2 files changed, 62 insertions, 8 deletions

diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt
index 687aedf59..fcf4109ee 100644
--- a/src/man/firejail-config.txt
+++ b/src/man/firejail-config.txt
@@ -14,16 +14,16 @@ time. Most features are enabled by default both at compile time and
 at run time.
 
 .TP
-\fBsecomp
-Enable or disable seccomp support, default enabled.
+\fBbind
+Enable or disable bind support, default enabled.
 
 .TP
 \fBchroot
 Enable or disable chroot support, default enabled.
 
 .TP
-\fBbind
-Enable or disable bind support, default enabled.
+\fBfile-transfer
+Enable or disable file transfer support, default enabled.
 
 .TP
 \fBnetwork
@@ -37,6 +37,10 @@ Restricted networking grants access to --interface and --net=ethXXX
 only to root user. Regular users are only allowed --net=none.
 
 .TP
+\fBsecomp
+Enable or disable seccomp support, default enabled.
+
+.TP
 \fBuserns
 Enable or disable user namespace support, default enabled.
 
@@ -45,8 +49,19 @@ Enable or disable user namespace support, default enabled.
 Enable or disable X11 sandboxing support, default enabled.
 
 .TP
-\fBfile-transfer
-Enable or disable file transfer support, default enabled.
+\fBxephyr-screen
+Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
+a full list of resolutions available on your specific setup. Examples:
+.br
+
+.br
+xephyr-screen 640x480
+.br
+xephyr-screen 800x600
+.br
+xephyr-screen 1024x768
+.br
+xephyr-screen 1280x1024
 
 .SH FILES
 /etc/firejail/firejail.config
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 6eb7c3ff7..a3c39a82b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1513,10 +1513,28 @@ $ firejail "\-\-whitelist=/home/username/My Virtual Machines"
 
 .TP
 \fB\-\-x11
+Start a new X11 server using Xpra or Xephyr and attach the sandbox to this server.
+The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger
+applications started in the sandbox from accessing other X11 displays.
+A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket.
+.br
+
+.br
+Firejail will try first Xpra, and if Xpra is not installed on the system, it will try to find Xephyr.
+This feature is not available when running as root. 
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-x11 --net=eth0 firefox
+
+.TP
+\fB\-\-x11=xpra
 Start a new X11 server using Xpra (http://xpra.org) and attach the sandbox to this server.
 Xpra is a persistent remote display server and client for forwarding X11 applications and desktop screens.
-The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger
-applications started in the sandbox from accessing display 0. This feature is not available when running as root. 
+On Debian platforms Xpra is installed with the command \fBsudo apt-get install xpra\fR.
+This feature is not available when running as root.
 .br
 
 .br
@@ -1525,6 +1543,27 @@ Example:
 $ firejail \-\-x11 --net=eth0 firefox
 
 .TP
+\fB\-\-x11=xephyr
+Start a new X11 server using Xephyr and attach the sandbox to this server.
+Xephyr is a display server implementing the X11 display server protocol.
+It runs in a window just like other X applications, but it is an X server itself in which you can run other software.
+The default Xephyr window size is 800x600. This can be modified in /etc/firejail/firejail.config file,
+see \fBman 5 firejail-config\fR for more details.
+.br
+
+.br
+The recommended way to use this feature is to run a window manager inside the sandbox.
+A security profile for OpenBox is provided.
+On Debian platforms Xephyr is installed with the command \fBsudo apt-get install xserver-xephyr\fR.
+This feature is not available when running as root. 
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-x11 --net=eth0 openbox
+
+.TP
 \fB\-\-zsh
 Use /usr/bin/zsh as default user shell.
 .br