github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #6956] Some system calls can not be whitelisted #3433

New issue

Closed

opened 2026-05-05 09:59:52 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 09:59:52 -06:00

Owner

Originally created by @pierretom on GitHub (Nov 2, 2025).
Original GitHub issue: https://github.com/netblue30/firejail/issues/6956

For example:
441 - epoll_pwait2
449 - futex_waitv

seccomp.keep epoll_pwait2,futex_waitv,...
seccomp.log

Also those system calls do not appear with --debug-syscalls but are present in syscalls.list.

Originally created by @pierretom on GitHub (Nov 2, 2025). Original GitHub issue: https://github.com/netblue30/firejail/issues/6956 For example: 441 - epoll_pwait2 449 - futex_waitv `seccomp.keep epoll_pwait2,futex_waitv,...` [seccomp.log](https://github.com/user-attachments/files/23290787/seccomp.log) Also those system calls do not appear with `--debug-syscalls` but are present in [syscalls.list](https://github.com/netblue30/firejail/blob/master/contrib/syntax/lists/syscalls.list).

gitea-mirror

2026-05-05 09:59:52 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 09:59:55 -06:00

Author

Owner

@rusty-snake commented on GitHub (Nov 2, 2025):

The syscall lists and groups in firejail are seriously out of date by a few years. This affects the ability to name syscalls in seccomp.* (by number syntax could work) but also blacklisting of newer syscalls that provide a superset of an older blocked syscall.

If anyone wants to PR, here are the relevant files:

https://github.com/netblue30/firejail/blob/master/src/include/syscall_x86_64.h
https://github.com/netblue30/firejail/blob/master/src/include/syscall_i386.h
https://github.com/netblue30/firejail/blob/master/src/include/syscall_armeabi.h
https://github.com/netblue30/firejail/blob/master/src/include/syscall_aarch64.h

@rusty-snake commented on GitHub (Nov 2, 2025): The syscall lists and groups in firejail are seriously out of date by a few years. This affects the ability to name syscalls in `seccomp.*` (by number syntax could work) but also blacklisting of newer syscalls that provide a superset of an older blocked syscall. If anyone wants to PR, here are the relevant files: https://github.com/netblue30/firejail/blob/master/src/include/syscall_x86_64.h https://github.com/netblue30/firejail/blob/master/src/include/syscall_i386.h https://github.com/netblue30/firejail/blob/master/src/include/syscall_armeabi.h https://github.com/netblue30/firejail/blob/master/src/include/syscall_aarch64.h

gitea-mirror commented

2026-05-05 09:59:56 -06:00

Author

Owner

@pierretom commented on GitHub (Nov 4, 2025):

Ok, work in progress.

@pierretom commented on GitHub (Nov 4, 2025): Ok, work in progress.

gitea-mirror referenced this issue

2026-05-05 10:26:04 -06:00

[PR #3433] [MERGED] Update dino-im.profile #4757

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#3433

No description provided.

Rows
Columns