github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2496] memory-deny-write-execute: also block memfd_create? #1629

New issue

Closed

opened 2026-05-05 08:16:51 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 08:16:51 -06:00

Owner

Originally created by @topimiettinen on GitHub (Mar 1, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2496

memfd_create() followed by mmap(,,PROT_EXEC) (i.e. without PROT_WRITE) can be used to create executable memory with any contents and thus avoid memory-deny-write-execute protections. Would it be OK to just block memfd_create() when memory-deny-write-execute is enabled? It would mean some incompatibility and possibly some profiles could break.

If that is not OK, the manual page could just recommend adding memfd_create() to seccomp filters manually, or a new flag could be introduced like memory-deny-write-execute-v2.

Originally created by @topimiettinen on GitHub (Mar 1, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2496 `memfd_create()` followed by `mmap(,,PROT_EXEC)` (i.e. without `PROT_WRITE`) can be used to create executable memory with any contents and thus avoid `memory-deny-write-execute` protections. Would it be OK to just block `memfd_create()` when `memory-deny-write-execute` is enabled? It would mean some incompatibility and possibly some profiles could break. If that is not OK, the manual page could just recommend adding `memfd_create()` to seccomp filters manually, or a new flag could be introduced like `memory-deny-write-execute-v2`.

gitea-mirror closed this issue

2026-05-05 08:16:52 -06:00

gitea-mirror commented

2026-05-05 08:16:54 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Mar 2, 2019):

I think @netblue30 mentioned putting out an rc candidate in the next few weeks. Could we maybe add this idea and try it out? If it causes lots of issues we could fix quickly before releasing an rc2.

@Fred-Barclay commented on GitHub (Mar 2, 2019): I think @netblue30 mentioned putting out an rc candidate in the next few weeks. Could we maybe add this idea and try it out? If it causes lots of issues we could fix quickly before releasing an rc2.

gitea-mirror commented

2026-05-05 08:16:54 -06:00

Author

Owner

@topimiettinen commented on GitHub (Mar 2, 2019):

I opened PR #2504.

@topimiettinen commented on GitHub (Mar 2, 2019): I opened PR #2504.

gitea-mirror commented

2026-05-05 08:16:55 -06:00

Author

Owner

@topimiettinen commented on GitHub (Mar 5, 2019):

Closed by 59e3061, let's see if anything breaks.

@topimiettinen commented on GitHub (Mar 5, 2019): Closed by 59e3061, let's see if anything breaks.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1629

No description provided.

Rows
Columns