github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1948] 0.9.54 compilation fails on RasPi 2 #1303

New issue

Closed

opened 2026-05-05 07:50:00 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 07:50:00 -06:00

Owner

Originally created by @drgibbon on GitHub (May 19, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1948

I'm trying to compile Firejail 0.09.54 on a RasPi 2 (kernel 4.14.37), and I'm running into this error during make:

In file included from ../include/seccomp.h:63:0,
                 from seccomp.c:21:
seccomp.c: In function ‘memory_deny_write_execute’:
seccomp.c:245:35: error: ‘__NR_pkey_mprotect’ undeclared (first use in this function)
   BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_pkey_mprotect, 0, 5),
                                   ^
seccomp.c:245:35: note: each undeclared identifier is reported only once for each function it appears in
Makefile:6: recipe for target 'seccomp.o' failed

I noticed this in the configure output:

checking for Spectre mitigation support in gcc or clang compiler... gcc: error: unrecognized command line option '-mindirect-branch=thunk'
... not available

the gcc version is 5.5.0.

Originally created by @drgibbon on GitHub (May 19, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/1948 I'm trying to compile Firejail 0.09.54 on a RasPi 2 (kernel 4.14.37), and I'm running into this error during `make`: ``` In file included from ../include/seccomp.h:63:0, from seccomp.c:21: seccomp.c: In function ‘memory_deny_write_execute’: seccomp.c:245:35: error: ‘__NR_pkey_mprotect’ undeclared (first use in this function) BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_pkey_mprotect, 0, 5), ^ seccomp.c:245:35: note: each undeclared identifier is reported only once for each function it appears in Makefile:6: recipe for target 'seccomp.o' failed ``` I noticed this in the `configure` output: ``` checking for Spectre mitigation support in gcc or clang compiler... gcc: error: unrecognized command line option '-mindirect-branch=thunk' ... not available ``` the gcc version is 5.5.0.

gitea-mirror

2026-05-05 07:50:00 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:50:03 -06:00

Author

Owner

@netblue30 commented on GitHub (May 19, 2018):

Possible fix in mainline git, you can give it a try. It could be a problem with the way glibc is installed on your system. Run the following command and put the output here:

$ grep pkey_mprotect `find /usr/include/ -name "*.h"`

Thanks for the bug!

@netblue30 commented on GitHub (May 19, 2018): Possible fix in mainline git, you can give it a try. It could be a problem with the way glibc is installed on your system. Run the following command and put the output here: ````` $ grep pkey_mprotect `find /usr/include/ -name "*.h"` ````` Thanks for the bug!

gitea-mirror commented

2026-05-05 07:50:05 -06:00

Author

Owner

@reinerh commented on GitHub (May 19, 2018):

@drgibbon Do you have linux-libc-dev installed?

@netblue30

/usr/include/asm-generic/unistd.h:#define __NR_pkey_mprotect 288
/usr/include/asm-generic/unistd.h:__SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect)
/usr/include/arm-linux-gnueabihf/asm/unistd.h:#define __NR_pkey_mprotect		(__NR_SYSCALL_BASE+394)

I don't think that workaround is required. It looks like a missing library.

@reinerh commented on GitHub (May 19, 2018): @drgibbon Do you have linux-libc-dev installed? @netblue30 ``` /usr/include/asm-generic/unistd.h:#define __NR_pkey_mprotect 288 /usr/include/asm-generic/unistd.h:__SYSCALL(__NR_pkey_mprotect, sys_pkey_mprotect) /usr/include/arm-linux-gnueabihf/asm/unistd.h:#define __NR_pkey_mprotect (__NR_SYSCALL_BASE+394) ``` I don't think that workaround is required. It looks like a missing library.

gitea-mirror commented

2026-05-05 07:50:07 -06:00

Author

Owner

@drgibbon commented on GitHub (May 20, 2018):

@netblue30 Build now works with latest master :) As for the grep:

$ grep pkey_mprotect `find /usr/include/ -name "*.h"`
/usr/include/bits/syscall.h:#define SYS_pkey_mprotect __NR_pkey_mprotect
/usr/include/bits/syscall.h:#define SYS_pkey_mprotect __NR_pkey_mprotect

@reinerh I'm not sure what linux-libc-dev is, I'm running Slackware ARM (SARPi community).

@drgibbon commented on GitHub (May 20, 2018): @netblue30 Build now works with latest master :) As for the grep: ``` $ grep pkey_mprotect `find /usr/include/ -name "*.h"` /usr/include/bits/syscall.h:#define SYS_pkey_mprotect __NR_pkey_mprotect /usr/include/bits/syscall.h:#define SYS_pkey_mprotect __NR_pkey_mprotect ``` @reinerh I'm not sure what `linux-libc-dev` is, I'm running Slackware ARM (SARPi community).

gitea-mirror commented

2026-05-05 07:50:10 -06:00

Author

Owner

@reinerh commented on GitHub (May 20, 2018):

@drgibbon Sorry, I assumed you were using Raspbian.
linux-libc-dev is a Debian package that ships Linux kernel headers. As you can see in my grep results, they contain the defines for the syscall numbers.
I would expect that a similar package is available in Slackware.

Edit: the /usr/include/asm-generic/unistd.h header is in the kernel-headers package in Slackware.
I recommend that you install it and rebuild, because otherwise firejail does not know about the pkey_mprotect syscall.

@netblue30 Can we remove the workaround again? It only silently drops support for the syscall, even though it's just because of a missing header. Maybe we can check during configure for the the header.

@reinerh commented on GitHub (May 20, 2018): @drgibbon Sorry, I assumed you were using Raspbian. linux-libc-dev is a Debian package that ships Linux kernel headers. As you can see in my grep results, they contain the defines for the syscall numbers. I would expect that a similar package is available in Slackware. Edit: the /usr/include/asm-generic/unistd.h header is in the kernel-headers package in Slackware. I recommend that you install it and rebuild, because otherwise firejail does not know about the pkey_mprotect syscall. @netblue30 Can we remove the workaround again? It only silently drops support for the syscall, even though it's just because of a missing header. Maybe we can check during configure for the the header.

gitea-mirror commented

2026-05-05 07:50:11 -06:00

Author

Owner

@drgibbon commented on GitHub (May 20, 2018):

@reinerh Ah, actually my kernel headers package is out of date compared with the kernel I'm running. This is probably the culprit then?

@drgibbon commented on GitHub (May 20, 2018): @reinerh Ah, actually my kernel headers package is out of date compared with the kernel I'm running. This is probably the culprit then?

gitea-mirror commented

2026-05-05 07:50:13 -06:00

Author

Owner

@reinerh commented on GitHub (May 20, 2018):

Yes, that could also be the problem, that your header is so old that the syscall define is not included yet.

@reinerh commented on GitHub (May 20, 2018): Yes, that could also be the problem, that your header is so old that the syscall define is not included yet.

gitea-mirror commented

2026-05-05 07:50:14 -06:00

Author

Owner

@netblue30 commented on GitHub (May 20, 2018):

Reverted, thanks @reinerh

@netblue30 commented on GitHub (May 20, 2018): Reverted, thanks @reinerh

gitea-mirror commented

2026-05-05 07:50:15 -06:00

Author

Owner

@drgibbon commented on GitHub (May 20, 2018):

Confirming that updating the kernel headers gives a successful build on 0.9.54. Sorry for the noise!

@drgibbon commented on GitHub (May 20, 2018): Confirming that updating the kernel headers gives a successful build on 0.9.54. Sorry for the noise!

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1303

No description provided.

Rows
Columns