github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2195] Chromium sys_chroot and sys_admin permissions #1470

New issue

Closed

opened 2026-05-05 08:08:07 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:08:07 -06:00

Owner

Originally created by @Zypherspace on GitHub (Oct 14, 2018).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2195

Chrome and Chromium firejail profiles enable sys_chroot and sys_admin kernel privileges. Is it possible to disable these by disabling Chrome's internal sandbox, or any other method?

Originally created by @Zypherspace on GitHub (Oct 14, 2018). Original GitHub issue: https://github.com/netblue30/firejail/issues/2195 Chrome and Chromium firejail profiles enable sys_chroot and sys_admin kernel privileges. Is it possible to disable these by disabling Chrome's internal sandbox, or any other method?

gitea-mirror

2026-05-05 08:08:07 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 08:08:11 -06:00

Author

Owner

@Vincent43 commented on GitHub (Oct 14, 2018):

Chrome sandbox is considered one of the best in industry. Disabling it will negatively impact security. Those privileges are available only for parent process, not for those exposed to web browsing.

@Vincent43 commented on GitHub (Oct 14, 2018): Chrome sandbox is considered one of the best in industry. Disabling it will negatively impact security. Those privileges are available only for parent process, not for those exposed to web browsing.

gitea-mirror commented

2026-05-05 08:08:12 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Oct 15, 2018):

@Zypherspace : Distros with newer kernels don't require that anymore.

My profile (on Fedora 28) contains:

seccomp.keep access,arch_prctl,bind,brk,capget,capset,chdir,chmod,chroot,clock_getres,clone,close,connect,creat,dup,dup2,epoll_create,epoll_ctl,epoll_wait,epoll_pwait,eventfd2,execve,faccessat,fadvise64,fchmod,fcntl,fdatasync,fstat,fstatfs,ftruncate,futex,getdents,getdents64,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getpriority,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,kill,listen,lseek,lstat,madvise,memfd_create,mkdir,mmap,mprotect,munmap,nanosleep,newfstatat,open,openat,personality,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rmdir,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_getscheduler,sched_setscheduler,sched_yield,seccomp,select,sendmsg,sendto,setpriority,setrlimit,set_robust_list,setsockopt,set_tid_address,shutdown,socket,socketpair,stat,statfs,symlink,sysinfo,umask,uname,unlink,unshare,wait4,waitid,write,writev,setresuid,setresgid,exit_group,tgkill,exit,utimensat,personality,setxattr,mremap,clock_gettime,fchown,getcwd,prlimit64,fallocate,msync

caps.drop all

noroot
nogroups
nonewprivs

ipc-namespace
machine-id

You can try if this works for you. It's possible that the list of necessary syscalls for your distro differs a bit. This guide helps to find out.

@curiosity-seeker commented on GitHub (Oct 15, 2018): @Zypherspace : Distros with newer kernels don't require that anymore. My profile (on Fedora 28) contains: ``` seccomp.keep access,arch_prctl,bind,brk,capget,capset,chdir,chmod,chroot,clock_getres,clone,close,connect,creat,dup,dup2,epoll_create,epoll_ctl,epoll_wait,epoll_pwait,eventfd2,execve,faccessat,fadvise64,fchmod,fcntl,fdatasync,fstat,fstatfs,ftruncate,futex,getdents,getdents64,getegid,geteuid,getgid,getpeername,getpgrp,getpid,getppid,getpriority,getrandom,getresgid,getresuid,getrlimit,getsockname,getsockopt,gettid,getuid,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,ioctl,kill,listen,lseek,lstat,madvise,memfd_create,mkdir,mmap,mprotect,munmap,nanosleep,newfstatat,open,openat,personality,pipe,pipe2,poll,ppoll,prctl,pread64,pwrite64,read,readlink,readlinkat,recvfrom,recvmsg,rename,rmdir,rt_sigaction,rt_sigprocmask,rt_sigreturn,sched_getaffinity,sched_getparam,sched_getscheduler,sched_setscheduler,sched_yield,seccomp,select,sendmsg,sendto,setpriority,setrlimit,set_robust_list,setsockopt,set_tid_address,shutdown,socket,socketpair,stat,statfs,symlink,sysinfo,umask,uname,unlink,unshare,wait4,waitid,write,writev,setresuid,setresgid,exit_group,tgkill,exit,utimensat,personality,setxattr,mremap,clock_gettime,fchown,getcwd,prlimit64,fallocate,msync caps.drop all noroot nogroups nonewprivs ipc-namespace machine-id ``` You can try if this works for you. It's possible that the list of necessary syscalls for your distro differs a bit. [This](https://firejail.wordpress.com/documentation-2/seccomp-guide/) guide helps to find out.

gitea-mirror commented

2026-05-05 08:08:12 -06:00

Author

Owner

@Vincent43 commented on GitHub (Oct 15, 2018):

I think it rather depends on unprivileged user namespaces being available. In that case /usr/lib/chromium/chrome-sandbox ( or whatever it's named) can be build non-setuid. Otherwise those caps are necessary. As some distros like Debian or Arch disable unprivileged user namespaces in default configuration we cannot change it in firejail profile.

@Vincent43 commented on GitHub (Oct 15, 2018): I think it rather depends on unprivileged user namespaces being available. In that case `/usr/lib/chromium/chrome-sandbox` ( or whatever it's named) can be build non-setuid. Otherwise those caps are necessary. As some distros like Debian or Arch disable unprivileged user namespaces in default configuration we cannot change it in firejail profile.

gitea-mirror commented

2026-05-05 08:08:13 -06:00

Author

Owner

@Zypherspace commented on GitHub (Oct 15, 2018):

Great, In Fedora 28 Chromium is working with --caps.drop=all.

I still see Warning: an existing sandbox was detected. /usr/bin/chromium-browser will run without any additional sandboxing features, but that reports even with the default Chromium.profile

about:sandbox in Chromium reports normal sandboxing.


SUID Sandbox | No
Namespace Sandbox | Yes
PID namespaces | Yes
Network namespaces | Yes
Seccomp-BPF sandbox | Yes
Seccomp-BPF sandbox supports TSYNC | Yes
Yama LSM Enforcing | No

@Zypherspace commented on GitHub (Oct 15, 2018): Great, In Fedora 28 Chromium is working with --caps.drop=all. I still see `Warning: an existing sandbox was detected. /usr/bin/chromium-browser will run without any additional sandboxing features`, but that reports even with the default Chromium.profile `about:sandbox` in Chromium reports normal sandboxing. ``` SUID Sandbox | No Namespace Sandbox | Yes PID namespaces | Yes Network namespaces | Yes Seccomp-BPF sandbox | Yes Seccomp-BPF sandbox supports TSYNC | Yes Yama LSM Enforcing | No ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1470

No description provided.

Rows
Columns