              get install xvfb.  This feature is not available when running as
+              root.
+
+              Example: remote VNC access
+
+              On  the  server we start a sandbox using Xvfb and openbox window
+              manager. The default size of Xvfb screen is 800x600 - it can  be
+              changed  in  /etc/firejail/firejail.config  (xvfb-screen).  Some
+              sort of networking (--net) is required in order to  isolate  the
+              abstract sockets used by other X servers.
+
+              $ firejail --net=none --x11=xvfb openbox
+
+              *** Attaching to Xvfb display 792 ***
+
+              Reading profile /etc/firejail/openbox.profile
+              Reading profile /etc/firejail/disable-common.inc
+              Reading profile /etc/firejail/disable-common.local
+              Parent pid 5400, child pid 5401
+
+              On  the  server  we also start a VNC server and attach it to the
+              display handled by our Xvfb server (792).
+
+              $ x11vnc -display :792
+
+              On the client machine we start a VNC viewer and use it  to  con‐
+              nect to our server:
+
+              $ vncviewer
 
 `````
 ## New Profiles
diff --git a/RELNOTES b/RELNOTES
index 54078875b..80bede268 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -31,6 +31,7 @@ firejail (0.9.45) baseline; urgency=low
   * feature: added a number o Python scripts for handling sandboxes
   * feature: allow local customization using .local files under /etc/firejail
   * feature: follow-symlink-as-user runtime config option in /etc/firejail/firejail.config
+  * feature: xvfb X11 server support (--x11=xvfb)
   * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire,
   * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
   * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index 521187e3a..30693f7a0 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -183,8 +183,10 @@ static int caps_find_name(const char *name) {
 // return 1 if error, 0 if OK
 void caps_check_list(const char *clist, void (*callback)(int)) {
         // don't allow empty lists
-        if (clist == NULL || *clist == '\0')
-                goto errexit;
+        if (clist == NULL || *clist == '\0') {
+                fprintf(stderr, "Error: empty capabilities list\n");
+                exit(1);
+        }
 
         // work on a copy of the string
         char *str = strdup(clist);
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index dff892ea3..56ab7c932 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -27,6 +27,8 @@ static int initialized = 0;
 static int cfg_val[CFG_MAX];
 char *xephyr_screen = "800x600";
 char *xephyr_extra_params = "";
+char *xvfb_screen = "800x600x24";
+char *xvfb_extra_params = "";
 char *netfilter_default = NULL;
 
 int checkcfg(int val) {
@@ -234,6 +236,28 @@ int checkcfg(int val) {
                                         errExit("strdup");
                         }
                         
+                        // Xvfb screen size
+                        else if (strncmp(ptr, "xvfb-screen ", 12) == 0) {
+                                // expecting three numbers separated by x's
+                                unsigned int n1;
+                                unsigned int n2;
+                                unsigned int n3;
+                                int rv = sscanf(ptr + 12, "%ux%ux%u", &n1, &n2, &n3);
+                                if (rv != 3)
+                                        goto errout;
+                                if (asprintf(&xvfb_screen, "%ux%ux%u", n1, n2, n3) == -1)
+                                        errExit("asprintf");
+                        }
+
+                        // Xvfb extra parameters
+                        else if (strncmp(ptr, "xvfb-extra-params ", 18) == 0) {
+                                if (*xvfb_extra_params != '\0')
+                                        goto errout;
+                                xvfb_extra_params = strdup(ptr + 18);
+                                if (!xvfb_extra_params)
+                                        errExit("strdup");
+                        }
+                        
                         // quiet by default
                         else if (strncmp(ptr, "quiet-by-default ", 17) == 0) {
                                 if (strcmp(ptr + 17, "yes") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index fbf83abb3..aec6f3de4 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -644,7 +644,6 @@ void fs_mkdir(const char *name);
 void fs_mkfile(const char *name);
 
 // x11.c
-extern int mask_x11_abstract_socket;
 void fs_x11(void);
 int x11_display(void);
 void x11_start(int argc, char **argv);
@@ -685,6 +684,8 @@ enum {
 };
 extern char *xephyr_screen;
 extern char *xephyr_extra_params;
+extern char *xvfb_screen;
+extern char *xvfb_extra_params;
 extern char *netfilter_default;
 int checkcfg(int val);
 void print_compiletime_support(void);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index c386f70cf..a06f3a35d 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1084,7 +1084,6 @@ void fs_check_chroot_dir(const char *rootdir) {
 
         // check x11 socket directory
         if (getenv("FIREJAIL_X11")) {
-                mask_x11_abstract_socket = 1;
                 char *name;
                 if (asprintf(&name, "%s/tmp/.X11-unix", rootdir) == -1)
                         errExit("asprintf");
@@ -1117,7 +1116,6 @@ void fs_chroot(const char *rootdir) {
                 
                 // x11
                 if (getenv("FIREJAIL_X11")) {
-                        mask_x11_abstract_socket = 1;
                         char *newx11;
                         if (asprintf(&newx11, "%s/tmp/.X11-unix", rootdir) == -1)
                                 errExit("asprintf");
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 310795abf..5951e5d16 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -349,6 +349,14 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 else
                         exit_err_feature("x11");
         }
+        else if (strcmp(argv[i], "--x11=xvfb") == 0) {
+                if (checkcfg(CFG_X11)) {
+                        x11_start_xvfb(argc, argv);
+                        exit(0);
+                }
+                else
+                        exit_err_feature("x11");
+        }
 #endif
 #ifdef HAVE_NETWORK     
         else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
@@ -2182,10 +2190,6 @@ int main(int argc, char **argv) {
                         fprintf(stderr, "Warning: --trace and --tracelog are mutually exclusive; --tracelog disabled\n");
         }
         
-        // disable x11 abstract socket
-        if (getenv("FIREJAIL_X11"))
-                mask_x11_abstract_socket = 1;
-        
         // check user namespace (--noroot) options
         if (arg_noroot) {
                 if (arg_overlay) {
diff --git a/src/firejail/output.c b/src/firejail/output.c
index 4872c57ba..cea4f4e28 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -26,50 +26,45 @@ void check_output(int argc, char **argv) {
         EUID_ASSERT();
         
         int i;
-        char *outfile = NULL;
+        int outindex = 0;
 
-        int found = 0;
         for (i = 1; i < argc; i++) {
                 if (strncmp(argv[i], "--output=", 9) == 0) {
-                        found = 1;
-                        invalid_filename(argv[i] + 9);
-                        outfile = argv[i] + 9;
-
-                        // do not accept directories, links, and files with ".."
-                        if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
-                                fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n");
-                                exit(1);
-                        }
-                        
-                        struct stat s;
-                        if (stat(outfile, &s) == 0) {
-                                // check permissions
-                                if (s.st_uid != getuid() || s.st_gid != getgid()) {
-                                        fprintf(stderr, "Error: the output file needs to be owned by the current user.\n");
-                                        exit(1);
-                                }
-                                
-                                // check hard links
-                                if (s.st_nlink != 1) {
-                                        fprintf(stderr, "Error: no hard links allowed.\n");
-                                        exit(1);
-                                }
-                        }
-
-                        /* coverity[toctou] */
-                        FILE *fp = fopen(outfile, "a");
-                        if (!fp) {
-                                fprintf(stderr, "Error: cannot open output file %s\n", outfile);
-                                exit(1);
-                        }
-                        fclose(fp);
+                        outindex = i;
                         break;
                 }
         }
-        if (!found)
+        if (!outindex)
                 return;
 
 
+        // check filename
+        drop_privs(0);
+        char *outfile = NULL;
+        invalid_filename(argv[outindex] + 9);
+        outfile = argv[outindex] + 9;
+
+        // do not accept directories, links, and files with ".."
