github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3313] join broken with seccomp since `88eadbf` #2080

New issue

Closed

opened 2026-05-05 08:44:58 -06:00 by gitea-mirror · 8 comments

gitea-mirror commented

2026-05-05 08:44:58 -06:00

Owner

Originally created by @rusty-snake on GitHub (Apr 2, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3313

@topimiettinen

STR:

term1$ firejail --noprofile --seccomp --name=test bash
% ls /run/firejail/mnt/seccomp/
seccomp.list  seccomp.postexec  seccomp.postexec32

term2$ firejail --join=test ls /run/firejail/mnt/seccomp
Error: cannot read /run/firejail/mnt/seccomp/seccomp.32

Originally created by @rusty-snake on GitHub (Apr 2, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3313 @topimiettinen STR: ``` term1$ firejail --noprofile --seccomp --name=test bash % ls /run/firejail/mnt/seccomp/ seccomp.list seccomp.postexec seccomp.postexec32 term2$ firejail --join=test ls /run/firejail/mnt/seccomp Error: cannot read /run/firejail/mnt/seccomp/seccomp.32 ```

gitea-mirror closed this issue

2026-05-05 08:44:58 -06:00

gitea-mirror commented

2026-05-05 08:45:00 -06:00

Author

Owner

@topimiettinen commented on GitHub (Apr 2, 2020):

Unfortunately --join has not worked for me for some time (several months) and I don't know why. Here's a strace:

nanosleep({tv_sec=0, tv_nsec=100000000}, NULL) = 0
getuid()                                = 1000
geteuid()                               = 1000
setresuid(-1, 0, -1)                    = 0
setresgid(-1, 0, -1)                    = 0
openat(AT_FDCWD, "/proc/12654/root/run/firejail/mnt/ready-for-join", O_RDONLY|O_
CLOEXEC) = -1 EACCES (Permission denied)
setresuid(-1, 1000, -1)                 = 0
setresgid(-1, 1000, -1)                 = 0
write(2, "Error: no valid sandbox\n", 24) = 24

The mode of the "ready-for-join" file is 0644. This happens with SELinux enforcing turned off, sysctl kernel.yama.ptrace_scope = 0 and /proc is not mounted with hidepid=[1|2]. TOMOYO Linux is also enabled but it shouldn't do anything here. AppArmor is not enabled. Very annoying.

@topimiettinen commented on GitHub (Apr 2, 2020): Unfortunately --join has not worked for me for some time (several months) and I don't know why. Here's a strace: ``` nanosleep({tv_sec=0, tv_nsec=100000000}, NULL) = 0 getuid() = 1000 geteuid() = 1000 setresuid(-1, 0, -1) = 0 setresgid(-1, 0, -1) = 0 openat(AT_FDCWD, "/proc/12654/root/run/firejail/mnt/ready-for-join", O_RDONLY|O_ CLOEXEC) = -1 EACCES (Permission denied) setresuid(-1, 1000, -1) = 0 setresgid(-1, 1000, -1) = 0 write(2, "Error: no valid sandbox\n", 24) = 24 ``` The mode of the "ready-for-join" file is 0644. This happens with SELinux enforcing turned off, `sysctl kernel.yama.ptrace_scope = 0` and /proc is not mounted with hidepid=[1|2]. TOMOYO Linux is also enabled but it shouldn't do anything here. AppArmor is not enabled. Very annoying.

gitea-mirror commented

2026-05-05 08:45:01 -06:00

Author

Owner

@ghost commented on GitHub (Apr 2, 2020):

Confirming @rusty-snake's observations. Adding seccomp.block-secondary only changes the ls ourput and the error:

$ firejail --noprofile --seccomp.block-secondary --seccomp --name=test bash
% ls /run/firejail/mnt/seccomp/
seccomp.block_secondary  seccomp.list  seccomp.postexec  seccomp.postexec32

firejail --join=test ls /run/firejail/mnt/seccomp
Error: cannot read /run/firejail/mnt/seccomp/seccomp

Reverting 88eadbf31f brings back join functionality here.

@ghost commented on GitHub (Apr 2, 2020): Confirming @rusty-snake's observations. Adding `seccomp.block-secondary` only changes the ls ourput and the error: ``` $ firejail --noprofile --seccomp.block-secondary --seccomp --name=test bash % ls /run/firejail/mnt/seccomp/ seccomp.block_secondary seccomp.list seccomp.postexec seccomp.postexec32 firejail --join=test ls /run/firejail/mnt/seccomp Error: cannot read /run/firejail/mnt/seccomp/seccomp ``` Reverting https://github.com/netblue30/firejail/commit/88eadbf31fe25dcd7c224a5d92f71c79ccf6c9d3 brings back `join` functionality here.

gitea-mirror commented

2026-05-05 08:45:02 -06:00

Author

Owner

@ghost commented on GitHub (Apr 2, 2020):

@topimiettinen Is join broken for you with both name and pid? For the record, I always use the name option.

@ghost commented on GitHub (Apr 2, 2020): @topimiettinen Is join broken for you with both `name` and `pid`? For the record, I always use the `name` option.

gitea-mirror commented

2026-05-05 08:45:03 -06:00

Author

Owner

@topimiettinen commented on GitHub (Apr 2, 2020):

Neither work here. --join=name seems to find the right pid.

@topimiettinen commented on GitHub (Apr 2, 2020): Neither work here. --join=name seems to find the right pid.

gitea-mirror commented

2026-05-05 08:45:04 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 3, 2020):

I have a fix in. We were deleting unused seccomp files from /run/firejail/mnt/seccomp directory during init, and we had a problem with "unused". So I let them all in. Give it a try.

9ba916d20d

@netblue30 commented on GitHub (Apr 3, 2020): I have a fix in. We were deleting unused seccomp files from /run/firejail/mnt/seccomp directory during init, and we had a problem with "unused". So I let them all in. Give it a try. https://github.com/netblue30/firejail/commit/9ba916d20d723f2515c2e084db3437a529b81c34

gitea-mirror commented

2026-05-05 08:45:06 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 3, 2020):

BTW: https://travis-ci.org/github/netblue30/firejail/builds/668027727#L790

travis-ci is also broken since 88eadbf.

@rusty-snake commented on GitHub (Apr 3, 2020): BTW: https://travis-ci.org/github/netblue30/firejail/builds/668027727#L790 travis-ci is also broken since 88eadbf.

gitea-mirror commented

2026-05-05 08:45:07 -06:00

Author

Owner

@ghost commented on GitHub (Apr 3, 2020):

Confirming 9ba916d20d does fix the join option 👍.

@ghost commented on GitHub (Apr 3, 2020): Confirming https://github.com/netblue30/firejail/commit/9ba916d20d723f2515c2e084db3437a529b81c34 does fix the join option :+1:.

gitea-mirror commented

2026-05-05 08:45:07 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 5, 2020):

Travis fixed, compile problems on old distros.

@netblue30 commented on GitHub (Apr 5, 2020): Travis fixed, compile problems on old distros.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2080

No description provided.

Rows
Columns

[GH-ISSUE #3313] join broken with seccomp since 88eadbf #2080

[GH-ISSUE #3313] join broken with seccomp since `88eadbf` #2080