github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #411] INFO: Limitation of supported options on GRsec #295

New issue

Closed

opened 2026-05-05 05:32:49 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:32:49 -06:00

Owner

Originally created by @HulaHoopWhonix on GitHub (Apr 6, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/411

Please add a brief note in documentation about what options are unavailable on GRsecurity kernels. Is this temporary or are GRsec chroots fundamentally incompatible with other programs?

In your testing did default profiles work out of the box?

Originally created by @HulaHoopWhonix on GitHub (Apr 6, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/411 Please add a brief note in documentation about what options are unavailable on GRsecurity kernels. Is this temporary or are GRsec chroots fundamentally incompatible with other programs? In your testing did default profiles work out of the box?

gitea-mirror

2026-05-05 05:32:49 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:32:53 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 7, 2016):

I'll write a full document for it. --chroot and --overlay will not be supported. Firetools is totally broken in this moment.

@netblue30 commented on GitHub (Apr 7, 2016): I'll write a full document for it. --chroot and --overlay will not be supported. Firetools is totally broken in this moment.

gitea-mirror commented

2026-05-05 05:32:55 -06:00

Author

Owner

@NoAgendaIT commented on GitHub (Apr 12, 2016):

I assume that, with "in this moment", you meant "when using this kernel", is that right?

Grsecurity provides similar options to firejail, so while chroot is not useful, I think that the networking options of firejail could still be useful on Grsecurity kernels. The chroot stuff of firejail will almost certainly break. And if you also have enabled Grsec's proc/pid hiding, firejail will not be able to work at all in my experience.

So, on these kernels, firejail will (only) be useful just for the networking stuff.

@NoAgendaIT commented on GitHub (Apr 12, 2016): I assume that, with "in this moment", you meant "when using this kernel", is that right? Grsecurity provides similar options to firejail, so while chroot is not useful, I think that the networking options of firejail could still be useful on Grsecurity kernels. The chroot stuff of firejail will almost certainly break. And if you also have enabled Grsec's proc/pid hiding, firejail will not be able to work at all in my experience. So, on these kernels, firejail will (only) be useful just for the networking stuff.

gitea-mirror commented

2026-05-05 05:32:58 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 13, 2016):

I have the kernel from Debian sid as a reference, before moving to a more general kernel configuration. This is the status:

proc/pid hiding problem was solved on the master branch. Some command line options in firemon utility would need to be run as root.

Chroot is stil broken - after chroot call I need to do some filesystem mounts, denied by Grsecurity. The story is similar to overlayfs - it uses chroot call at some point.

Firetools is mostly fixed. It will not show network statistics - also a problem with proc/pid hiding.

@netblue30 commented on GitHub (Apr 13, 2016): I have the kernel from Debian sid as a reference, before moving to a more general kernel configuration. This is the status: proc/pid hiding problem was solved on the master branch. Some command line options in firemon utility would need to be run as root. Chroot is stil broken - after chroot call I need to do some filesystem mounts, denied by Grsecurity. The story is similar to overlayfs - it uses chroot call at some point. Firetools is mostly fixed. It will not show network statistics - also a problem with proc/pid hiding.

gitea-mirror commented

2026-05-05 05:32:59 -06:00

Author

Owner

@netblue30 commented on GitHub (May 10, 2016):

I added some notes here: https://firejail.wordpress.com/documentation-2/grsecurity-notes/

@netblue30 commented on GitHub (May 10, 2016): I added some notes here: https://firejail.wordpress.com/documentation-2/grsecurity-notes/

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#295

No description provided.

Rows
Columns