+        if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
+                fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n");
+                exit(1);
+        }
+        
+        struct stat s;
+        if (stat(outfile, &s) == 0) {
+                // check permissions
+                if (s.st_uid != getuid() || s.st_gid != getgid()) {
+                        fprintf(stderr, "Error: the output file needs to be owned by the current user.\n");
+                        exit(1);
+                }
+                
+                // check hard links
+                if (s.st_nlink != 1) {
+                        fprintf(stderr, "Error: no hard links allowed.\n");
+                        exit(1);
+                }
+        }
+
         // build the new command line
         int len = 0;
         for (i = 0; i < argc; i++) {
@@ -90,7 +85,6 @@ void check_output(int argc, char **argv) {
         sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile);
 
         // run command
-        drop_privs(0);
         char *a[4];
         a[0] = "/bin/bash";
         a[1] = "-c";
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 5684a2d95..9f6688d4a 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -696,7 +696,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
                         if (x11env && strcmp(x11env, "yes") == 0) {
-                                mask_x11_abstract_socket = 1;
                                 return 0;
                         }
                         else {
@@ -720,12 +719,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #endif
                 return 0;
         }
+        
         if (strcmp(ptr, "x11 xpra") == 0) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
                         if (x11env && strcmp(x11env, "yes") == 0) {
-                                mask_x11_abstract_socket = 1;
                                 return 0;
                         }
                         else {
@@ -740,12 +739,30 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         
+        if (strcmp(ptr, "x11 xvfb") == 0) {
+#ifdef HAVE_X11
+                if (checkcfg(CFG_X11)) {
+                        char *x11env = getenv("FIREJAIL_X11");
+                        if (x11env && strcmp(x11env, "yes") == 0) {
+                                return 0;
+                        }
+                        else {
+                                // start x11
+                                x11_start_xvfb(cfg.original_argc, cfg.original_argv);
+                                exit(0);
+                        }
+                }
+                else
+                        warning_feature_disabled("x11");
+#endif
+                return 0;
+        }
+
         if (strcmp(ptr, "x11") == 0) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
                         if (x11env && strcmp(x11env, "yes") == 0) {
-                                mask_x11_abstract_socket = 1;
                                 return 0;
                         }
                         else {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index ae3993aec..4d2054a72 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -205,6 +205,7 @@ void usage(void) {
         printf("    --x11=xephyr - enable Xephyr X11 server. The window size is 800x600.\n");
         printf("    --x11=xorg - enable X11 security extension.\n");
         printf("    --x11=xpra - enable Xpra X11 server.\n");
+        printf("    --x11=xvfb - enable Xvfb X11 server.\n");
         printf("    --zsh - use /usr/bin/zsh as default shell.\n");
         printf("\n");
         printf("Examples:\n");
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 5bbc327a6..b72b46f0d 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -31,46 +31,45 @@
 #include <sys/wait.h>
 #include <errno.h>
 #include <limits.h>
-int mask_x11_abstract_socket = 0;
-
 
 // Parse the DISPLAY environment variable and return a display number.
 // Returns -1 if DISPLAY is not set, or is set to anything other than :ddd.
 int x11_display(void) {
-        const char *display_str = getenv("DISPLAY");
-        char *endp;
-        unsigned long display;
-
-        if (!display_str) {
-                if (arg_debug)
-                        fputs("DISPLAY is not set\n", stderr);
-                return -1;
-        }
-
-        if (display_str[0] != ':' || display_str[1] < '0' || display_str[1] > '9') {
-                if (arg_debug)
-                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
-                return -1;
-        }
-
-        errno = 0;
-        display = strtoul(display_str+1, &endp, 10);
-        if (endp == display_str+1 || (*endp != '\0' && *endp != '.')) { // handling DISPLAY=:0 and also :0.0
-                if (arg_debug)
-                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
-                return -1;
-        }
-        if (errno || display > (unsigned long)INT_MAX) {
-                if (arg_debug)
-                        fprintf(stderr, "display number %s is outside the valid range\n",
-                                display_str+1);
-                return -1;
-        }
-
-        if (arg_debug)
-                fprintf(stderr, "DISPLAY=%s parsed as %lu\n", display_str, display);
-
-        return (int)display;
+        const char *display_str = getenv("DISPLAY");
+        char *endp;
+        unsigned long display;
+
+        if (!display_str) {
+                if (arg_debug)
+                        fputs("DISPLAY is not set\n", stderr);
+                return -1;
+        }
+
+        if (display_str[0] != ':' || display_str[1] < '0' || display_str[1] > '9') {
+                if (arg_debug)
+                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
+                return -1;
+        }
+
+        errno = 0;
+        display = strtoul(display_str+1, &endp, 10);
+        // handling DISPLAY=:0 and also :0.0
+        if (endp == display_str+1 || (*endp != '\0' && *endp != '.')) {
+                if (arg_debug)
+                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
+                return -1;
+        }
+        if (errno || display > (unsigned long)INT_MAX) {
+                if (arg_debug)
+                        fprintf(stderr, "display number %s is outside the valid range\n",
+                                display_str+1);
+                return -1;
+        }
+
+        if (arg_debug)
+                fprintf(stderr, "DISPLAY=%s parsed as %lu\n", display_str, display);
+
+        return (int)display;
 }
 
 
@@ -78,34 +77,34 @@ int x11_display(void) {
 // check for X11 abstract sockets
 static int x11_abstract_sockets_present(void) {
 
-        EUID_ROOT(); // grsecurity fix
+        EUID_ROOT();                              // grsecurity fix
         FILE *fp = fopen("/proc/net/unix", "r");
         if (!fp)
                 errExit("fopen");
         EUID_USER();
 
         char *linebuf = 0;
-        size_t bufsz = 0;
-        int found = 0;
-        errno = 0;
+        size_t bufsz = 0;
+        int found = 0;
+        errno = 0;
 
         for (;;) {
-                if (getline(&linebuf, &bufsz, fp) == -1) {
-                        if (errno)
-                                errExit("getline");
-                        break;
-                }
-                // The last space-separated field in 'linebuf' is the
-                // pathname of the socket.  Abstract sockets' pathnames
-                // all begin with '@/', normal ones begin with '/'.
-                char *p = strrchr(linebuf, ' ');
-                if (!p) {
-                        fputs("error parsing /proc/net/unix\n", stderr);
-                        exit(1);
-                }
-                if (strncmp(p+1, "@/tmp/.X11-unix/", 16) == 0) {
-                        found = 1;
-                        break;
+                if (getline(&linebuf, &bufsz, fp) == -1) {
+                        if (errno)
+                                errExit("getline");
+                        break;
+                }
+                // The last space-separated field in 'linebuf' is the
+                // pathname of the socket.  Abstract sockets' pathnames
+                // all begin with '@/', normal ones begin with '/'.
+                char *p = strrchr(linebuf, ' ');
+                if (!p) {
+                        fputs("error parsing /proc/net/unix\n", stderr);
+                        exit(1);
+                }
+                if (strncmp(p+1, "@/tmp/.X11-unix/", 16) == 0) {
+                        found = 1;
+                        break;
                 }
         }
 
@@ -114,94 +113,289 @@ static int x11_abstract_sockets_present(void) {
         return found;
 }
 
+
 // Choose a random, unallocated display number.  This has an inherent
 // and unavoidable TOCTOU race, since we cannot create either the
 // socket or a lockfile ourselves.
 static int random_display_number(void) {
-        int display;
-        int found = 0;
+        int display;
+        int found = 0;
         int i;
 
-        struct sockaddr_un sa;
-        // The -1 here is because we need space to inject a
-        // leading nul byte.
