diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/man/firejail-config.txt | 27 | ||||
-rw-r--r-- | src/man/firejail.txt | 43 |
2 files changed, 62 insertions, 8 deletions
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt index 687aedf59..fcf4109ee 100644 --- a/src/man/firejail-config.txt +++ b/src/man/firejail-config.txt | |||
@@ -14,16 +14,16 @@ time. Most features are enabled by default both at compile time and | |||
14 | at run time. | 14 | at run time. |
15 | 15 | ||
16 | .TP | 16 | .TP |
17 | \fBsecomp | 17 | \fBbind |
18 | Enable or disable seccomp support, default enabled. | 18 | Enable or disable bind support, default enabled. |
19 | 19 | ||
20 | .TP | 20 | .TP |
21 | \fBchroot | 21 | \fBchroot |
22 | Enable or disable chroot support, default enabled. | 22 | Enable or disable chroot support, default enabled. |
23 | 23 | ||
24 | .TP | 24 | .TP |
25 | \fBbind | 25 | \fBfile-transfer |
26 | Enable or disable bind support, default enabled. | 26 | Enable or disable file transfer support, default enabled. |
27 | 27 | ||
28 | .TP | 28 | .TP |
29 | \fBnetwork | 29 | \fBnetwork |
@@ -37,6 +37,10 @@ Restricted networking grants access to --interface and --net=ethXXX | |||
37 | only to root user. Regular users are only allowed --net=none. | 37 | only to root user. Regular users are only allowed --net=none. |
38 | 38 | ||
39 | .TP | 39 | .TP |
40 | \fBsecomp | ||
41 | Enable or disable seccomp support, default enabled. | ||
42 | |||
43 | .TP | ||
40 | \fBuserns | 44 | \fBuserns |
41 | Enable or disable user namespace support, default enabled. | 45 | Enable or disable user namespace support, default enabled. |
42 | 46 | ||
@@ -45,8 +49,19 @@ Enable or disable user namespace support, default enabled. | |||
45 | Enable or disable X11 sandboxing support, default enabled. | 49 | Enable or disable X11 sandboxing support, default enabled. |
46 | 50 | ||
47 | .TP | 51 | .TP |
48 | \fBfile-transfer | 52 | \fBxephyr-screen |
49 | Enable or disable file transfer support, default enabled. | 53 | Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for |
54 | a full list of resolutions available on your specific setup. Examples: | ||
55 | .br | ||
56 | |||
57 | .br | ||
58 | xephyr-screen 640x480 | ||
59 | .br | ||
60 | xephyr-screen 800x600 | ||
61 | .br | ||
62 | xephyr-screen 1024x768 | ||
63 | .br | ||
64 | xephyr-screen 1280x1024 | ||
50 | 65 | ||
51 | .SH FILES | 66 | .SH FILES |
52 | /etc/firejail/firejail.config | 67 | /etc/firejail/firejail.config |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 6eb7c3ff7..a3c39a82b 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -1513,10 +1513,28 @@ $ firejail "\-\-whitelist=/home/username/My Virtual Machines" | |||
1513 | 1513 | ||
1514 | .TP | 1514 | .TP |
1515 | \fB\-\-x11 | 1515 | \fB\-\-x11 |
1516 | Start a new X11 server using Xpra or Xephyr and attach the sandbox to this server. | ||
1517 | The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger | ||
1518 | applications started in the sandbox from accessing other X11 displays. | ||
1519 | A network namespace needs to be instantiated in order to deny access to X11 abstract Unix domain socket. | ||
1520 | .br | ||
1521 | |||
1522 | .br | ||
1523 | Firejail will try first Xpra, and if Xpra is not installed on the system, it will try to find Xephyr. | ||
1524 | This feature is not available when running as root. | ||
1525 | .br | ||
1526 | |||
1527 | .br | ||
1528 | Example: | ||
1529 | .br | ||
1530 | $ firejail \-\-x11 --net=eth0 firefox | ||
1531 | |||
1532 | .TP | ||
1533 | \fB\-\-x11=xpra | ||
1516 | Start a new X11 server using Xpra (http://xpra.org) and attach the sandbox to this server. | 1534 | Start a new X11 server using Xpra (http://xpra.org) and attach the sandbox to this server. |
1517 | Xpra is a persistent remote display server and client for forwarding X11 applications and desktop screens. | 1535 | Xpra is a persistent remote display server and client for forwarding X11 applications and desktop screens. |
1518 | The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger | 1536 | On Debian platforms Xpra is installed with the command \fBsudo apt-get install xpra\fR. |
1519 | applications started in the sandbox from accessing display 0. This feature is not available when running as root. | 1537 | This feature is not available when running as root. |
1520 | .br | 1538 | .br |
1521 | 1539 | ||
1522 | .br | 1540 | .br |
@@ -1525,6 +1543,27 @@ Example: | |||
1525 | $ firejail \-\-x11 --net=eth0 firefox | 1543 | $ firejail \-\-x11 --net=eth0 firefox |
1526 | 1544 | ||
1527 | .TP | 1545 | .TP |
1546 | \fB\-\-x11=xephyr | ||
1547 | Start a new X11 server using Xephyr and attach the sandbox to this server. | ||
1548 | Xephyr is a display server implementing the X11 display server protocol. | ||
1549 | It runs in a window just like other X applications, but it is an X server itself in which you can run other software. | ||
1550 | The default Xephyr window size is 800x600. This can be modified in /etc/firejail/firejail.config file, | ||
1551 | see \fBman 5 firejail-config\fR for more details. | ||
1552 | .br | ||
1553 | |||
1554 | .br | ||
1555 | The recommended way to use this feature is to run a window manager inside the sandbox. | ||
1556 | A security profile for OpenBox is provided. | ||
1557 | On Debian platforms Xephyr is installed with the command \fBsudo apt-get install xserver-xephyr\fR. | ||
1558 | This feature is not available when running as root. | ||
1559 | .br | ||
1560 | |||
1561 | .br | ||
1562 | Example: | ||
1563 | .br | ||
1564 | $ firejail \-\-x11 --net=eth0 openbox | ||
1565 | |||
1566 | .TP | ||
1528 | \fB\-\-zsh | 1567 | \fB\-\-zsh |
1529 | Use /usr/bin/zsh as default user shell. | 1568 | Use /usr/bin/zsh as default user shell. |
1530 | .br | 1569 | .br |