[GH-ISSUE #1] Modify seccomp arguments in profile config for more flexibility

gitea-mirror commented

2026-05-05 04:42:03 -06:00

Owner

Originally created by @boltronics on GitHub (Aug 9, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1

At the time of writing, firejail supports:

       seccomp
              Enable default seccomp filter.

       seccomp syscall,syscall,syscall
              Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter.

       seccomp.drop syscall,syscall,syscall
              Enable seccomp filter and blacklist  the system calls in the list.

       seccomp.keep syscall,syscall,syscall
              Enable seccomp filter and whitelist the system calls in the list.

What I actually want is the default seccomp filter, with some additional system calls on top of the default seccomp filter. Additionally, I might want to remove some system calls in the same profile. To facilitate this functionality, I suggest changing the second seccomp usage option to work like follows:

       seccomp -syscall,-syscall,-syscall,+syscall,+syscall,+syscall
              Enable seccomp filter and whitelist and/or blacklist additional system calls in the list on top of the default seccomp filter.

Regardless of how the information is specified in the profile, it would be very helpful to somehow just say "use the default filter +/- these other system calls". This should cut down the work required for people following the Firejail Seccomp Guide.

Originally created by @boltronics on GitHub (Aug 9, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/1 At the time of writing, firejail supports: ``` seccomp Enable default seccomp filter. seccomp syscall,syscall,syscall Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter. seccomp.drop syscall,syscall,syscall Enable seccomp filter and blacklist the system calls in the list. seccomp.keep syscall,syscall,syscall Enable seccomp filter and whitelist the system calls in the list. ``` What I actually want is the default seccomp filter, with some additional system calls on top of the default seccomp filter. Additionally, I might want to remove some system calls in the same profile. To facilitate this functionality, I suggest changing the second seccomp usage option to work like follows: ``` seccomp -syscall,-syscall,-syscall,+syscall,+syscall,+syscall Enable seccomp filter and whitelist and/or blacklist additional system calls in the list on top of the default seccomp filter. ``` Regardless of how the information is specified in the profile, it would be very helpful to somehow just say "use the default filter +/- these other system calls". This should cut down the work required for people following the [Firejail Seccomp Guide](https://l3net.wordpress.com/2015/04/13/firejail-seccomp-guide/).

gitea-mirror

2026-05-05 04:42:03 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 04:42:11 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 11, 2015):

What I actually want is the default seccomp filter, with some additional system calls on top of the default seccomp filter.

This is exactly what "seccomp syscall,syscall,syscall". It takes the default filter and adds "syscall,syscall,syscall".

"use the default filter +/- these other system calls"

I'll leave this open as an enhancement for now.

@netblue30 commented on GitHub (Aug 11, 2015): > What I actually want is the default seccomp filter, with some additional system calls on top of the default seccomp filter. This is exactly what "seccomp syscall,syscall,syscall". It takes the default filter and adds "syscall,syscall,syscall". > "use the default filter +/- these other system calls" I'll leave this open as an enhancement for now.

gitea-mirror commented

2026-05-05 04:42:18 -06:00

Author

Owner

@boltronics commented on GitHub (Aug 11, 2015):

This is exactly what "seccomp syscall,syscall,syscall". It takes the default filter and adds
"syscall,syscall,syscall".

Sorry - I wasn't very clear. By "with some additional system calls on top of the default seccomp filter", I meant I wanted to allow additional system calls - so effectively it would unblock something the default filter has blocked. I think that's likely to be a more common scenario, as most people would go with the defaults, and then adjust them if they don't work. If they don't work, permissions will need to be relaxed, not tightened.

@boltronics commented on GitHub (Aug 11, 2015): > This is exactly what "seccomp syscall,syscall,syscall". It takes the default filter and adds > "syscall,syscall,syscall". Sorry - I wasn't very clear. By "with some additional system calls on top of the default seccomp filter", I meant I wanted to allow additional system calls - so effectively it would unblock something the default filter has blocked. I think that's likely to be a more common scenario, as most people would go with the defaults, and then adjust them if they don't work. If they don't work, permissions will need to be relaxed, not tightened.

gitea-mirror commented

2026-05-05 04:42:22 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 11, 2015):

I'll have to think about it, thanks.

@netblue30 commented on GitHub (Aug 11, 2015): I'll have to think about it, thanks.

gitea-mirror commented

2026-05-05 04:42:24 -06:00

Author

Owner

@netblue30 commented on GitHub (Sep 26, 2015):

I am dropping it. It complicates the code to much.

@netblue30 commented on GitHub (Sep 26, 2015): I am dropping it. It complicates the code to much.

Rows
Columns

[GH-ISSUE #1] Modify seccomp arguments in profile config for more flexibility #1