-        int sun_pathmax = (int)(sizeof sa.sun_path - 1);
-        assert((size_t)sun_pathmax == sizeof sa.sun_path - 1);
-        int sun_pathlen;
+        struct sockaddr_un sa;
+        // The -1 here is because we need space to inject a
+        // leading nul byte.
+        int sun_pathmax = (int)(sizeof sa.sun_path - 1);
+        assert((size_t)sun_pathmax == sizeof sa.sun_path - 1);
+        int sun_pathlen;
 
-        int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
-        if (sockfd == -1)
-                errExit("socket");
+        int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sockfd == -1)
+                errExit("socket");
 
         for (i = 0; i < 100; i++) {
-                // We try display numbers in the range 21 through 1000.
-                // Normal X servers typically use displays in the 0-10 range;
-                // ssh's X11 forwarding uses 10-20, and login screens
-                // (e.g. gdm3) may use displays above 1000.
-                display = rand() % 979 + 21;
-
-                // The display number might be claimed by a server listening
-                // in _either_ the normal or the abstract namespace; they
-                // don't necessarily do both.  The easiest way to check is
-                // to try to connect, both ways.
-                memset(&sa, 0, sizeof sa);
-                sa.sun_family = AF_UNIX;
-                sun_pathlen = snprintf(sa.sun_path, sun_pathmax,
-                                       "/tmp/.X11-unix/X%d", display);
-                if (sun_pathlen >= sun_pathmax) {
-                        fprintf(stderr, "sun_path too small for display :%d"
-                                " (only %d bytes usable)\n", display, sun_pathmax);
-                        exit(1);
-                }
-
-                if (connect(sockfd, (struct sockaddr *)&sa,
-                            offsetof(struct sockaddr_un, sun_path) + sun_pathlen + 1) == 0) {
-                        close(sockfd);
-                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
-                        if (sockfd == -1)
-                                errExit("socket");
-                        continue;
-                }
-                if (errno != ECONNREFUSED && errno != ENOENT)
-                        errExit("connect");
-
-                // Name not claimed in the normal namespace; now try it
-                // in the abstract namespace.  Note that abstract-namespace
-                // names are NOT nul-terminated; they extend to the length
-                // specified as the third argument to 'connect'.
-                memmove(sa.sun_path + 1, sa.sun_path, sun_pathlen + 1);
-                sa.sun_path[0] = '\0';
-                if (connect(sockfd, (struct sockaddr *)&sa,
-                            offsetof(struct sockaddr_un, sun_path) + 1 + sun_pathlen) == 0) {
-                        close(sockfd);
-                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
-                        if (sockfd == -1)
-                                errExit("socket");
-                        continue;
-                }
-                if (errno != ECONNREFUSED && errno != ENOENT)
-                        errExit("connect");
-
-                // This display number is unclaimed.  Of course, it could
-                // be claimed before we get around to doing it...
-                found = 1;
-                break;
-        }
-        close(sockfd);
+                // We try display numbers in the range 21 through 1000.
+                // Normal X servers typically use displays in the 0-10 range;
+                // ssh's X11 forwarding uses 10-20, and login screens
+                // (e.g. gdm3) may use displays above 1000.
+                display = rand() % 979 + 21;
+
+                // The display number might be claimed by a server listening
+                // in _either_ the normal or the abstract namespace; they
+                // don't necessarily do both.  The easiest way to check is
+                // to try to connect, both ways.
+                memset(&sa, 0, sizeof sa);
+                sa.sun_family = AF_UNIX;
+                sun_pathlen = snprintf(sa.sun_path, sun_pathmax,
+                        "/tmp/.X11-unix/X%d", display);
+                if (sun_pathlen >= sun_pathmax) {
+                        fprintf(stderr, "sun_path too small for display :%d"
+                                " (only %d bytes usable)\n", display, sun_pathmax);
+                        exit(1);
+                }
+
+                if (connect(sockfd, (struct sockaddr *)&sa,
+                offsetof(struct sockaddr_un, sun_path) + sun_pathlen + 1) == 0) {
+                        close(sockfd);
+                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                        if (sockfd == -1)
+                                errExit("socket");
+                        continue;
+                }
+                if (errno != ECONNREFUSED && errno != ENOENT)
+                        errExit("connect");
+
+                // Name not claimed in the normal namespace; now try it
+                // in the abstract namespace.  Note that abstract-namespace
+                // names are NOT nul-terminated; they extend to the length
+                // specified as the third argument to 'connect'.
+                memmove(sa.sun_path + 1, sa.sun_path, sun_pathlen + 1);
+                sa.sun_path[0] = '\0';
+                if (connect(sockfd, (struct sockaddr *)&sa,
+                offsetof(struct sockaddr_un, sun_path) + 1 + sun_pathlen) == 0) {
+                        close(sockfd);
+                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                        if (sockfd == -1)
+                                errExit("socket");
+                        continue;
+                }
+                if (errno != ECONNREFUSED && errno != ENOENT)
+                        errExit("connect");
+
+                // This display number is unclaimed.  Of course, it could
+                // be claimed before we get around to doing it...
+                found = 1;
+                break;
+        }
+        close(sockfd);
 
         if (!found) {
-                fputs("Error: cannot find an unallocated X11 display number, "
-                      "exiting...\n", stderr);
+                fputs("Error: cannot find an unallocated X11 display number, "
+                        "exiting...\n", stderr);
                 exit(1);
         }
         return display;
 }
 #endif
 
+#ifdef HAVE_X11
+void x11_start_xvfb(int argc, char **argv) {
+        EUID_ASSERT();
+        int i;
+        struct stat s;
+        pid_t jail = 0;
+        pid_t server = 0;
 
+        setenv("FIREJAIL_X11", "yes", 1);
+
+        // mever try to run X servers as root!!!
