[GH-ISSUE #75] Steam and Seccomp #43

New issue

Closed

opened 2026-05-05 04:53:14 -06:00 by gitea-mirror · 1 comment

gitea-mirror commented

2026-05-05 04:53:14 -06:00

Owner

Originally created by @ghost on GitHub (Oct 8, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/75

I'm trying to run Steam with Firejail. Everything works except when I enable seccomp. I tried keeping one by one with no results. It seems like all of the seccomp calls break Steam?

The error:

Error: You are missing the following 32-bit libraries, and Steam may not run:
libc.so.6

The log:

[amarildo@amarildo ~]$ firejail --noprofile --debug --seccomp steam
Command name #steam#
Using the local network stack
Parent pid 12153, child pid 12154
Initializing child process
PID namespace installed
Mounting read-only /bin, /sbin, /lib, /lib64, /usr, /etc, /var
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /tmp/firejail/mnt directory
Create the new utmp file
Mount the new utmp file
Disable /home/lost+found
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /sys/kernel/uevent_helper
Disable /proc/irq
Disable /proc/bus
Disable /proc/kcore
Disable /proc/kallsyms
Mounting a new /boot directory
SECCOMP Filter:
VALIDATE_ARCHITECTURE
EXAMINE_SYSCAL
BLACKLIST 165 mount
BLACKLIST 166 umount2
BLACKLIST 101 ptrace
BLACKLIST 246 kexec_load
BLACKLIST 304 open_by_handle_at
BLACKLIST 175 init_module
BLACKLIST 313 finit_module
BLACKLIST 176 delete_module
BLACKLIST 172 iopl
BLACKLIST 173 ioperm
BLACKLIST 167 swapon
BLACKLIST 168 swapoff
BLACKLIST 103 syslog
BLACKLIST 310 process_vm_readv
BLACKLIST 311 process_vm_writev
BLACKLIST 139 sysfs
BLACKLIST 156 _sysctl
BLACKLIST 159 adjtimex
BLACKLIST 305 clock_adjtime
BLACKLIST 212 lookup_dcookie
BLACKLIST 298 perf_event_open
BLACKLIST 300 fanotify_init
BLACKLIST 312 kcmp
RETURN_ALLOW
Save seccomp filter, size 408 bytes
seccomp enabled
Username amarildo, groups 100, 10, 90, 91, 92, 93, 95, 98,
Starting steam
execvp argument 0: /bin/bash
execvp argument 1: -c
execvp argument 2: steam
Child process initialized
/home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable
/home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable
Running Steam on arch 64-bit
/home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable
STEAM_RUNTIME is enabled automatically
Error: You are missing the following 32-bit libraries, and Steam may not run:
libc.so.6
/home/amarildo/.local/share/Steam/steam.sh: line 756: 93 Bad system call >$STEAM_DEBUGGER "$STEAMROOT/$STEAMEXEPATH" "$@"

parent is shutting down, bye...
[amarildo@amarildo ~]$

Arch Linux
linux-grsec Kernel

Originally created by @ghost on GitHub (Oct 8, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/75 I'm trying to run Steam with Firejail. Everything works except when I enable seccomp. I tried keeping one by one with no results. It seems like all of the seccomp calls break Steam? The error: > Error: You are missing the following 32-bit libraries, and Steam may not run: > libc.so.6 The log: > [amarildo@amarildo ~]$ firejail --noprofile --debug --seccomp steam > Command name #steam# > Using the local network stack > Parent pid 12153, child pid 12154 > Initializing child process > PID namespace installed > Mounting read-only /bin, /sbin, /lib, /lib64, /usr, /etc, /var > Mounting tmpfs on /var/lock > Mounting tmpfs on /var/tmp > Mounting tmpfs on /var/log > Mounting tmpfs on /tmp/firejail/mnt directory > Create the new utmp file > Mount the new utmp file > Disable /home/lost+found > Remounting /proc and /proc/sys filesystems > Remounting /sys directory > Disable /proc/sysrq-trigger > Disable /proc/sys/kernel/hotplug > Disable /sys/kernel/uevent_helper > Disable /proc/irq > Disable /proc/bus > Disable /proc/kcore > Disable /proc/kallsyms > Mounting a new /boot directory > SECCOMP Filter: > VALIDATE_ARCHITECTURE > EXAMINE_SYSCAL > BLACKLIST 165 mount > BLACKLIST 166 umount2 > BLACKLIST 101 ptrace > BLACKLIST 246 kexec_load > BLACKLIST 304 open_by_handle_at > BLACKLIST 175 init_module > BLACKLIST 313 finit_module > BLACKLIST 176 delete_module > BLACKLIST 172 iopl > BLACKLIST 173 ioperm > BLACKLIST 167 swapon > BLACKLIST 168 swapoff > BLACKLIST 103 syslog > BLACKLIST 310 process_vm_readv > BLACKLIST 311 process_vm_writev > BLACKLIST 139 sysfs > BLACKLIST 156 _sysctl > BLACKLIST 159 adjtimex > BLACKLIST 305 clock_adjtime > BLACKLIST 212 lookup_dcookie > BLACKLIST 298 perf_event_open > BLACKLIST 300 fanotify_init > BLACKLIST 312 kcmp > RETURN_ALLOW > Save seccomp filter, size 408 bytes > seccomp enabled > Username amarildo, groups 100, 10, 90, 91, 92, 93, 95, 98, > Starting steam > execvp argument 0: /bin/bash > execvp argument 1: -c > execvp argument 2: steam > Child process initialized > /home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable > /home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable > Running Steam on arch 64-bit > /home/amarildo/.local/share/Steam/steam.sh: line 161: VERSION_ID: unbound variable > STEAM_RUNTIME is enabled automatically > Error: You are missing the following 32-bit libraries, and Steam may not run: > libc.so.6 > /home/amarildo/.local/share/Steam/steam.sh: line 756: 93 Bad system call >$STEAM_DEBUGGER "$STEAMROOT/$STEAMEXEPATH" "$@" > > parent is shutting down, bye... > [amarildo@amarildo ~]$ Arch Linux linux-grsec Kernel

gitea-mirror closed this issue

2026-05-05 04:53:18 -06:00

gitea-mirror commented

2026-05-05 04:53:22 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 9, 2015):

Syscall numbers don't match in 32bit and 64bit architectures. For example, syscall 311 is a harmless sys_set_robust_list on 32bit and a troublesome process_vm_writev on 64bit.

Steam is a 32bit executable, and I assume you are running on a 64bit system with a 64bit seccomp filter, so at some point seccomp will crash your program.

@netblue30 commented on GitHub (Oct 9, 2015): Syscall numbers don't match in 32bit and 64bit architectures. For example, syscall 311 is a harmless sys_set_robust_list on 32bit and a troublesome process_vm_writev on 64bit. Steam is a 32bit executable, and I assume you are running on a 64bit system with a 64bit seccomp filter, so at some point seccomp will crash your program.

gitea-mirror referenced this issue

2026-05-05 10:03:00 -06:00

[PR #43] [MERGED] Fix typo in usage.c #3522

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#43

No description provided.

Rows
Columns