Firejail/Flatpak applications display "as superuser" on window title

[slazur]

Applications launched under Firejail and Flatpak include "(as superuser)" in their window's title even though they're not actually being ran as root.

More information from Firejail's issues tracker: (as superuser) in title bar.

Debian stretch, marco 1.16.0, firejail 0.9.44.2, flatpak 0.6.14.

[monsta]

It's up to them to solve this, MATE apps know nothing about Firejail or Flatpak.

[smitsohu]

For the record: This is probably a result of PID namespaces, and the effect should be observable with many sandboxing tools (firejail, bubblewrap, flatpack, ...)

The PID from inside the sandbox, often a single digit number, is used to set _NET_WM_PID, and then probably the window manager checks outside the sandbox if this _NET_WM_PID belongs to the superuser (which it usually does).

[halfline]

I'd suggest you use the XResource extension to query the LOCAL_CLIENT_PID value for the window from the X server rather than trust _NET_WM_PID which may be faked or running inside a different pid namespace. @monsta don't know if you want to reopen given the last couple of comments ?

[davidedmundson]

(I got linked to here from a KDE bug report with a similar problem)

That's not a terrible idea, but blindly switching will break just as many places as it fixes.
Like smplayer which have mplayer and the GUI as separate processes, but deliberately have a NET_WM_PID which is "faked"

[halfline]

shouldnt matter unless one of the separate processes runs as root right?

[SivaMachina]

I wonder if this issue is related to why some of the flatpaks don't fit in with the DE I am using. Kinda like if I were actually running them as root.

[LorenzoAncora]

The bug is still present on Marco 1.20.3-1 [Debian GNU/Linux 10 (buster)].
End users don't care which team fixes it, @monsta.