cannot open x11 apps with --net=none (/tmp setup issue)

[haarp]

Hello!

On an older system (firejail-0.9.70 or older) I could run Wine applications without network access with firejail --net=none wine foo.exe.

On my new system (firejail-0.9.72) this fails ($DISPLAY is set):

firejail --net=none wine foo.exe
...
0120:err:winediag:nodrv_CreateWindow Application tried to create a window, but no driver could be loaded.
0120:err:winediag:nodrv_CreateWindow L"Make sure that your X server is running and that $DISPLAY is set correctly."
...

on further investigation, it seems X applications in general don't work with --net=none:

firejail --noprofile --net=none xev
...
xev:  unable to open display ':0.0'

I cannot say what changed between the old and new system. The firejail version does not seem to be the culprit.

Alternatives considered:

• firejail --noprofile --protocol=unix: Allows X apps to work and prevents network access. But the Wine app won't start without the inet protocol.
• --net=br0/tap0: Requires setting up bridge/TAP interfaces first, which involves root rights, which is not an option for this use-case.
• --netfilter: Won't work in system network namespace

I'm thinking the solution would be to use --net=none and add whatever X needs. But what?

Any ideas? Thanks a lot!

[haarp]

Ok, after trying, searching, reading manpages and looking at issues (#3568 and #2711 in particular), I finally figured it out.

My system mounts tmpfs on top of /tmp/ during the boot process, but after X starts. 🤦 So firejail cannot hand /tmp/.X11-unix/X0 over to the jail. The fix is to mount /tmp/ earlier in the boot process.