+        if (getuid() == 0) {
+                fprintf(stderr, "Error: X11 sandboxing is not available when running as root\n");
+                exit(1);
+        }
+        drop_privs(0);
+
+        // check xephyr
+        if (!program_in_path("Xvfb")) {
+                fprintf(stderr, "\nError: Xvfb program was not found in /usr/bin directory, please install it:\n");
+                fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xvfb\n");
+                fprintf(stderr, "   Arch: sudo pacman -S xorg-server-xvfb\n");
+                exit(0);
+        }
+
+        int display = random_display_number();
+        char *display_str;
+        if (asprintf(&display_str, ":%d", display) == -1)
+                errExit("asprintf");
+
+        assert(xvfb_screen);
+
+        char *server_argv[256] = {                // rest initialyzed to NULL
+                "Xvfb", display_str, "-screen", "0", xvfb_screen
+        };
+        unsigned pos = 0;
+        while (server_argv[pos] != NULL) pos++;
+        assert(xvfb_extra_params);                // should be "" if empty
+
+        // parse xvfb_extra_params
+        // very basic quoting support
+        char *temp = strdup(xephyr_extra_params);
+        if (*xephyr_extra_params != '\0') {
+                if (!temp)
+                        errExit("strdup");
+                bool dquote = false;
+                bool squote = false;
+                for (i = 0; i < (int) strlen(xvfb_extra_params); i++) {
+                        if (temp[i] == '\"') {
+                                dquote = !dquote;
+                                                  // replace closing quote by \0
+                                if (dquote) temp[i] = '\0';
+                        }
+                        if (temp[i] == '\'') {
+                                squote = !squote;
+                                                  // replace closing quote by \0
+                                if (squote) temp[i] = '\0';
+                        }
+                        if (!dquote && !squote && temp[i] == ' ') temp[i] = '\0';
+                        if (dquote && squote) {
+                                fprintf(stderr, "Error: mixed quoting found while parsing xvfb_extra_params\n");
+                                exit(1);
+                        }
+                }
+                if (dquote) {
+                        fprintf(stderr, "Error: unclosed quote found while parsing xephyr_extra_params\n");
+                        exit(1);
+                }
+
+                for (i = 0; i < (int) strlen(xvfb_extra_params)-1; i++) {
+                        if (pos >= (sizeof(server_argv)/sizeof(*server_argv)) - 2) {
+                                fprintf(stderr, "Error: arg count limit exceeded while parsing xvfb_extra_params\n");
+                                exit(1);
+                        }
+                        if (temp[i] == '\0' && (temp[i+1] == '\"' || temp[i+1] == '\'')) server_argv[pos++] = temp + i + 2;
+                        else if (temp[i] == '\0' && temp[i+1] != '\0') server_argv[pos++] = temp + i + 1;
+                }
+        }
+
+        server_argv[pos++] = NULL;
+
+        assert(pos < (sizeof(server_argv)/sizeof(*server_argv))); // no overrun
+        assert(server_argv[pos-1] == NULL);       // last element is null
+
+        if (arg_debug) {
+                size_t i = 0;
+                printf("xvfb server:");
+                while (server_argv[i]!=NULL) {
+                        printf(" \"%s\"", server_argv[i]);
+                        i++;
+                }
+                putchar('\n');
+        }
+
+        // remove --x11 arg
+        char *jail_argv[argc+2];
+        int j = 0;
+        for (i = 0; i < argc; i++) {
+                if (strncmp(argv[i], "--x11", 5) == 0)
+                        continue;
+                jail_argv[j] = argv[i];
+                j++;
+        }
+        jail_argv[j] = NULL;
+
+        assert(j < argc+2);                       // no overrun
+
+        if (arg_debug) {
+                size_t i = 0;
+                printf("xvfb client:");
+                while (jail_argv[i]!=NULL) {
+                        printf(" \"%s\"", jail_argv[i]);
+                        i++;
+                }
+                putchar('\n');
+        }
+
+        server = fork();
+        if (server < 0)
+                errExit("fork");
+        if (server == 0) {
+                if (arg_debug)
+                        printf("Starting xvfb...\n");
+
+                // running without privileges - see drop_privs call above
+                assert(getenv("LD_PRELOAD") == NULL);
+                execvp(server_argv[0], server_argv);
+                perror("execvp");
+                _exit(1);
+        }
+
+        if (arg_debug)
+                printf("xephyr server pid %d\n", server);
+
+        // check X11 socket
+        char *fname;
+        if (asprintf(&fname, "/tmp/.X11-unix/X%d", display) == -1)
+                errExit("asprintf");
+        int n = 0;
+        // wait for x11 server to start
+        while (++n < 10) {
+                sleep(1);
+                if (stat(fname, &s) == 0)
+                        break;
+        };
+
+        if (n == 10) {
+                fprintf(stderr, "Error: failed to start xephyr\n");
+                exit(1);
+        }
+        free(fname);
+
+        if (arg_debug) {
+                printf("X11 sockets: "); fflush(0);
+                int rv = system("ls /tmp/.X11-unix");
+                (void) rv;
+        }
+
+        setenv("DISPLAY", display_str, 1);
+        // run attach command
+        jail = fork();
+        if (jail < 0)
+                errExit("fork");
+        if (jail == 0) {
+                if (!arg_quiet)
+                        printf("\n*** Attaching to Xvfb display %d ***\n\n", display);
+
+                // running without privileges - see drop_privs call above
+                assert(getenv("LD_PRELOAD") == NULL);
+                execvp(jail_argv[0], jail_argv);
+                perror("execvp");
+                _exit(1);
+        }
+
+        // cleanup
+        free(display_str);
+        free(temp);
+
+        // wait for either server or jail termination
+        pid_t pid = wait(NULL);
+
+        // see which process terminated and kill other
+        if (pid == server) {
+                kill(jail, SIGTERM);
+        }
+        else if (pid == jail) {
+                kill(server, SIGTERM);
+        }
+
+        // without this closing Xephyr window may mess your terminal:
+        // "monitoring" process will release terminal before
+        // jail process ends and releases terminal
+        wait(NULL);                               // fulneral
+
+        exit(0);
+}
 
 
-#ifdef HAVE_X11
 //$ Xephyr -ac -br -noreset -screen 800x600 :22 &
 //$ DISPLAY=:22 firejail --net=eth0 --blacklist=/tmp/.X11-unix/x0 firefox
 void x11_start_xephyr(int argc, char **argv) {
@@ -210,7 +404,7 @@ void x11_start_xephyr(int argc, char **argv) {
         struct stat s;
         pid_t jail = 0;
         pid_t server = 0;
-        
+
         setenv("FIREJAIL_X11", "yes", 1);
 
         // unfortunately, xephyr does a number of weird things when started by root user!!!
