github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #2514] [Info] seccomp enhancements in Linux 5.0 #1635

New issue

Closed

opened 2026-05-05 08:17:14 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 08:17:14 -06:00

Owner

Originally created by @curiosity-seeker on GitHub (Mar 4, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2514

Linux 5.0 got seccomp enhancements which might be useful for future Firejail versions:

https://git.kernel.org/torvalds/c/6a21cc50f0c7f87dae5259f6cfefe024412313f6
https://git.kernel.org/torvalds/c/fec7b6690541b8128663a13c9586b1daf42b0a6c

Background:
https://lwn.net/Articles/756233/
https://youtu.be/sqvF_Mdtzgg

But I'm sure you guys are already aware of those changes :-)

Originally created by @curiosity-seeker on GitHub (Mar 4, 2019). Original GitHub issue: https://github.com/netblue30/firejail/issues/2514 Linux 5.0 got seccomp enhancements which might be useful for future Firejail versions: https://git.kernel.org/torvalds/c/6a21cc50f0c7f87dae5259f6cfefe024412313f6 https://git.kernel.org/torvalds/c/fec7b6690541b8128663a13c9586b1daf42b0a6c Background: https://lwn.net/Articles/756233/ https://youtu.be/sqvF_Mdtzgg But I'm sure you guys are already aware of those changes :-)

gitea-mirror

2026-05-05 08:17:14 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 08:17:17 -06:00

Author

Owner

@topimiettinen commented on GitHub (Mar 4, 2019):

New sandboxing features could use this for example to check socket addresses for additional firewalling, to filter ioctls based on the file path of the file descriptor via /proc/PID/fd, or to implement a simple MAC for /proc or /sys by checking path to open() etc.

The enhancements could be used to make seccomp work also on i386, where some set of system calls are multiplexed into one and arguments are passed with a pointer to a structure. Now some of the filters just don't work on i386.

But a big showstopper for most of the above is lack of fd passing. Hopefully that will be added soon.

@topimiettinen commented on GitHub (Mar 4, 2019): New sandboxing features could use this for example to check socket addresses for additional firewalling, to filter ioctls based on the file path of the file descriptor via /proc/PID/fd, or to implement a simple MAC for /proc or /sys by checking path to open() etc. The enhancements could be used to make seccomp work also on i386, where some set of system calls are multiplexed into one and arguments are passed with a pointer to a structure. Now some of the filters just don't work on i386. But a big showstopper for most of the above is lack of fd passing. Hopefully that will be added soon.

gitea-mirror commented

2026-05-05 08:17:18 -06:00

Author

Owner

@chiraag-nataraj commented on GitHub (May 20, 2019):

Any progress on this stuff?

@chiraag-nataraj commented on GitHub (May 20, 2019): Any progress on this stuff?

gitea-mirror commented

2026-05-05 08:17:19 -06:00

Author

Owner

@topimiettinen commented on GitHub (May 20, 2019):

I don't know if kernel has fd passing yet.

i386 and most other archs got unmultiplexed versions of system calls in end 2018, so there's no need to demultiplex anymore with recent kernels.

@topimiettinen commented on GitHub (May 20, 2019): I don't know if kernel has fd passing yet. i386 and most other archs got unmultiplexed versions of system calls in end 2018, so there's no need to demultiplex anymore with recent kernels.

gitea-mirror commented

2026-05-05 08:17:20 -06:00

Author

Owner

@rusty-snake commented on GitHub (May 6, 2020):

Can we close here?

@rusty-snake commented on GitHub (May 6, 2020): Can we close here?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#1635

No description provided.

Rows
Columns