github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3237] kernel.yama.ptrace_scope = 2|3 breaks --build if strace is installed #2032

New issue

Closed

opened 2026-05-05 08:42:18 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 08:42:18 -06:00

Owner

Originally created by @rusty-snake on GitHub (Feb 22, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3237

STR

sudo sysctl kernel.yama.ptrace_scope=2 or 3.
make sure strace is installed
firejail --build true

actual behavior

/usr/bin/strace: test_ptrace_get_syscall_info: PTRACE_TRACEME: Operation not permitted
/usr/bin/strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted
Error: cannot run the sandbox

expected behavior

Firejail checks kernel.yama.ptrace_scope and skip strace if it is 2 or 3.

Originally created by @rusty-snake on GitHub (Feb 22, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3237 ### STR 1. `sudo sysctl kernel.yama.ptrace_scope=2` or 3. 2. make sure `strace` is installed 3. firejail --build true ### actual behavior ``` /usr/bin/strace: test_ptrace_get_syscall_info: PTRACE_TRACEME: Operation not permitted /usr/bin/strace: ptrace(PTRACE_TRACEME, ...): Operation not permitted Error: cannot run the sandbox ``` ### expected behavior Firejail checks `kernel.yama.ptrace_scope` and skip strace if it is 2 or 3.

gitea-mirror

2026-05-05 08:42:18 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 08:42:21 -06:00

Author

Owner

@reinerh commented on GitHub (Feb 23, 2020):

Or instead of checking kernel.yama.ptrace_scope, it could check the ptrace result for EPERM.

Edit: oh, just noticed it's calling strace, not calling ptrace directly...

@reinerh commented on GitHub (Feb 23, 2020): Or instead of checking kernel.yama.ptrace_scope, it could check the ptrace result for EPERM. Edit: oh, just noticed it's calling strace, not calling ptrace directly...

gitea-mirror commented

2026-05-05 08:42:22 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 23, 2020):

Edit: oh, just noticed it's calling strace, not calling ptrace directly...

If /usr/bin/strace is installed on the system, it also builds a whitelisted seccomp profile.

@rusty-snake commented on GitHub (Feb 23, 2020): > Edit: oh, just noticed it's calling strace, not calling ptrace directly... > If /usr/bin/strace is installed on the system, it also builds a whitelisted seccomp profile.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2032

No description provided.

Rows
Columns