github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6491] Command to mount `/proc` with `subset=pid` #3289

New issue

Open

opened 2026-05-05 09:53:36 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 09:53:36 -06:00

Owner

Originally created by @rusty-snake on GitHub (Sep 27, 2024).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6491

System information exposed in various proc files such as cmdline, kallsyms, ... can contain sensitive information. A lot of programs work w/o them.

Describe the solution you'd like

Mount proc with subset=pid. On older kernels were subset=pid isn't supported we should ignore it if it was requested in a profile an proceed without it; if it was requested on the cli, we should harderror.

This need to be opt-in so suggestions for the command name are welcome (for crabjail I currently use the bulky fs._proc-exposes-system-information to turn it off and --mount-proc-subset=pid in crablock to turn it on, systemd uses ProcSubset=pid to turn it on).

Describe alternatives you've considered

We have disable-proc.inc, but enumerating badness does not work as good as subset=pid does.
Also some programs fail on EACCES but have fallback for ENOENT.

Downside: subset=pid is all or nothing. You can not mkdir/mknod in proc and bind something on it.

Additional context

Previous discussions:

Originally created by @rusty-snake on GitHub (Sep 27, 2024). Original GitHub issue: https://github.com/netblue30/firejail/issues/6491 ### Is your feature request related to a problem? Please describe. System information exposed in various proc files such as `cmdline`, `kallsyms`, ... can contain sensitive information. A lot of programs work w/o them. ### Describe the solution you'd like Mount proc with `subset=pid`. On older kernels were `subset=pid` isn't supported we should ignore it if it was requested in a profile an proceed without it; if it was requested on the cli, we should harderror. This need to be opt-in so suggestions for the command name are welcome (for crabjail I currently use the bulky `fs._proc-exposes-system-information` to turn it off and `--mount-proc-subset=pid` in crablock to turn it on, systemd uses `ProcSubset=pid` to turn it on). ### Describe alternatives you've considered We have `disable-proc.inc`, but enumerating badness does not work as good as `subset=pid` does. Also some programs fail on `EACCES` but have fallback for `ENOENT`. Downside: `subset=pid` is all or nothing. You can not `mkdir`/`mknod` in proc and bind something on it. ### Additional context Previous discussions: * https://github.com/netblue30/firejail/pull/4229#issuecomment-2378944433 * #6489

gitea-mirror added the

enhancement

label 2026-05-05 09:53:36 -06:00

gitea-mirror commented

2026-05-05 09:53:37 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 27, 2024):

$ crablock --mount-proc --mount-proc-subset= -- ls /proc
1	    diskstats	   keys		  mounts	swaps
2	    dma		   key-users	  mtd		sys
acpi	    driver	   kmsg		  mtrr		sysrq-trigger
asound	    dynamic_debug  kpagecgroup	  net		sysvipc
bootconfig  execdomains    kpagecount	  pagetypeinfo	thread-self
buddyinfo   filesystems    kpageflags	  partitions	timer_list
bus	    fs		   latency_stats  pressure	tty
cgroups     interrupts	   loadavg	  schedstat	uptime
cmdline     iomem	   locks	  scsi		version
consoles    ioports	   mdstat	  self		vmallocinfo
cpuinfo     irq		   meminfo	  slabinfo	vmstat
crypto	    kallsyms	   misc		  softirqs	zoneinfo
devices     kcore	   modules	  stat
$ crablock --mount-proc --mount-proc-subset=pid -- ls /proc
1  2  self  thread-self

@rusty-snake commented on GitHub (Sep 27, 2024): ```console $ crablock --mount-proc --mount-proc-subset= -- ls /proc 1 diskstats keys mounts swaps 2 dma key-users mtd sys acpi driver kmsg mtrr sysrq-trigger asound dynamic_debug kpagecgroup net sysvipc bootconfig execdomains kpagecount pagetypeinfo thread-self buddyinfo filesystems kpageflags partitions timer_list bus fs latency_stats pressure tty cgroups interrupts loadavg schedstat uptime cmdline iomem locks scsi version consoles ioports mdstat self vmallocinfo cpuinfo irq meminfo slabinfo vmstat crypto kallsyms misc softirqs zoneinfo devices kcore modules stat $ crablock --mount-proc --mount-proc-subset=pid -- ls /proc 1 2 self thread-self ```

gitea-mirror commented

2026-05-05 09:53:39 -06:00

Author

Owner

@kmk3 commented on GitHub (Sep 27, 2024):

It would be nice to have a command for hidepid=n as well.

@kmk3 commented on GitHub (Sep 27, 2024): +1 It would be nice to have a command for `hidepid=n` as well.

gitea-mirror commented

2026-05-05 09:53:40 -06:00

Author

Owner

@rusty-snake commented on GitHub (Sep 27, 2024):

While it would be a nice to have, it us not very useful because of the unshared pid namespace. So you need processes with different uids running in the sandbox.

@rusty-snake commented on GitHub (Sep 27, 2024): While it would be a nice to have, it us not very useful because of the unshared pid namespace. So you need processes with different uids running in the sandbox.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3289

No description provided.

Rows
Columns

[GH-ISSUE #6491] Command to mount /proc with subset=pid #3289

Is your feature request related to a problem? Please describe.

Describe the solution you'd like

Describe alternatives you've considered

Additional context

[GH-ISSUE #6491] Command to mount `/proc` with `subset=pid` #3289