[GH-ISSUE #3476] With seccomp installed, child process exit successfully but parent process would not exit. #2187

New issue

Closed

opened 2026-05-05 08:51:59 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 08:51:59 -06:00

Owner

Originally created by @sfc-gh-hyu on GitHub (Jun 24, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3476

So I basically start the firejail as a separate user by using sudo. And firejail has seccomp installed.

[hyu@DEVVM-hyu ExecPlatform]$ ps aux | grep foo
root      6334  0.0  0.0 243412  4660 ?        SN   00:08   0:00 /usr/bin/sudo -u test -C 10 /usr/bin/firejail --private=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852 --profile=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852/foo.profile /home/test/foo ....
test      6335  0.0  0.0  10024  1052 ?        SN   00:08   0:00 /usr/bin/firejail --private=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852 --profile=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852/foo.profile /home/test/foo 
test      6337  0.0  0.0  10028   900 ?        SN   00:08   0:00 /usr/bin/firejail --private=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852 --profile=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852/foo.profile /home/test/foo 
test      6342  1.7  0.0      0     0 ?        ZNl  00:08   0:00 [foo] <defunct>
hyu       6392  0.0  0.0 112812   972 pts/4    SN+  00:08   0:00 grep --color=auto foo

Somehow the child process(6342) exit successfully but parent process is still there. I maybe miss whitelisting some systemcall but cannot figure out which one need to be whitelisted.

Here is my seccomp

caps.drop all
nonewprivs
seccomp.keep futex,read,epoll_wait,mmap,gettid,mprotect,open,madvise,close,rt_sigprocmask,write,munmap,clone,fstat,pread64,sched_getaffinity,stat,set_robust_list,brk,sysinfo,prctl,rt_sigaction,lseek,recvmsg,lstat,getdents,sendmsg,uname,eventfd2,openat,unlink,access,sched_yield,fcntl,getrlimit,ftruncate,mkdir,epoll_create1,socket,symlink,readlink,connect,epoll_ctl,setsockopt,fchdir,clock_getres,geteuid,shutdown,arch_prctl,rt_sigreturn,mincore,sigaltstack,setrlimit,set_tid_address,getcwd,getuid,nanosleep,execve,getrusage,alarm,pipe,tgkill,mincore,select,poll,fadvise64

Originally created by @sfc-gh-hyu on GitHub (Jun 24, 2020). Original GitHub issue: https://github.com/netblue30/firejail/issues/3476 So I basically start the firejail as a separate user by using sudo. And firejail has seccomp installed. ``` [hyu@DEVVM-hyu ExecPlatform]$ ps aux | grep foo root 6334 0.0 0.0 243412 4660 ? SN 00:08 0:00 /usr/bin/sudo -u test -C 10 /usr/bin/firejail --private=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852 --profile=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852/foo.profile /home/test/foo .... test 6335 0.0 0.0 10024 1052 ? SN 00:08 0:00 /usr/bin/firejail --private=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852 --profile=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852/foo.profile /home/test/foo test 6337 0.0 0.0 10028 900 ? SN 00:08 0:00 /usr/bin/firejail --private=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852 --profile=/tmp/firejail_mount/d06ddf0e-27c6-460b-8822-b477ab714852/foo.profile /home/test/foo test 6342 1.7 0.0 0 0 ? ZNl 00:08 0:00 [foo] <defunct> hyu 6392 0.0 0.0 112812 972 pts/4 SN+ 00:08 0:00 grep --color=auto foo ``` Somehow the child process(6342) exit successfully but parent process is still there. I maybe miss whitelisting some systemcall but cannot figure out which one need to be whitelisted. Here is my seccomp ``` caps.drop all nonewprivs seccomp.keep futex,read,epoll_wait,mmap,gettid,mprotect,open,madvise,close,rt_sigprocmask,write,munmap,clone,fstat,pread64,sched_getaffinity,stat,set_robust_list,brk,sysinfo,prctl,rt_sigaction,lseek,recvmsg,lstat,getdents,sendmsg,uname,eventfd2,openat,unlink,access,sched_yield,fcntl,getrlimit,ftruncate,mkdir,epoll_create1,socket,symlink,readlink,connect,epoll_ctl,setsockopt,fchdir,clock_getres,geteuid,shutdown,arch_prctl,rt_sigreturn,mincore,sigaltstack,setrlimit,set_tid_address,getcwd,getuid,nanosleep,execve,getrusage,alarm,pipe,tgkill,mincore,select,poll,fadvise64 ```

gitea-mirror closed this issue

2026-05-05 08:52:00 -06:00

gitea-mirror commented

2026-05-05 08:52:02 -06:00

Author

Owner

@sfc-gh-hyu commented on GitHub (Jun 24, 2020):

Seems that I missed exit,exit_group

@sfc-gh-hyu commented on GitHub (Jun 24, 2020): Seems that I missed `exit,exit_group`

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2187

No description provided.

Rows
Columns