@@ -227,14 +421,16 @@ void x11_start_xephyr(int argc, char **argv) {
                 fprintf(stderr, "   Arch: sudo pacman -S xorg-server-xephyr\n");
                 exit(0);
         }
-        
+
         int display = random_display_number();
         char *display_str;
         if (asprintf(&display_str, ":%d", display) == -1)
                 errExit("asprintf");
 
         assert(xephyr_screen);
-        char *server_argv[256] = { "Xephyr", "-ac", "-br", "-noreset", "-screen", xephyr_screen }; // rest initialyzed to NULL
+        char *server_argv[256] = {                // rest initialyzed to NULL
+                "Xephyr", "-ac", "-br", "-noreset", "-screen", xephyr_screen
+        };
         unsigned pos = 0;
         while (server_argv[pos] != NULL) pos++;
         if (checkcfg(CFG_XEPHYR_WINDOW_TITLE)) {
@@ -242,7 +438,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 server_argv[pos++] = "firejail x11 sandbox";
         }
 
-        assert(xephyr_extra_params); // should be "" if empty
+        assert(xephyr_extra_params);              // should be "" if empty
 
         // parse xephyr_extra_params
         // very basic quoting support
@@ -255,11 +451,13 @@ void x11_start_xephyr(int argc, char **argv) {
                 for (i = 0; i < (int) strlen(xephyr_extra_params); i++) {
                         if (temp[i] == '\"') {
                                 dquote = !dquote;
-                                if (dquote) temp[i] = '\0'; // replace closing quote by \0
+                                                  // replace closing quote by \0
+                                if (dquote) temp[i] = '\0';
                         }
                         if (temp[i] == '\'') {
                                 squote = !squote;
-                                if (squote) temp[i] = '\0'; // replace closing quote by \0
+                                                  // replace closing quote by \0
+                                if (squote) temp[i] = '\0';
                         }
                         if (!dquote && !squote && temp[i] == ' ') temp[i] = '\0';
                         if (dquote && squote) {
@@ -281,13 +479,14 @@ void x11_start_xephyr(int argc, char **argv) {
                         else if (temp[i] == '\0' && temp[i+1] != '\0') server_argv[pos++] = temp + i + 1;
                 }
         }
-        
+
         server_argv[pos++] = display_str;
         server_argv[pos++] = NULL;
 
-        assert(pos < (sizeof(server_argv)/sizeof(*server_argv))); // no overrun
-        assert(server_argv[pos-1] == NULL); // last element is null
-        
+                                                  // no overrun
+        assert(pos < (sizeof(server_argv)/sizeof(*server_argv)));
+        assert(server_argv[pos-1] == NULL);       // last element is null
+
         if (arg_debug) {
                 size_t i = 0;
                 printf("xephyr server:");
@@ -302,18 +501,14 @@ void x11_start_xephyr(int argc, char **argv) {
         char *jail_argv[argc+2];
         int j = 0;
         for (i = 0; i < argc; i++) {
-                if (strcmp(argv[i], "--x11") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xpra") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xephyr") == 0)
+                if (strncmp(argv[i], "--x11", 5) == 0)
                         continue;
                 jail_argv[j] = argv[i];
                 j++;
         }
         jail_argv[j] = NULL;
 
-        assert(j < argc+2); // no overrun
+        assert(j < argc+2);                       // no overrun
 
         if (arg_debug) {
                 size_t i = 0;
@@ -324,7 +519,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 }
                 putchar('\n');
         }
-        
+
         server = fork();
         if (server < 0)
                 errExit("fork");
@@ -333,7 +528,7 @@ void x11_start_xephyr(int argc, char **argv) {
                         printf("Starting xephyr...\n");
 
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(server_argv[0], server_argv);
                 perror("execvp");
                 _exit(1);
@@ -353,17 +548,17 @@ void x11_start_xephyr(int argc, char **argv) {
                 if (stat(fname, &s) == 0)
                         break;
         };
-        
+
         if (n == 10) {
                 fprintf(stderr, "Error: failed to start xephyr\n");
                 exit(1);
         }
         free(fname);
-        
+
         if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
+                printf("X11 sockets: "); fflush(0);
+                int rv = system("ls /tmp/.X11-unix");
+                (void) rv;
         }
 
         setenv("DISPLAY", display_str, 1);
@@ -376,7 +571,7 @@ void x11_start_xephyr(int argc, char **argv) {
                         printf("\n*** Attaching to Xephyr display %d ***\n\n", display);
 
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(jail_argv[0], jail_argv);
                 perror("execvp");
                 _exit(1);
@@ -392,25 +587,27 @@ void x11_start_xephyr(int argc, char **argv) {
         // see which process terminated and kill other
         if (pid == server) {
                 kill(jail, SIGTERM);
-        } else if (pid == jail) {
+        }
+        else if (pid == jail) {
                 kill(server, SIGTERM);
         }
 
         // without this closing Xephyr window may mess your terminal:
         // "monitoring" process will release terminal before
         // jail process ends and releases terminal
-        wait(NULL); // fulneral
+        wait(NULL);                               // fulneral
 
         exit(0);
 }
 
+
 void x11_start_xpra(int argc, char **argv) {
         EUID_ASSERT();
         int i;
         struct stat s;
         pid_t client = 0;
         pid_t server = 0;
-        
+
         setenv("FIREJAIL_X11", "yes", 1);
 
         // unfortunately, xpra does a number of weird things when started by root user!!!
@@ -426,7 +623,7 @@ void x11_start_xpra(int argc, char **argv) {
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xpra\n");
                 exit(0);
         }
-        
+
         int display = random_display_number();
         char *display_str;
         if (asprintf(&display_str, ":%d", display) == -1)
@@ -455,9 +652,9 @@ void x11_start_xpra(int argc, char **argv) {
                         dup2(fd_null,1);
                         dup2(fd_null,2);
                 }
-        
+
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(server_argv[0], server_argv);
                 perror("execvp");
                 _exit(1);
@@ -477,18 +674,18 @@ void x11_start_xpra(int argc, char **argv) {
                 if (stat(fname, &s) == 0)
                         break;
         }
-        
+
         if (n == 10) {
                 fprintf(stderr, "Error: failed to start xpra\n");
                 exit(1);
         }
         free(fname);
-        
+
         if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
-        }
+                printf("X11 sockets: "); fflush(0);
+                int rv = system("ls /tmp/.X11-unix");
+                (void) rv;
+        }
 
         // build attach command
         char *attach_argv[] = { "xpra", "--title=\"firejail x11 sandbox\"", "attach", display_str, NULL };
@@ -508,7 +705,7 @@ void x11_start_xpra(int argc, char **argv) {
                         printf("\n*** Attaching to xpra display %d ***\n\n", display);
 
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(attach_argv[0], attach_argv);
                 perror("execvp");
                 _exit(1);
@@ -520,11 +717,7 @@ void x11_start_xpra(int argc, char **argv) {
         char *firejail_argv[argc+2];
         int pos = 0;
         for (i = 0; i < argc; i++) {
-                if (strcmp(argv[i], "--x11") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xpra") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xephyr") == 0)
+                if (strncmp(argv[i], "--x11", 5) == 0)
                         continue;
                 firejail_argv[pos] = argv[i];
                 pos++;
@@ -540,8 +733,8 @@ void x11_start_xpra(int argc, char **argv) {
                 errExit("fork");
         if (jail == 0) {
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
-                if (firejail_argv[0]) // shut up llvm scan-build
+                assert(getenv("LD_PRELOAD") == NULL);
+                if (firejail_argv[0])             // shut up llvm scan-build
                         execvp(firejail_argv[0], firejail_argv);
                 perror("execvp");
                 exit(1);
@@ -550,8 +743,8 @@ void x11_start_xpra(int argc, char **argv) {
         if (!arg_quiet)
                 printf("Xpra server pid %d, xpra client pid %d, jail %d\n", server, client, jail);
 
-        sleep(1); // let jail start
-
+        sleep(1); // adding a delay in order to let the server start
+        
         // wait for jail or server to end
         while (1) {
                 pid_t pid = wait(NULL);
@@ -568,7 +761,7 @@ void x11_start_xpra(int argc, char **argv) {
                                         dup2(fd_null,2);
                                 }
                                 // running without privileges - see drop_privs call above
-                                assert(getenv("LD_PRELOAD") == NULL);   
+                                assert(getenv("LD_PRELOAD") == NULL);
                                 execvp(stop_argv[0], stop_argv);
                                 perror("execvp");
                                 _exit(1);
@@ -588,7 +781,7 @@ void x11_start_xpra(int argc, char **argv) {
                                 else
                                         printf("xpra server successfully stopped in %d secs\n", n);
                         }
-                        
+
                         // kill xpra server and xpra client
                         kill(client, SIGTERM);
                         kill(server, SIGTERM);
@@ -604,6 +797,7 @@ void x11_start_xpra(int argc, char **argv) {
         }
 }
 
+
 void x11_start(int argc, char **argv) {
         EUID_ASSERT();
 
@@ -628,7 +822,7 @@ void x11_start(int argc, char **argv) {
 #endif
 
 // Porting notes:
-// 
+//
 // 1. merge #1100 from zackw:
 //     Attempting to run xauth -f directly on a file in /run/firejail/mnt/ directory fails on Debian 8
 //     with this message:
@@ -653,7 +847,7 @@ void x11_xorg(void) {
         struct stat s;
         if (stat("/usr/bin/xauth", &s) == -1) {
                 fprintf(stderr, "Error: xauth utility not found in PATH.  Please install it:\n"
-                                "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n");
+                        "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n");
                 exit(1);
         }
         if (s.st_uid != 0 && s.st_gid != 0) {
@@ -695,8 +889,8 @@ void x11_xorg(void) {
                 __gcov_flush();
 #endif
                 execlp("/usr/bin/xauth", "/usr/bin/xauth", "-v", "-f", tmpfname,
-                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL); 
-                
+                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL);
+
                 _exit(127);
         }
 
@@ -705,16 +899,19 @@ void x11_xorg(void) {
         if (waitpid(child, &status, 0) != child)
                 errExit("waitpid");
         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
-                 /* success */
-        } else if (WIFEXITED(status)) {
+                /* success */
+        }
+        else if (WIFEXITED(status)) {
                 fprintf(stderr, "Failed to create untrusted X cookie: xauth: exit %d\n",
                         WEXITSTATUS(status));
                 exit(1);
-        } else if (WIFSIGNALED(status)) {
+        }
+        else if (WIFSIGNALED(status)) {
                 fprintf(stderr, "Failed to create untrusted X cookie: xauth: %s\n",
                         strsignal(WTERMSIG(status)));
                 exit(1);
-        } else {
+        }
+        else {
                 fprintf(stderr, "Failed to create untrusted X cookie: "
                         "xauth: un-decodable exit status %04x\n", status);
                 exit(1);
@@ -728,10 +925,11 @@ void x11_xorg(void) {
         }
         if (set_perms(tmpfname, getuid(), getgid(), 0600))
                 errExit("set_perms");
-        
+
         // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted
         // automatically when the sandbox is closed (rename doesn't work)
-        if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) { // root needed
+                                                  // root needed
+        if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) {
                 fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
                 exit(1);
         }
@@ -740,7 +938,6 @@ void x11_xorg(void) {
         /* coverity[toctou] */
         unlink(tmpfname);
         umount("/tmp");
-        
 
         // Ensure there is already a file in the usual location, so that bind-mount below will work.
