github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #5200] Remove --cgroups support #2912

New issue

Closed

opened 2026-05-05 09:34:35 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:34:35 -06:00

Owner

Originally created by @kmk3 on GitHub (Jun 14, 2022).
Original GitHub issue: https://github.com/netblue30/firejail/issues/5200

(Continued from #5190)

Some commits have been made to remove support for --cgroups:

73b089092 ("disable cgroup code", 2022-06-13)
95544a17f ("more on disable cgroups", 2022-06-13)

But there is still quite a bit of cgroup-related code left:

$ git show --pretty='%h %ai %s' -s
ed5f3fca1 2022-06-14 01:02:15 -0300 test/fs/invalid_filename.exp: s/end/send/
$ git grep cgroup | grep -v '^RELNOTES:' | grep cgroup
contrib/update_deb.sh:    -e "s/# cgroup .*/cgroup no/" \
contrib/vim/syntax/firejail.vim:syn match fjCommand /\v(bind|blacklist|blacklist-nolog|cgroup|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
etc/inc/disable-proc.inc:blacklist /proc/cgroups
etc/inc/disable-proc.inc:blacklist /proc/kpagecgroup
src/bash_completion/firejail.bash_completion.in:        --cgroup)
src/firejail/join.c:    // in user mode set caps seccomp, cpu, cgroup, etc
src/include/rundefs.h:#define RUN_CGROUP_CFG                    RUN_MNT_DIR "/cgroup"
src/zsh_completion/_firejail.in:    '--cgroup=-[place the sandbox in the specified control group]: :'
test/fs/sys_fs.exp:     "cgroup"
test/root/cgroup.exp:send -- "mkdir /sys/fs/cgroup/systemd/firejail\r"
test/root/cgroup.exp:send -- "ls /sys/fs/cgroup/systemd/firejail\r"
test/root/cgroup.exp:send --  "firejail --name=\"join testing\" --cgroup=/sys/fs/cgroup/systemd/firejail/tasks\r"
test/root/cgroup.exp:send -- "wc -l /sys/fs/cgroup/systemd/firejail/tasks\r"
test/root/cgroup.exp:send -- "wc -l /sys/fs/cgroup/systemd/firejail/tasks\r"
test/root/root.sh:echo "TESTING: cgroup (test/root/cgroup.exp)"
test/root/root.sh:./cgroup.exp

At a glance, I think that the syntax/completion/test code should probably also
be removed; not sure about the rest.

Cc: @netblue30

Originally created by @kmk3 on GitHub (Jun 14, 2022). Original GitHub issue: https://github.com/netblue30/firejail/issues/5200 (Continued from #5190) Some commits have been made to remove support for `--cgroups`: * 73b089092 ("disable cgroup code", 2022-06-13) * 95544a17f ("more on disable cgroups", 2022-06-13) But there is still quite a bit of cgroup-related code left: ```console $ git show --pretty='%h %ai %s' -s ed5f3fca1 2022-06-14 01:02:15 -0300 test/fs/invalid_filename.exp: s/end/send/ $ git grep cgroup | grep -v '^RELNOTES:' | grep cgroup contrib/update_deb.sh: -e "s/# cgroup .*/cgroup no/" \ contrib/vim/syntax/firejail.vim:syn match fjCommand /\v(bind|blacklist|blacklist-nolog|cgroup|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained etc/inc/disable-proc.inc:blacklist /proc/cgroups etc/inc/disable-proc.inc:blacklist /proc/kpagecgroup src/bash_completion/firejail.bash_completion.in: --cgroup) src/firejail/join.c: // in user mode set caps seccomp, cpu, cgroup, etc src/include/rundefs.h:#define RUN_CGROUP_CFG RUN_MNT_DIR "/cgroup" src/zsh_completion/_firejail.in: '--cgroup=-[place the sandbox in the specified control group]: :' test/fs/sys_fs.exp: "cgroup" test/root/cgroup.exp:send -- "mkdir /sys/fs/cgroup/systemd/firejail\r" test/root/cgroup.exp:send -- "ls /sys/fs/cgroup/systemd/firejail\r" test/root/cgroup.exp:send -- "firejail --name=\"join testing\" --cgroup=/sys/fs/cgroup/systemd/firejail/tasks\r" test/root/cgroup.exp:send -- "wc -l /sys/fs/cgroup/systemd/firejail/tasks\r" test/root/cgroup.exp:send -- "wc -l /sys/fs/cgroup/systemd/firejail/tasks\r" test/root/root.sh:echo "TESTING: cgroup (test/root/cgroup.exp)" test/root/root.sh:./cgroup.exp ``` At a glance, I think that the syntax/completion/test code should probably also be removed; not sure about the rest. Cc: @netblue30

gitea-mirror

2026-05-05 09:34:35 -06:00

closed this issue
added the
removal
label

gitea-mirror commented

2026-05-05 09:34:37 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 16, 2022):

Marking it a bug, I'll clean them up.

@netblue30 commented on GitHub (Jun 16, 2022): Marking it a bug, I'll clean them up.

gitea-mirror commented

2026-05-05 09:34:38 -06:00

Author

Owner

@kmk3 commented on GitHub (Jun 16, 2022):

I think that the code related to the option is all gone now:

$ git show --pretty='%h %ai %s' -s
0e0804635 2022-06-16 16:52:02 -0300 update_deb.sh: remove cgroup-related code
$ git grep cgroup | grep -v '^RELNOTES:' | grep cgroup
etc/inc/disable-proc.inc:blacklist /proc/cgroups
etc/inc/disable-proc.inc:blacklist /proc/kpagecgroup
test/fs/sys_fs.exp:     "cgroup"

Thanks for continuing the removal until the end.

@kmk3 commented on GitHub (Jun 16, 2022): I think that the code related to the option is all gone now: ```console $ git show --pretty='%h %ai %s' -s 0e0804635 2022-06-16 16:52:02 -0300 update_deb.sh: remove cgroup-related code $ git grep cgroup | grep -v '^RELNOTES:' | grep cgroup etc/inc/disable-proc.inc:blacklist /proc/cgroups etc/inc/disable-proc.inc:blacklist /proc/kpagecgroup test/fs/sys_fs.exp: "cgroup" ``` Thanks for continuing the removal until the end.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#2912

No description provided.

Rows
Columns