github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #669] Is it possible to avoid remounting /proc on an individual basis? #459

New issue

Closed

opened 2026-05-05 05:54:25 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 05:54:25 -06:00

Owner

Originally created by @Fred-Barclay on GitHub (Jul 30, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/669

...and if so, what security problems could this cause?

I've started back on #435 and I believe the problem all boils down to the symlink ~/.googleearth/instance-running-lock and its target, /proc/12.
Even when using firejail --noprofile --debug google-earth, the /proc directory is remounted:
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
...
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
...

If it were possible to avoid remounting /proc/12, or at the very least /proc, then it's possible that #435 could be fixed.
So...
is there a command line option in firejail to keep /proc or /proc/12 from being remounted?

Thanks!
Fred

Originally created by @Fred-Barclay on GitHub (Jul 30, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/669 ...and if so, what security problems could this cause? I've started back on #435 and I believe the problem all boils down to the symlink ~/.googleearth/instance-running-lock and its target, /proc/12. Even when using `firejail --noprofile --debug google-earth`, the /proc directory is remounted: `Remounting /proc and /proc/sys filesystems` `Remounting /sys directory` `...` `Disable /proc/sys/fs/binfmt_misc` `Disable /proc/sys/kernel/core_pattern` `Disable /proc/sys/kernel/modprobe` `...` If it were possible to avoid remounting /proc/12, or at the very least /proc, then it's possible that #435 could be fixed. So... is there a command line option in firejail to keep /proc or /proc/12 from being remounted? Thanks! Fred

gitea-mirror

2026-05-05 05:54:25 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:54:31 -06:00

Author

Owner

@manevich commented on GitHub (Jul 30, 2016):

I think remounting is not related to this case.
/proc/12 and other /proc/number are directories created for each process, and number is PID of process running on system.
From jail you can see only processes running inside (that's one of things we use jail for - to isolate processes).
Same process will have different PID if you look from outside. This is effect of process namespaces, not remounting.

I don't have googleearth installed nor intent to install it, so I can't help you further.

@manevich commented on GitHub (Jul 30, 2016): I think remounting is not related to this case. `/proc/12` and other /proc/**_number_** are directories created for each process, and number is PID of process running on system. From jail you can see only processes running inside (that's one of things we use jail for - to isolate processes). Same process will have different PID if you look from outside. This is effect of process namespaces, not remounting. I don't have googleearth installed nor intent to install it, so I can't help you further.

gitea-mirror commented

2026-05-05 05:54:34 -06:00

Author

Owner

@netblue30 commented on GitHub (Jul 31, 2016):

If it were possible to avoid remounting /proc/12

The kernel does it automatically, no way around it. Try a simple blacklist /proc in the profile, maybe googleearth doesn't crash and doesn't create the lock file.

@netblue30 commented on GitHub (Jul 31, 2016): > If it were possible to avoid remounting /proc/12 The kernel does it automatically, no way around it. Try a simple blacklist /proc in the profile, maybe googleearth doesn't crash and doesn't create the lock file.

gitea-mirror commented

2026-05-05 05:54:37 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Aug 2, 2016):

Thanks. Since my question is answered I'll close this and use #677 for the issues I'm having with blacklisting /proc. :)

@Fred-Barclay commented on GitHub (Aug 2, 2016): Thanks. Since my question is answered I'll close this and use #677 for the issues I'm having with blacklisting /proc. :)

gitea-mirror referenced this issue

2026-05-05 08:49:46 -06:00

[GH-ISSUE #3426] Feature request: Allow bind in non-root mode #2152

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#459

No description provided.

Rows
Columns