github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #4185] Enhancement. we need secure memory zone for started apps #2571

New issue

Closed

opened 2026-05-05 09:14:36 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 09:14:36 -06:00

Owner

Originally created by @osevan on GitHub (Apr 13, 2021).
Original GitHub issue: https://github.com/netblue30/firejail/issues/4185

https://www.phoronix.com/scan.php?page=news_item&px=memfd_secret-Secret-Linux-RAM

New syscall is available for new kernel.

Originally created by @osevan on GitHub (Apr 13, 2021). Original GitHub issue: https://github.com/netblue30/firejail/issues/4185 https://www.phoronix.com/scan.php?page=news_item&px=memfd_secret-Secret-Linux-RAM New syscall is available for new kernel.

gitea-mirror closed this issue

2026-05-05 09:14:37 -06:00

gitea-mirror commented

2026-05-05 09:14:39 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 13, 2021):

For what is it good? Can you explain more details what you think. How should it look like ( --secmem=5,512 fd=5, 512mb) and how it should work? Why does the sandboxed program create these zone not by itself? How does it help to sandbox the program?

this ability to create secret memory areas on the system is disabled by default unless a special option is passed at boot time.

Given that, it's possible we might see this new secret memory area system call introduced as part of the upcoming Linux 5.13 cycle

Will still take some time until users get this.

@rusty-snake commented on GitHub (Apr 13, 2021): For what is it good? Can you explain more details what you think. How should it look like ( `--secmem=5,512` fd=5, 512mb) and how it should work? Why does the sandboxed program create these zone not by itself? How does it help to sandbox the program? > this ability to create secret memory areas on the system is disabled by default unless a special option is passed at boot time. > Given that, it's possible we might see this new secret memory area system call introduced as part of the upcoming Linux 5.13 cycle Will still take some time until users get this.

gitea-mirror commented

2026-05-05 09:14:40 -06:00

Author

Owner

@osevan commented on GitHub (Apr 13, 2021):

I thought, when secret memory reserved somewhere by firejail sandbox,other sandbox process cannot access in nemory each other.

....

@osevan commented on GitHub (Apr 13, 2021): I thought, when secret memory reserved somewhere by firejail sandbox,other sandbox process cannot access in nemory each other. ....

gitea-mirror commented

2026-05-05 09:14:41 -06:00

Author

Owner

@rusty-snake commented on GitHub (Apr 14, 2021):

And then we LD_PRELOAD a malloc that uses this secure memory?

The sandbox protects the system from bad actions inside the sandbox. There is no protection for the sandbox.

@rusty-snake commented on GitHub (Apr 14, 2021): And then we LD_PRELOAD a `malloc` that uses this secure memory? The sandbox protects the system from bad actions inside the sandbox. There is no protection for the sandbox.

gitea-mirror commented

2026-05-05 09:14:42 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 4, 2021):

As long as nobody can say how we can use this, I close here.

@rusty-snake commented on GitHub (Aug 4, 2021): As long as nobody can say how we can use this, I close here.

gitea-mirror referenced this issue

2026-05-05 10:19:44 -06:00

[PR #2571] [MERGED] Fixes and comment for eog/eom #4418

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2571

No description provided.

Rows
Columns