         // todo: fix TOCTOU races, currently managed by imposing /usr/bin/xauth as executable
@@ -765,9 +962,10 @@ void x11_xorg(void) {
         if (set_perms(dest, getuid(), getgid(), 0600))
                 errExit("set_perms");
         free(dest);
-#endif  
+#endif
 }
 
+
 void fs_x11(void) {
 #ifdef HAVE_X11
         int display = x11_display();
@@ -786,63 +984,62 @@ void fs_x11(void) {
         if (arg_debug || arg_debug_whitelists)
                 fprintf(stderr, "Masking all X11 sockets except %s\n", x11file);
 
-               // Move the real /tmp/.X11-unix to a scratch location
-                // so we can still access x11file after we mount a
-                // tmpfs over /tmp/.X11-unix.
-                int rv = mkdir(RUN_WHITELIST_X11_DIR, 0700);
-                if (rv == -1)
-                        errExit("mkdir");
-                if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 0700))
-                        errExit("set_perms");
-
-                if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
-                        errExit("mount bind");
-
-                // This directory must be mode 1777, or Xlib will barf.
-                if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
-                          MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
-                          "mode=1777,uid=0,gid=0") < 0)
-                        errExit("mounting tmpfs on /tmp/.X11-unix");
-                fs_logger("tmpfs /tmp/.X11-unix");
-
-                // create an empty file which will have the desired socket bind-mounted over it
-                int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
-                if (fd < 0)
-                        errExit(x11file);
-                if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
-                        errExit("fchown");
-                close(fd);
-
-                // do the mount
-                char *wx11file;
-                if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
-                        errExit("asprintf");
-                if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mount bind");
-                fs_logger2("whitelist", x11file);
-
-                free(x11file);
-                free(wx11file);
-
-                // block access to RUN_WHITELIST_X11_DIR
-                if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
-                        errExit("mount");
-                fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
+        // Move the real /tmp/.X11-unix to a scratch location
+        // so we can still access x11file after we mount a
+        // tmpfs over /tmp/.X11-unix.
+        int rv = mkdir(RUN_WHITELIST_X11_DIR, 0700);
+        if (rv == -1)
+                errExit("mkdir");
+        if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 0700))
+                errExit("set_perms");
+
+        if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
+                errExit("mount bind");
+
+        // This directory must be mode 1777, or Xlib will barf.
+        if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
+                MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
+                "mode=1777,uid=0,gid=0") < 0)
+                errExit("mounting tmpfs on /tmp/.X11-unix");
+        fs_logger("tmpfs /tmp/.X11-unix");
+
+        // create an empty file which will have the desired socket bind-mounted over it
+        int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
+        if (fd < 0)
+                errExit(x11file);
+        if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
+                errExit("fchown");
+        close(fd);
+
+        // do the mount
+        char *wx11file;
+        if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
+                errExit("asprintf");
+        if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mount bind");
+        fs_logger2("whitelist", x11file);
+
+        free(x11file);
+        free(wx11file);
+
+        // block access to RUN_WHITELIST_X11_DIR
+        if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
+                errExit("mount");
+        fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
 #endif
 }
 
+
 void x11_block(void) {
 #ifdef HAVE_X11
-        mask_x11_abstract_socket = 1;
-
         // check abstract socket presence and network namespace options
         if ((!arg_nonetwork && !cfg.bridge0.configured && !cfg.interface0.configured)
-                && x11_abstract_sockets_present()) {
+        && x11_abstract_sockets_present()) {
                 fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n"
-                                                "Additional setup required. To block abstract X11 socket you can either:\n"
-                                                " * use network namespace in firejail (--net=none, --net=...)\n"
-                                                " * add \"-nolisten local\" to xserver options\n"
-                                                "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
+                        "Additional setup required. To block abstract X11 socket you can either:\n"
+                        " * use network namespace in firejail (--net=none, --net=...)\n"
+                        " * add \"-nolisten local\" to xserver options\n"
+                        "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
                 exit(1);
         }
 
@@ -867,4 +1064,3 @@ void x11_block(void) {
         env_store("XAUTHORITY", RMENV);
 #endif
 }
-
diff --git a/src/firemon/arp.c b/src/firemon/arp.c
index cef48fb0d..d30983e4a 100644
--- a/src/firemon/arp.c
+++ b/src/firemon/arp.c
@@ -80,7 +80,7 @@ void arp(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1) {
                                 char *fname;
diff --git a/src/firemon/caps.c b/src/firemon/caps.c
index 8837c9ee7..a13b784a2 100644
--- a/src/firemon/caps.c
+++ b/src/firemon/caps.c
@@ -38,9 +38,7 @@ static void print_caps(int pid) {
                 if (strncmp(buf, "CapBnd:", 7) == 0) {
                         printf("  %s", buf);
                         fflush(0);
-                        free(file);
-                        fclose(fp);
-                        return;
+                        break;
                 }
         }
         fclose(fp);
@@ -55,7 +53,7 @@ void caps(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_caps(child);
diff --git a/src/firemon/cgroup.c b/src/firemon/cgroup.c
index bbb28f619..48427210b 100644
--- a/src/firemon/cgroup.c
+++ b/src/firemon/cgroup.c
@@ -52,7 +52,7 @@ void cgroup(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_cgroup(child);
diff --git a/src/firemon/cpu.c b/src/firemon/cpu.c
index 47c935686..2a6979573 100644
--- a/src/firemon/cpu.c
+++ b/src/firemon/cpu.c
@@ -39,9 +39,7 @@ static void print_cpu(int pid) {
                 if (strncmp(buf, "Cpus_allowed_list:", 18) == 0) {
                         printf("  %s", buf);
                         fflush(0);
-                        free(file);
-                        fclose(fp);
-                        return;
+                        break;
                 }
         }
         fclose(fp);
@@ -56,7 +54,7 @@ void cpu(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_cpu(child);
diff --git a/src/firemon/interface.c b/src/firemon/interface.c
index ba3c9fceb..77dd1f277 100644
