mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #2931] --seccomp= unknown syscall names/numbers are silently ignored #1829
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#1829
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @aoand on GitHub (Aug 26, 2019).
Original GitHub issue: https://github.com/netblue30/firejail/issues/2931
If a bogus (unknown) syscall name/number/group-name is supplied to --seccomp=, then it is silently ignored. No warning is printed even with --debug.
This is bad, because a misspelled syscall will not be disabled in the jail, potentially creating a vulnerability. It would be better, if firejail would reject a wrong name/number and refuse to start.
On a related note: why '$' is needed to denote a numeric syscall? If syscall "name" is all numeric, then it is definitely the syscall number, so '$' seems to be redundant.
firejail version: 0.9.56.2-LTS
OS: Ubuntu 16.04.6 LTS
@netblue30 commented on GitHub (Aug 28, 2019):
The fix is on mainline. I'll leave the bug open until we merge it on LTS branch. Thanks.