X11 Guide

[rusty-snake]

Discussion for discussions about https://github.com/netblue30/firejail/wiki/X11-Guide.

Predecessor: #3602

[crocket]

--x11=xpra doesn't really launch a window, and it is very slow to set up an xpra sandbox for some reason.

Xephyr is said to have performance issue.

Does x11 security extension work?

[crocket]

It seems I can't use xpra... Does xephyr have performance issues?

[rusty-snake]

There is #3702 but IDK if this is a config problem or a general problem.

[crocket]

I don't use virtualgl.

[crocket]

It seems xephyr doesn't give me a resizable window. A tiling window manager like sway doesn't work well with xephyr.
It seems I'm stuck with either XWayland or xpra.
How can I make xpra fast? Xpra is reasonably fast outside firejail. But, it is very slow inside firejail. Why?

[crocket]

Anyway, it seems sandboxing X11 involves too much trouble. I will just migrate as many applications as possible over to wayland.

[matu3ba]

Author of x11 guide (that is based on test experience of the netblue30 article) here.

"Xephyr is said to have performance issue."
Not true, I wrote after testing "occasionally has lags, where you cant move your mouse for a while." So its usable, but the mouse may stutter sometimes.
Do you have suggestions how to make this more clear in the wiki?

[crocket]

Is xephyr a lot faster than xpra inside a firejail sandbox?

I wrote after testing "occasionally has lags, where you cant move your mouse for a while." So its usable, but the mouse may stutter sometimes. Do you have suggestions how to make this more clear in the wiki?

There is no performance issue apart from the issue that mouse cursor occasionally stutters.

[matu3ba]

done.

[totaam]

I made xpra work by adding my user to xpra group

That's only needed if $XDG_RUNTIME_DIR is not created.
And even then, xpra should gracefully fallback to something like /tmp.

I also hate seeing xpra splash screen that I see with --x11=xpra.

--splash=no

How can I make xpra fast? Xpra is reasonably fast outside firejail.

When running locally, it should be almost indistinguishable from native.
(bar startup cost - which can be drastically reduced via configuration: no splash, no opengl, fixed fakexinerama path, etc)

But, it is very slow inside firejail. Why?

My guess is that mmap is disabled so all the screen updates end up being encoded and forwarded over a unix domain socket. Even a virtual machine would be faster than this!

[rusty-snake]

xpra.profile does not block mmap via seccomp.

[totaam]

xpra.profile does not block mmap via seccomp.

My bad. Just tried it and mmap is enabled, performance is pretty good here on Fedora 34 with Firefox running at 4K. Only the occasional framedrop watching youtube fullscreen.

[crocket]

$XDG_RUNTIME_DIR exists.

How can I pass --splash=no to xpra through firejail? firejail --noprofile --x11=xpra alacritty

Can you give me command examples?

[rusty-snake]

firejail/etc/firejail.config

Lines 151 to 152 in 7aec067

	# Xpra server command extra parameters. None by default; this is an example.
	# xpra-extra-params --dpi 96

[totaam]

How can I pass --splash=no to xpra through firejail?

I don't know how to do that with firejail, but you can do that easily enough with xpra:

echo "splash = no" >> ~/.config/xpra/xpra.conf

(older versions used .xpra/xpra.conf)

[crocket]

I disabled xpra splash. But, --x11=xpra slows down startup and rendering of alacritty significantly to the point where I think a VTE-based terminal emulator on wayland backend is going to be much better.

[totaam]

slows down startup

Default config uses Xdummy, Xvfb is faster.
But in any case, it will be slower than native: around 2 second is standard.

I think a VTE-based terminal emulator

Yes, why go through all this trouble for a terminal emulator?

[crocket]

X11 is evil. After replacing alacritty with a VTE-based terminal emulator and sxiv with imv, emacs is the last remaining X11 program on my system. I can accept one X11 program on sway.

Even emacs is going to be a native citizen on wayland soon.

[jjakob]

I managed to get xclipsync to work with Xephyr. A modification to the xclipsync script was needed in my case to use the exact binary name wish8.6 instead of just wish, which is a symlink. Maybe because I used private-bin or because I blacklisted /usr/bin in my profile, /usr/bin was "permission denied".

1. download xclipsync and xclipfrom and put them in /usr/local/bin, chmod +x (they're <40 LOC each)
2. edit xclipsync, change lines 37 and 38: replace "wish" with "wish8.6" or the name of the wish binary (find it with command -v wish) - this is needed probably because I blacklisted /usr/bin in the profile which meant all binaries were only accessible in /bin and /sbin, the wish symlink pointed to the blacklisted /usr/bin/wish8.6
3. if you use private-bin you need to add: xclipsync,xclipfrom,xclip,dirname,wish*
4. if you use private-lib you need to add: tcl*,tk*
5. change your command line to add xclipsync & before starting the WM or browser

With Xephyr you usually also need a WM, I needed it because the browser window did not resize itself to the resolution of the Xephyr display but stayed smaller. I used dwm because that's what I already had installed but is overkill. Other possible choices of minimal WMs might be matchbox, ratpoison, 2bwm. You just want something that handles window resizing, no other features. kiosk-wm might also work, it's even smaller than the rest.

[matu3ba]

Feel free to edit the wiki page with instruction steps of the X11 Guide at "TODO: xclipsync appears not to work or write cli for clipboard handling?".

I'll be switching to Arcan and do not plan to complete the guide to work around these problems.