github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #423] firejail shutdown does not pass SIGNAL to children #307

New issue

Closed

opened 2026-05-05 05:34:39 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:34:39 -06:00

Owner

Originally created by @pyther on GitHub (Apr 9, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/423

I'm testing against git.

When I run firejail ./catchsignal.sh and then firejail --shutdown ./catchsignal.sh I would expect my shell script would receive a SIGTERM, but that does not appear to be the case.

I have a simple shell script to demo straight this issue.

#!/bin/bash

_term() {
  echo "Caught Signal"
  kill $pid
  exit
}

trap _term SIGTERM

echo "Sleeping..."

sleep inf &
pid=$!
wait $pid

In this first example, I run the script with firejail, I kill the bash process and 'Caught Signal' is printed to the screen.

r2:firejail $ ./src/firejail/firejail ./catchsignal.sh 
Parent pid 30506, child pid 30507

Child process initialized
Sleeping...
Caught Signal
after wait

parent is shutting down, bye...

r2:~ $ firejail --tree
30506:pyther:./src/firejail/firejail ./catchsignal.sh 
  30507:pyther:./src/firejail/firejail ./catchsignal.sh 
    30509:pyther:/bin/bash ./catchsignal.sh 
      30510:pyther:sleep inf 

r2:~ $ kill 30509

When I firejail --shutdown the script does not echo Caught Signal. Firejail shows it issues a SIGTERM and then 2 seconds later a SIGKILL. Also the output shows that I can not shutdown the jail as my user, even thought I created it as a user.

r2:firejail $ ./src/firejail/firejail ./catchsignal.sh 
Parent pid 30603, child pid 30604

Child process initialized
Sleeping...
Killed

r2:~ $ firejail --tree
30603:pyther:./src/firejail/firejail ./catchsignal.sh 
  30604:pyther:./src/firejail/firejail ./catchsignal.sh 
    30606:pyther:/bin/bash ./catchsignal.sh 
      30607:pyther:sleep inf 

r2:~ $ firejail --shutdown=30603
Switching to pid 30604, the first child process inside the sandbox
Error: permission is denied to shutdown a sandbox created by a different user.

r2:~ $ sudo firejail --shutdown=30603
Switching to pid 30604, the first child process inside the sandbox
Sending SIGTERM to 30604
Sending SIGKILL to 30604
Sending SIGKILL to 30603

Originally created by @pyther on GitHub (Apr 9, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/423 I'm testing against git. When I run `firejail ./catchsignal.sh` and then `firejail --shutdown ./catchsignal.sh` I would expect my shell script would receive a SIGTERM, but that does not appear to be the case. I have a simple shell script to demo straight this issue. ``` bash #!/bin/bash _term() { echo "Caught Signal" kill $pid exit } trap _term SIGTERM echo "Sleeping..." sleep inf & pid=$! wait $pid ``` In this first example, I run the script with firejail, I kill the bash process and 'Caught Signal' is printed to the screen. ``` r2:firejail $ ./src/firejail/firejail ./catchsignal.sh Parent pid 30506, child pid 30507 Child process initialized Sleeping... Caught Signal after wait parent is shutting down, bye... r2:~ $ firejail --tree 30506:pyther:./src/firejail/firejail ./catchsignal.sh 30507:pyther:./src/firejail/firejail ./catchsignal.sh 30509:pyther:/bin/bash ./catchsignal.sh 30510:pyther:sleep inf r2:~ $ kill 30509 ``` When I `firejail --shutdown` the script does not echo Caught Signal. Firejail shows it issues a SIGTERM and then 2 seconds later a SIGKILL. Also the output shows that I can not shutdown the jail as my user, even thought I created it as a user. ``` r2:firejail $ ./src/firejail/firejail ./catchsignal.sh Parent pid 30603, child pid 30604 Child process initialized Sleeping... Killed r2:~ $ firejail --tree 30603:pyther:./src/firejail/firejail ./catchsignal.sh 30604:pyther:./src/firejail/firejail ./catchsignal.sh 30606:pyther:/bin/bash ./catchsignal.sh 30607:pyther:sleep inf r2:~ $ firejail --shutdown=30603 Switching to pid 30604, the first child process inside the sandbox Error: permission is denied to shutdown a sandbox created by a different user. r2:~ $ sudo firejail --shutdown=30603 Switching to pid 30604, the first child process inside the sandbox Sending SIGTERM to 30604 Sending SIGKILL to 30604 Sending SIGKILL to 30603 ```

gitea-mirror

2026-05-05 05:34:39 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:34:44 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 10, 2016):

Definitely a bug, thanks!

@netblue30 commented on GitHub (Apr 10, 2016): Definitely a bug, thanks!

gitea-mirror commented

2026-05-05 05:34:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 12, 2016):

Fixed on the master branch.

@netblue30 commented on GitHub (Apr 12, 2016): Fixed on the master branch.

gitea-mirror commented

2026-05-05 05:34:48 -06:00

Author

Owner

@pyther commented on GitHub (Apr 13, 2016):

Thanks. When I built the latest git HEAD gcc had the following warning

sandbox.c:37:8: warning: type defaults to 'int' in declaration of 'monitored_pid' [-Wimplicit-int]

Just wanted to give you a heads up as it seems directly related to this fix.
bb4830eb7e (diff-666cee54353ff0c7dfb4c7eb2933f273R37)

@pyther commented on GitHub (Apr 13, 2016): Thanks. When I built the latest git HEAD gcc had the following warning ``` sandbox.c:37:8: warning: type defaults to 'int' in declaration of 'monitored_pid' [-Wimplicit-int] ``` Just wanted to give you a heads up as it seems directly related to this fix. https://github.com/netblue30/firejail/commit/bb4830eb7eb1a1345f13a8f2e8e21a524dda3049#diff-666cee54353ff0c7dfb4c7eb2933f273R37

gitea-mirror commented

2026-05-05 05:34:50 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 14, 2016):

Fixed, thanks.

@netblue30 commented on GitHub (Apr 14, 2016): Fixed, thanks.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#307

No description provided.

Rows
Columns