github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

ld.so.preload #358

New issue

Closed

opened 2026-05-05 05:40:42 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:40:42 -06:00

Owner

Originally created by @boite on GitHub (May 11, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/509

Apparmor denial messages are seen after using firejail --trace. This is because:-

--trace creates an empty /etc/ld.so.preload if it doesn't already exist
All glibc linked programs will attempt to read from /etc/ld.so.preload if if exists
The programs concerned have apparmor profiles which deny read of /etc/ld.so.preload

Ideally, firejail would not create the preload file. If it's absolutely necessary then the file should be removed as soon a practically possible iff firejail created it and it's still empty.

Originally created by @boite on GitHub (May 11, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/509 Apparmor denial messages are seen after using `firejail --trace`. This is because:- 1. `--trace` creates an empty `/etc/ld.so.preload` if it doesn't already exist 2. All glibc linked programs will attempt to read from `/etc/ld.so.preload` if if exists 3. The programs concerned have apparmor profiles which deny `read` of `/etc/ld.so.preload` Ideally, firejail would not create the preload file. If it's absolutely necessary then the file should be removed as soon a practically possible iff firejail created it and it's still empty.

gitea-mirror

2026-05-05 05:40:42 -06:00

closed this issue
added the
bug
label

gitea-mirror commented

2026-05-05 05:40:49 -06:00

Author

Owner

@netblue30 commented on GitHub (May 11, 2016):

I wish I had a solution to this problem. The file created by firejail is an empty file, used as a mount point by --trace feature. There is no way I can delete it, the mount point should stay there while the sandbox is running, and there could be multiple sandboxes running.

I will document the problem, the only impact is the message generated by AppArmor. AppArmor will prevent the linker from loading the file, but it will not crash the program.

@netblue30 commented on GitHub (May 11, 2016): I wish I had a solution to this problem. The file created by firejail is an empty file, used as a mount point by --trace feature. There is no way I can delete it, the mount point should stay there while the sandbox is running, and there could be multiple sandboxes running. I will document the problem, the only impact is the message generated by AppArmor. AppArmor will prevent the linker from loading the file, but it will not crash the program.

gitea-mirror commented

2026-05-05 05:40:53 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 1, 2016):

I'll be tracking the problem on the project webpage here:

https://firejail.wordpress.com/support/known-problems/#apparmor

@netblue30 commented on GitHub (Jun 1, 2016): I'll be tracking the problem on the project webpage here: https://firejail.wordpress.com/support/known-problems/#apparmor

gitea-mirror referenced this issue

2026-05-05 10:04:29 -06:00

[PR #363] [MERGED] Forward exit code from child process #3602

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#358

No description provided.

Rows
Columns