--- a/src/firemon/interface.c
+++ b/src/firemon/interface.c
@@ -163,7 +163,7 @@ void interface(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1) {
                                 print_sandbox(child);
diff --git a/src/firemon/list.c b/src/firemon/list.c
index 1df737e8c..2152df31f 100644
--- a/src/firemon/list.c
+++ b/src/firemon/list.c
@@ -26,7 +26,7 @@ void list(void) {
         int i;
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1)
-                        pid_print_list(i, 0);
+                        pid_print_list(i, arg_nowrap);
         }
 }
 
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c
index ebcb7a72c..378bdefe9 100644
--- a/src/firemon/procevent.c
+++ b/src/firemon/procevent.c
@@ -150,10 +150,8 @@ doexit:
 static int procevent_netlink_setup(void) {
         // open socket for process event connector
         int sock;
-        if ((sock = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR)) < 0) {
-                fprintf(stderr, "Error: cannot open netlink socket\n");
-                exit(1);
-        }
+        if ((sock = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR)) < 0)
+                goto errexit;
 
         // bind socket
         struct sockaddr_nl addr;
@@ -161,10 +159,8 @@ static int procevent_netlink_setup(void) {
         addr.nl_pid = getpid();
         addr.nl_family = AF_NETLINK;
         addr.nl_groups = CN_IDX_PROC;
-        if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
-                fprintf(stderr, "Error: cannot bind to netlink socket\n");
-                exit(1);
-        }
+        if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0)
+                goto errexit;
 
         // send monitoring message
         struct nlmsghdr nlmsghdr;
@@ -189,12 +185,13 @@ static int procevent_netlink_setup(void) {
         iov[2].iov_base = &op;
         iov[2].iov_len = sizeof(op);
 
-        if (writev(sock, iov, 3) == -1) {
-                fprintf(stderr, "Error: cannot write to netlink socket\n");
-                exit(1);
-        }
+        if (writev(sock, iov, 3) == -1)
+                goto errexit;
         
         return sock;
+errexit:
+        fprintf(stderr, "Error: netlink socket problem\n");
+        exit(1);
 }
 
 
diff --git a/src/firemon/route.c b/src/firemon/route.c
index dff594431..145daa152 100644
--- a/src/firemon/route.c
+++ b/src/firemon/route.c
@@ -189,7 +189,7 @@ void route(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1) {
                                 char *fname;
diff --git a/src/firemon/seccomp.c b/src/firemon/seccomp.c
index d50692b37..e530fa1c3 100644
--- a/src/firemon/seccomp.c
+++ b/src/firemon/seccomp.c
@@ -37,9 +37,7 @@ static void print_seccomp(int pid) {
                 if (strncmp(buf, "Seccomp:", 8) == 0) {
                         printf("  %s", buf);
                         fflush(0);
-                        fclose(fp);
-                        free(file);
-                        return;
+                        break;
                 }
         }
         fclose(fp);
@@ -54,7 +52,7 @@ void seccomp(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_seccomp(child);
diff --git a/src/firemon/usage.c b/src/firemon/usage.c
index 1768237b3..20f2c071b 100644
--- a/src/firemon/usage.c
+++ b/src/firemon/usage.c
@@ -37,6 +37,7 @@ void usage(void) {
         printf("\t--name=name - print information only about named sandbox.\n\n");
         printf("\t--netstats - monitor network statistics for sandboxes creating a new\n");
         printf("\t\tnetwork namespace.\n\n");
+        printf("\t--nowrap - enable line wrapping in terminals.\n\n");
         printf("\t--route - print route table for each sandbox.\n\n");
         printf("\t--seccomp - print seccomp configuration for each sandbox.\n\n");
         printf("\t--tree - print a tree of all sandboxed processes.\n\n");
diff --git a/src/firemon/x11.c b/src/firemon/x11.c
index 97cfffe64..c923c8ef8 100644
--- a/src/firemon/x11.c
+++ b/src/firemon/x11.c
@@ -30,7 +30,7 @@ void x11(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         
                         char *x11file;
                         // todo: use macro from src/firejail/firejail.h for /run/firejail/x11 directory
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index aa1aec567..d60d48072 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -310,13 +310,16 @@ Remove DISPLAY and XAUTHORITY environment variables.
 Stop with error message if X11 abstract socket will be accessible in jail.
 .TP
 \fBx11 xephyr
-Enable X11 sandboxing with xephyr.
+Enable X11 sandboxing with Xephyr server.
 .TP
 \fBx11 xorg
 Enable X11 sandboxing with X11 security extension.
 .TP
 \fBx11 xpra
-Enable X11 sandboxing with xpra.
+Enable X11 sandboxing with Xpra server.
+.TP
+\fBx11 xvfb
+Enable X11 sandboxing with Xvfb server.
 
 .SH Resource limits, CPU affinity, Control Groups
 These profile entries define the limits on system resources (rlimits) for the processes inside the sandbox.
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f978661dc..2b6069a7a 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1772,17 +1772,17 @@ $ sudo firejail --writable-var-log
 
 .TP
 \fB\-\-x11
-Sandbox the application using Xpra, Xephyr or Xorg security extension.
+Sandbox the application using Xpra, Xephyr, Xvfb or Xorg security extension.
 The sandbox will prevents screenshot and keylogger applications started inside the sandbox from accessing
 clients running outside the sandbox.
 Firejail will try first Xpra, and if Xpra is not installed on the system, it will try to find Xephyr.
-If all fails, Firejail will not attempt to use X11 security extension.
+If all fails, Firejail will not attempt to use Xvfb or X11 security extension. 
 .br
 
 .br
-Xpra and Xephyr modes require a network namespace to be instantiated in order to disable
+Xpra, Xephyr and Xvfb modes require a network namespace to be instantiated in order to disable
 X11 abstract Unix socket. If this is not possible, the user can disable the abstract socket
-by adding "-nolisten local" on Xorg command line.
+by adding "-nolisten local" on Xorg command line at system level.
 .br
 
 .br
@@ -1859,6 +1859,68 @@ Example:
 .br
 $ firejail \-\-x11=xpra --net=eth0 firefox
 
+
+.TP
+\fB\-\-x11=xvfb
+Start Xvfb X11 server and attach the sandbox to this server. 
+Xvfb, short for X virtual framebuffer, performs all graphical operations in memory 
+without showing any screen output. Xvfb is mainly used for remote access and software 
+testing on headless servers.
+.br
+
+.br
+On Debian platforms Xvfb is installed with the command \fBsudo apt-get install xvfb\fR.
+This feature is not available when running as root.
+.br
+
+.br
+Example: remote VNC access
+.br
+
+.br
+On the server we start a sandbox using Xvfb and openbox
+window manager. The default size of Xvfb screen is 800x600 - it can be changed
+in /etc/firejail/firejail.config (xvfb-screen). Some sort of networking (--net) is required
+in order to isolate the abstract sockets used by other X servers.
+.br
+
+.br
+$ firejail --net=none --x11=xvfb openbox
+.br
+
+.br
+*** Attaching to Xvfb display 792 ***
+.br
+
+.br
+Reading profile /etc/firejail/openbox.profile
+.br
+Reading profile /etc/firejail/disable-common.inc
+.br
+Reading profile /etc/firejail/disable-common.local
+.br
+Parent pid 5400, child pid 5401
+.br
+
+.br
+On the server we also start a VNC server and attach it to the display handled by our
+Xvfb server (792).
