Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My Firefox configuration is tricky:

  1. Firefox runs at separate restricted user account which cannot connect to main X server.
  2. Firefox uses Xvfb (virtual "headless" X server) as X server.
  3. x11vnc is running on that Xvfb.
  4. On the main X server there is vncviewer running that connect to this x11vnc

On powerful laptop (Acer Extensa 5220) it seems to work more or less well, but on "Acer Aspire One" netbook it is slowish (on a background that firefox is loaded with lots of extensions).

How to optimise this scheme? Requirements:

  1. Browser cannot connect to main X server.
  2. Browser should be in chroot jail (no "suid" scripts, readonly for many things)
  3. Browser should have a lot of features (like in AutoPager, NoScript, WoT, AdBlockPlus)
share|improve this question
IMHO, X11 separation is just paranoia. – grawity Feb 20 '11 at 14:53
@grawity, Browser is expected to be affected by various security exploits. If browser runs malicious native code, it can connect to X server and input commands there, so gain elevated access. I don't want main browser to be a trusted component. – Vi. Feb 20 '11 at 17:31
@Vi. You may find interesting, it is an OS based on xen + small virtualized linux guests, and guests can't access the main X server directly. Basically, it implements everything you want (including separate virtual hard disk instead of a chroot), but evrything's pre-configured for you :) . – Georges Dupéron May 12 '14 at 13:55
@GeorgesDupéron, How to attain decent GUI performance without giving direct access to X server? The main questoin is what to put between X and the browser. – Vi. May 12 '14 at 15:03
Well, I know little about qubes-os, but it seems that they use a custom protocol to communicate efficiently between the Xorg in the VM and the Xorg on the host. You should definitely read this page : even if you don't agree with some of their implementation choices, it may give you some ideas. – Georges Dupéron May 12 '14 at 15:26

Try using Xephyr as the X11 server.

Another possibility is to run Firefox over a SSH connection to localhost, with restricted X11 forwarding. The OpenSSH ssh client has options ForwardX11 and ForwardX11Trusted; disable the latter in ~/.ssh/config.

share|improve this answer
Will SSH approach it prevent Firefox from running things like x11vnc and controlling all application connected to the same X server? – Vi. Feb 20 '11 at 17:32
@Vi: Untrusted clients will not have access to windows created by any other program. – grawity Feb 20 '11 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .