[GH-ISSUE #5116] Filter netlink families with seccomp #2885

New issue

Open

opened 2026-05-05 09:32:39 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 09:32:39 -06:00

Owner

Originally created by @rusty-snake on GitHub (Apr 23, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5116

AF_NETLINK exposes a (huge) attack surface for the kernel. See https://github.com/netblue30/firejail/issues/4013#issuecomment-786780504 and #4020 for previous discussions.

cc @kris7t @glitsj16

Describe the solution you'd like

The socket syscall looks like int socket(int domain, int type, int protocol);. We already filter the first argument (domain) with protocol unix,inet,inet6,netlink. To minimize the attack surface of AF_NETLINK we should filter the third/last argument (protocol) if the first is AF_NETLINK (netlink_socket = socket(AF_NETLINK, socket_type, netlink_family);).

protocol unix,inet,inet6,netlink
protocol.netlink netfilter,audit,generic,route,...

Describe alternatives you've considered

N/A

Additional context

N/A

Originally created by @rusty-snake on GitHub (Apr 23, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5116 ### Is your feature request related to a problem? Please describe. `AF_NETLINK` exposes a (huge) attack surface for the kernel. See https://github.com/netblue30/firejail/issues/4013#issuecomment-786780504 and #4020 for previous discussions. cc @kris7t @glitsj16 ### Describe the solution you'd like The socket syscall looks like `int socket(int domain, int type, int protocol);`. We already filter the first argument (`domain`) with `protocol unix,inet,inet6,netlink`. To minimize the attack surface of `AF_NETLINK` we should filter the third/last argument (`protocol`) if the first is `AF_NETLINK` (`netlink_socket = socket(AF_NETLINK, socket_type, netlink_family);`). ``` protocol unix,inet,inet6,netlink protocol.netlink netfilter,audit,generic,route,... ``` ### Describe alternatives you've considered N/A ### Additional context N/A

gitea-mirror added the

enhancement

networking

labels 2026-05-05 09:32:39 -06:00

gitea-mirror commented

2026-05-05 09:32:42 -06:00

Author

Owner

@ghost commented on GitHub (Apr 24, 2022):

Would make a nice enhancement. FWIW I always try to run apps without netlink via local overrides. Only in very rare cases it is actually needed. So, in other words, besides netlink filtering we could drop netlink from protocol for known 'good' applications too IMO. More of a note for future reference when doing PR's.

@ghost commented on GitHub (Apr 24, 2022): Would make a nice enhancement. FWIW I always try to run apps without netlink via local overrides. Only in very rare cases it is actually needed. So, in other words, besides netlink filtering we could drop netlink from protocol for known 'good' applications too IMO. More of a note for future reference when doing PR's.

gitea-mirror referenced this issue

2026-05-05 10:22:34 -06:00

[PR #2885] [MERGED] Add new Tor Browser alias #4570

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2885

No description provided.

Rows
Columns