github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6448] Harden `memory-deny-write-execute` against `READ_IMPLIES_EXEC` #3279

New issue

Open

opened 2026-05-05 09:53:11 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:53:11 -06:00

Owner

Originally created by @rusty-snake on GitHub (Aug 23, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6448

See https://gist.github.com/rusty-snake/481ad71892fb587a6056326686e55bf7

d6dae786b0/src/modules/seccomp.rs (L643-L647)

Originally created by @rusty-snake on GitHub (Aug 23, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6448 See https://gist.github.com/rusty-snake/481ad71892fb587a6056326686e55bf7 https://codeberg.org/crabjail/crablock/src/commit/d6dae786b0227fe1b97355412beee3aa46559522/src/modules/seccomp.rs#L643-L647

gitea-mirror added the

enhancement

label 2026-05-05 09:53:11 -06:00

gitea-mirror commented

2026-05-05 09:53:12 -06:00

Author

Owner

@ghost commented on GitHub (Aug 23, 2024):

@rusty-snake

On the gist you mention
[...]
3. shmat on architectures that multiplex is through ipc.
[...]

Do you have any insights on whether setting kernel parameter ia32_emulation=0 can help in this context?

@ghost commented on GitHub (Aug 23, 2024): @rusty-snake On the gist you mention [...] 3. shmat on architectures that multiplex is through ipc. [...] Do you have any insights on whether setting kernel parameter [ia32_emulation=0](https://lore.kernel.org/lkml/ZT0OqhIh%2F7c9IOYU@gmail.com/) can help in this context?

gitea-mirror commented

2026-05-05 09:53:13 -06:00

Author

Owner

@rusty-snake commented on GitHub (Aug 23, 2024):

Yes.

To be precise, disabling ia32 emulation, be it in Kconfig, as boot parameter or with a seccomp filter (systemd can set a system-wide filter for that) on a x86-64 system leaves only x86-64 and x32 (different ABIs, same architecture) which implement shmat as syscall.

In general you should disable/restrict such ugly/scary emulation features.
And OT, while my fedora hardening script(s) are (still) not ready, https://github.com/a13xp0p0v/kernel-hardening-checker it a great tool to check your Kconfig, cmdline and sysctls. _{But do not blindly apply everything from it and stay in front of a brick.}

@rusty-snake commented on GitHub (Aug 23, 2024): Yes. To be precise, disabling ia32 emulation, be it in Kconfig, as boot parameter or with a seccomp filter (systemd can set a system-wide filter for that) *on a x86-64 system* leaves only x86-64 and x32 (different ABIs, same architecture) which implement shmat as syscall. In general you should disable/restrict such ugly/scary emulation features. And OT, while my fedora hardening script(s) are (still) not ready, https://github.com/a13xp0p0v/kernel-hardening-checker it a great tool to check your Kconfig, cmdline and sysctls. <sub>But do not blindly apply everything from it and stay in front of a brick.</sub>

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3279

No description provided.

Rows
Columns

[GH-ISSUE #6448] Harden memory-deny-write-execute against READ_IMPLIES_EXEC #3279

[GH-ISSUE #6448] Harden `memory-deny-write-execute` against `READ_IMPLIES_EXEC` #3279