github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #494] Firejail broken in Debian sid #346

New issue

Closed

opened 2026-05-05 05:38:57 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 05:38:57 -06:00

Owner

Originally created by @netblue30 on GitHub (May 1, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/494

A recent libselinux1 update (2.5-1) introduces a bug where it attempts to re-mount /proc directory. The library is in use by a number of very common utilities such as ls, mv, sed, tar.

$ strace ls
[...]
statfs("/sys/fs/selinux", 0x7fff330402d0) = -1 ENOENT (No such file or directory
)
statfs("/selinux", 0x7fff330402d0)      = -1 ENOENT (No such file or directory)
mount("proc", "/proc", "proc", 0, NULL) = -1 EPERM (Operation not permitted)
brk(NULL)                               = 0x2179000
brk(0x219a000)                          = 0x219a000
open("/proc/filesystems", O_RDONLY)     = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa

mount syscall is detected by seccomp, and Firejail kills the process. Inside the sandbox it looks something like this:

$ firejail
Reading profile /etc/firejail/generic.profile
Reading profile /etc/firejail/disable-common.inc
Reading profile /etc/firejail/disable-programs.inc
Reading profile /etc/firejail/disable-passwdmgr.inc

** Note: you can use --noprofile to disable generic.profile **

Parent pid 1092, child pid 1093

Child process initialized
$ ls
Bad system call
$

You will get an entry in system log such as:

$ tail -f /var/log/syslog
[...]
type=SECCOMP msg=audit(1462106848.449:3321): auid=1000 uid=1000 gid=1000 ses=1 pid=10502 comm="icedove" exe="/usr/lib/icedove/icedove" sig=31 arch=c000003e syscall=165 compat=0 ip=0x7f0b02be866a code=0x0

The problem also affects a number of desktop programs such as icedove and iceweasel. The workaround for now is to build a seccomp list without mount, or to disable seccomp.

firejail --seccomp.drop=umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,nfsservctl,get_kernel_syms iceweasel

There is already a bug report here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822679, although is not specific to Firejail. A fix for the problem is available upstream, it needs to be ported a new libselinux1 version released. On my side, I will put a workaround in the latest version here on GitHub in the next few days.

Originally created by @netblue30 on GitHub (May 1, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/494 A recent libselinux1 update (2.5-1) introduces a bug where it attempts to re-mount /proc directory. The library is in use by a number of very common utilities such as ls, mv, sed, tar. ``` $ strace ls [...] statfs("/sys/fs/selinux", 0x7fff330402d0) = -1 ENOENT (No such file or directory ) statfs("/selinux", 0x7fff330402d0) = -1 ENOENT (No such file or directory) mount("proc", "/proc", "proc", 0, NULL) = -1 EPERM (Operation not permitted) brk(NULL) = 0x2179000 brk(0x219a000) = 0x219a000 open("/proc/filesystems", O_RDONLY) = 3 fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fa ``` mount syscall is detected by seccomp, and Firejail kills the process. Inside the sandbox it looks something like this: ``` $ firejail Reading profile /etc/firejail/generic.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc ** Note: you can use --noprofile to disable generic.profile ** Parent pid 1092, child pid 1093 Child process initialized $ ls Bad system call $ ``` You will get an entry in system log such as: ``` $ tail -f /var/log/syslog [...] type=SECCOMP msg=audit(1462106848.449:3321): auid=1000 uid=1000 gid=1000 ses=1 pid=10502 comm="icedove" exe="/usr/lib/icedove/icedove" sig=31 arch=c000003e syscall=165 compat=0 ip=0x7f0b02be866a code=0x0 ``` The problem also affects a number of desktop programs such as icedove and iceweasel. The workaround for now is to build a seccomp list without mount, or to disable seccomp. ``` firejail --seccomp.drop=umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,chroot,tuxcall,reboot,nfsservctl,get_kernel_syms iceweasel ``` There is already a bug report here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=822679, although is not specific to Firejail. A fix for the problem is available upstream, it needs to be ported a new libselinux1 version released. On my side, I will put a workaround in the latest version here on GitHub in the next few days.

gitea-mirror

2026-05-05 05:38:57 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:39:03 -06:00

Author

Owner

@Micha-Btz commented on GitHub (May 2, 2016):

ok, thanks. didn't check that are bug reports there. day was too long :-)
debian has released a new version libselinux1 update 2.5-2 i will test today if it work and i will report back.

@Micha-Btz commented on GitHub (May 2, 2016): ok, thanks. didn't check that are bug reports there. day was too long :-) debian has released a new version libselinux1 update 2.5-2 i will test today if it work and i will report back.

gitea-mirror commented

2026-05-05 05:39:04 -06:00

Author

Owner

@netblue30 commented on GitHub (May 2, 2016):

Indeed, libxelinux1 update 2.5-2 fixed the problem. Thanks.

@netblue30 commented on GitHub (May 2, 2016): Indeed, libxelinux1 update 2.5-2 fixed the problem. Thanks.

gitea-mirror commented

2026-05-05 05:39:07 -06:00

Author

Owner

@Wadkar07 commented on GitHub (May 22, 2018):

how to use "--noprofile" help plz I am extreme noob

@Wadkar07 commented on GitHub (May 22, 2018): how to use "--noprofile" help plz I am extreme noob

gitea-mirror commented

2026-05-05 05:39:09 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (May 22, 2018):

@Wadkar07 like this: firejail --noprofile <some_program> from inside your terminal.
For instance, if you wanted to do it for firefox, it would be firejail --noprofile firefox.

@Fred-Barclay commented on GitHub (May 22, 2018): @Wadkar07 like this: `firejail --noprofile <some_program>` from inside your terminal. For instance, if you wanted to do it for firefox, it would be `firejail --noprofile firefox`.

gitea-mirror referenced this issue

2026-05-05 10:04:25 -06:00

[PR #346] [MERGED] add hedgewars profile (whitelist) #3601

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#346

No description provided.

Rows
Columns