github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #3972] Add sara LSM library for W^X protection #2484

New issue

Closed

opened 2026-05-05 09:10:03 -06:00 by gitea-mirror · 5 comments

gitea-mirror commented

2026-05-05 09:10:03 -06:00

Owner

Originally created by @osevan on GitHub (Feb 11, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3972

https://sara.smeso.it/en/latest/

Sara library exists too

https://github.com/smeso/libsara

Maybe useful for firejail sandbox

Thanks and

Best regards

Originally created by @osevan on GitHub (Feb 11, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/3972 https://sara.smeso.it/en/latest/ Sara library exists too https://github.com/smeso/libsara Maybe useful for firejail sandbox Thanks and Best regards

gitea-mirror

2026-05-05 09:10:03 -06:00

closed this issue
added the
enhancement

wontfix
labels

gitea-mirror commented

2026-05-05 09:10:06 -06:00

Author

Owner

@topimiettinen commented on GitHub (Feb 11, 2021):

Sara (or something like it) would be nice, though kernel support is not merged yet. Currently Firejail has a poor man's version of it with memory-deny-write-execute (mdwx). This is implemented with seccomp, so it's only capable of blocking mprotect() and mmap() system calls with PROT_EXEC|PROT_WRITE flag combination as well as memfd() system call. Because Sara would be part of the kernel, it can do further checks including the history of the pages. Firejail profiles can also complement Sara (and mdwx) with noexec and read-only options, by making sure that also file systems are mounted with W^X logic: no file system is executable which is also writable. Sara also tries to be compatible with trampolines without giving up entire protection: with seccomp it's not possible to identify the use case. Some class of programs won't be able to use Sara or mdwx, for example Java and probably they are the same programs which can't use memory-deny-write-execute.

When/if Sara gets merged, Firejail could simply enable it with memory-deny-write-execute automatically or with a new option(s) if finer control is needed.

@topimiettinen commented on GitHub (Feb 11, 2021): Sara (or something like it) would be nice, though kernel support is not merged yet. Currently Firejail has a poor man's version of it with `memory-deny-write-execute` (mdwx). This is implemented with seccomp, so it's only capable of blocking `mprotect()` and `mmap()` system calls with `PROT_EXEC|PROT_WRITE` flag combination as well as `memfd()` system call. Because Sara would be part of the kernel, it can do further checks including the history of the pages. Firejail profiles can also complement Sara (and mdwx) with `noexec` and `read-only` options, by making sure that also file systems are mounted with W^X logic: no file system is executable which is also writable. Sara also tries to be compatible with trampolines without giving up entire protection: with seccomp it's not possible to identify the use case. Some class of programs won't be able to use Sara or mdwx, for example Java and probably they are the same programs which can't use `memory-deny-write-execute`. When/if Sara gets merged, Firejail could simply enable it with `memory-deny-write-execute` automatically or with a new option(s) if finer control is needed.

gitea-mirror commented

2026-05-05 09:10:07 -06:00

Author

Owner

@osevan commented on GitHub (Feb 11, 2021):

Sara is already used by many guys...

We need a solutions easy one at compile time.--with-sara option and in profiles for specific apps .

Thanks and
Best regards

@osevan commented on GitHub (Feb 11, 2021): Sara is already used by many guys... We need a solutions easy one at compile time.--with-sara option and in profiles for specific apps . Thanks and Best regards

gitea-mirror commented

2026-05-05 09:10:08 -06:00

Author

Owner

@Vincent43 commented on GitHub (Feb 12, 2021):

Sara is already used by many guys...

Does sara patches even compile against latest kernels? I didn't saw updated version for many months.

@Vincent43 commented on GitHub (Feb 12, 2021): > Sara is already used by many guys... Does sara patches even compile against latest kernels? I didn't saw updated version for many months.

gitea-mirror commented

2026-05-05 09:10:09 -06:00

Author

Owner

@osevan commented on GitHub (Feb 12, 2021):

Author need update patch.

:-(

@osevan commented on GitHub (Feb 12, 2021): Author need update patch. :-(

gitea-mirror commented

2026-05-05 09:10:10 -06:00

Author

Owner

@rusty-snake commented on GitHub (Feb 26, 2023):

S.A.R.A. had no releases/development activity for around 5 years. Closing for now.

@rusty-snake commented on GitHub (Feb 26, 2023): S.A.R.A. had no releases/development activity for around 5 years. Closing for now.

gitea-mirror referenced this issue

2026-05-05 10:18:24 -06:00

[PR #2484] [MERGED] Add new profile for netactview #4347

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2484

No description provided.

Rows
Columns