+.br
+
+.br
+$ x11vnc -display :792
+.br
+
+.br
+On the client machine we start a VNC viewer and use it to connect to our server:
+.br
+
+.br
+$ vncviewer
+.br
+
+
+
 .TP
 \fB\-\-zsh
 Use /usr/bin/zsh as default user shell.
diff --git a/src/man/firemon.txt b/src/man/firemon.txt
index bd84401af..ecb626fc6 100644
--- a/src/man/firemon.txt
+++ b/src/man/firemon.txt
@@ -37,6 +37,9 @@ Print information only about named sandbox.
 \fB\-\-netstats
 Monitor network statistics for sandboxes creating a new network namespace.
 .TP
+\fB\-\-nowrap
+Enable line wrapping in terminals. By default the lines are trimmed.
+.TP
 \fB\-\-route
 Print route table for each sandbox.
 .TP
diff --git a/test/apps-x11-xorg/firefox.exp b/test/apps-x11-xorg/firefox.exp
index 4da9e5a16..4fd17caa6 100755
--- a/test/apps-x11-xorg/firefox.exp
+++ b/test/apps-x11-xorg/firefox.exp
@@ -41,7 +41,7 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
-send -- "firemon --seccomp\r"
+send -- "firemon --seccomp --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit}
@@ -61,7 +61,7 @@ expect {
         "name=blablabla"
 }
 sleep 1
-send -- "firemon --caps\r"
+send -- "firemon --caps --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         " firefox" {puts "firefox detected\n";}
diff --git a/test/apps-x11-xorg/icedove.exp b/test/apps-x11-xorg/icedove.exp
index ce1d38222..8f6722cd7 100755
--- a/test/apps-x11-xorg/icedove.exp
+++ b/test/apps-x11-xorg/icedove.exp
@@ -38,7 +38,7 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
-send -- "firemon --seccomp\r"
+send -- "firemon --seccomp --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit}
@@ -57,7 +57,7 @@ expect {
         "name=blablabla"
 }
 sleep 2
-send -- "firemon --caps\r"
+send -- "firemon --caps --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         ":firejail"
diff --git a/test/apps-x11-xorg/transmission-gtk.exp b/test/apps-x11-xorg/transmission-gtk.exp
index c6d9ba13a..3eb537c1b 100755
--- a/test/apps-x11-xorg/transmission-gtk.exp
+++ b/test/apps-x11-xorg/transmission-gtk.exp
@@ -38,7 +38,7 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
-send -- "firemon --seccomp\r"
+send -- "firemon --seccomp --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit}
@@ -57,7 +57,7 @@ expect {
         "name=blablabla"
 }
 sleep 1
-send -- "firemon --caps\r"
+send -- "firemon --caps --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         ":firejail"
diff --git a/test/environment/nice.exp b/test/environment/nice.exp
index 2c00d1485..50e789c9e 100755
--- a/test/environment/nice.exp
+++ b/test/environment/nice.exp
@@ -77,7 +77,48 @@ expect {
         "top"
 }
 
+sleep 1
+send -- "exit\r"
+after 100
+
+
+# negative nice value should result in nice=0
+send -- "firejail --nice=-5\r"
+expect {
+        timeout {puts "TESTING ERROR 17\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "top -b -n 1\r"
+expect {
+        timeout {puts "TESTING ERROR 18\n";exit}
+        $env(USER)
+}
+expect {
+        timeout {puts "TESTING ERROR 19\n";exit}
+        "0"
+}
+expect {
+        timeout {puts "TESTING ERROR 20\n";exit}
+        "bash"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        $env(USER)
+}
+expect {
+        timeout {puts "TESTING ERROR 22\n";exit}
+        "0"
+}
+expect {
+        timeout {puts "TESTING ERROR 23\n";exit}
+        "top"
+}
 
+sleep 1
+send -- "exit\r"
+after 100
 
 puts "\nall done\n"
 
diff --git a/test/environment/output.exp b/test/environment/output.exp
index 10c325832..d175ddae2 100755
--- a/test/environment/output.exp
+++ b/test/environment/output.exp
@@ -61,5 +61,27 @@ expect {
 }
 after 100
 send -- "rm -f logfile*\r"
+
+
+send -- "firejail --output=../logfile -- ./output.sh\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "invalid output file"
+}
+after 100
+
+send -- "firejail --output=/etc -- ./output.sh\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "invalid output file"
+}
+after 100
+
+send -- "firejail --output=/etc/firejail/zoom.profile -- ./output.sh\r"
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "the output file needs to be owned by the current user"
+}
+
 after 100
 puts "\nall done\n"
diff --git a/test/filters/debug.exp b/test/filters/debug.exp
new file mode 100755
index 000000000..493022c05
--- /dev/null
+++ b/test/filters/debug.exp
@@ -0,0 +1,45 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2017 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --debug-syscalls\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "set_mempolicy"
+}
+after 100
+
+send --  "firejail --debug-syscalls\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "setitimer"
+}
+after 100
+
+send --  "firejail --debug-errnos\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "EBADMSG"
+}
+after 100
+
+send --  "firejail --debug-errnos\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "ELIBMAX"
+}
+after 100
+
+send --  "firejail --debug-protocols\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "unix, inet, inet6, netlink, packet"
+}
+after 100
+
+puts "all done\n"
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 73e0e4d5c..4996e6d66 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -6,6 +6,9 @@
 export MALLOC_CHECK_=3
 export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
 
+echo "TESTING: debug options (test/filters/debug.exp)"
+./debug.exp
+
 echo "TESTING: noroot (test/filters/noroot.exp)"
 ./noroot.exp
 
diff --git a/test/root/git.exp b/test/root/git.exp
new file mode 100755
index 000000000..c5ddeee89
--- /dev/null
+++ b/test/root/git.exp
@@ -0,0 +1,51 @@
+#!/usr/bin/expect -f
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+
+
+send -- "firejail --version\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "git install support is disabled" { puts "TESTING: git support not available in current build\n"; exit}
+        "git install support is enabled" { puts "git support available\n"}
+}
+
+set timeout 120
+send -- "firejail --git-install\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Cloning into"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Configuration options"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "src/fseccomp/fseccomp default seccomp"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "Mainline git Firejail version was installed in"
+}
+after 100
+
+send -- "firejail --git-uninstall\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "Cloning into"
+}
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Configuration options"
+}
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "Firejail mainline git version uninstalled from"
+}
+after 100
+
+puts "\nall done\n"
diff --git a/test/root/root.sh b/test/root/root.sh
index 9764b3804..29c618772 100755
--- a/test/root/root.sh
+++ b/test/root/root.sh
@@ -62,6 +62,9 @@ echo "TESTING: fs whitelist mnt, opt, media (test/root/whitelist-mnt.exp)"
 echo "TESTING: join (test/root/join.exp)"
 ./join.exp
 
+echo "TESTING: git-install (test/root/git.exp)"
+./git.exp
+
 #********************************
 # seccomp
 #********************************
diff --git a/test/utils/join.exp b/test/utils/join.exp
index b74b0b17a..d5c421676 100755
--- a/test/utils/join.exp
+++ b/test/utils/join.exp
@@ -16,6 +16,14 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
+send --  "firejail --shell=none --join=jointesting\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "shell=none set, but no command specified"
+}
+after 100
+
+
 send --  "firejail --join=jointesting\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}