[GH-ISSUE #4020] Revisit profiles allowing netlink protocol #2508

New issue

Closed

opened 2026-05-05 09:11:28 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:11:28 -06:00

Owner

Originally created by @ghost on GitHub (Mar 1, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4020

As recently pointed out by @kris7t here the netlink protocol potentially exposes a huge kernel API sandbox escape surface. In that regard it might be wise to revisit our profiles containing that option.

I've been running several profiles without the netlink protocol via local overrides without issues for quite some time (e.g. aria2c, chromium-common-hardened, firefox-common, mocp, mpg123, mplayer, mpv, nodejs-common, qnapi, sqlitebrowser, sysprof) but that's always dependant on personal workflow and specific use-case. To be clear, I'm not aware of any real-world issues but wanted to file this more as a reminder here. A thorough check of all relevant profiles will certainly take considerable time. Still, IMO it's worth looking at it again.

Originally created by @ghost on GitHub (Mar 1, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4020 As recently pointed out by @kris7t [here](https://github.com/netblue30/firejail/issues/4013#issuecomment-786780504) the `netlink` protocol `potentially` exposes a huge kernel API sandbox escape surface. In that regard it might be wise to revisit our profiles containing that option. I've been running several profiles without the netlink protocol via local overrides without issues for quite some time (e.g. aria2c, chromium-common-hardened, firefox-common, mocp, mpg123, mplayer, mpv, nodejs-common, qnapi, sqlitebrowser, sysprof) but that's always dependant on personal workflow and specific use-case. To be clear, I'm not aware of any real-world issues but wanted to file this more as a reminder here. A thorough check of all relevant profiles will certainly take considerable time. Still, IMO it's worth looking at it again.

gitea-mirror

2026-05-05 09:11:28 -06:00

closed this issue
added the
networking
label

gitea-mirror commented

2026-05-05 09:11:31 -06:00

Author

Owner

@rusty-snake commented on GitHub (Mar 5, 2021):

Removing netlink from chromium-common-hardened beaks WebRTC, likely the same for firefox-common. mpv has a lot of features, so it's likely needed (maybe for hw related streams), sysprof likely needs it for some features I guess. sqlitebrowser I can not thing any case where it is needed.

Quoting myself for the record (https://github.com/netblue30/firejail/issues/4013#issuecomment-786762799):

It's always better to not add / remove netlink as long as nothing is broken. But how do you know that nothing is? If the program complains about it, it misses something it wants and if the profile contains it, it's often for a reason.

@rusty-snake commented on GitHub (Mar 5, 2021): Removing `netlink` from chromium-common-hardened beaks WebRTC, likely the same for firefox-common. mpv has a lot of features, so it's likely needed (maybe for hw related streams), sysprof likely needs it for some features I guess. sqlitebrowser I can not thing any case where it is needed. Quoting myself for the record (https://github.com/netblue30/firejail/issues/4013#issuecomment-786762799): > It's always better to not add _/ remove `netlink`_ as long as nothing is broken. But how do you know that nothing is? If the program complains about it, it misses something it wants _and if the profile contains it, it's often for a reason._

gitea-mirror commented

2026-05-05 09:11:32 -06:00

Author

Owner

@rusty-snake commented on GitHub (Jun 10, 2021):

Should we close?

@rusty-snake commented on GitHub (Jun 10, 2021): Should we close?

gitea-mirror referenced this issue

2026-05-05 10:18:42 -06:00

[PR #2508] [MERGED] Fix regextester #4365

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2508

No description provided.

Rows
Columns