[GH-ISSUE #731] Kernel fix found for known problem, "Cannot install new software while Firejail is running" #493

New issue

Closed

opened 2026-05-05 05:58:31 -06:00 by gitea-mirror · 2 comments

gitea-mirror commented

2026-05-05 05:58:31 -06:00

Owner

Originally created by @david-drinn on GitHub (Aug 18, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/731

This strikes me as exactly the kernel fix needed for the aforementioned firejail known problem:

vfs: Lazily remove mounts on unlinked files and directories.

With the introduction of mount namespaces and bind mounts it became possible to access files and directories that on some paths are mount points but are not mount points on other paths. It is very confusing when rm -rf somedir returns -EBUSY simply because somedir is mounted somewhere else. With the addition of user namespaces allowing unprivileged mounts this condition has gone from annoying to allowing a DOS attack on other users in the system.

The possibility for mischief is removed by updating the vfs to support rename, unlink and rmdir on a dentry that is a mountpoint and by lazily unmounting mountpoints on deleted dentries.

...

I wanted to share the knowledge in case it helps you devise a tweak to the way firejail blacklists files, or at the very least so others know which patch they need to backport to older kernels.

Originally created by @david-drinn on GitHub (Aug 18, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/731 This strikes me as exactly the kernel fix needed for the aforementioned firejail [known problem](https://firejail.wordpress.com/support/known-problems/#removeblacklisted): > [vfs: Lazily remove mounts on unlinked files and directories.](https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?h=linux-3.18.y&id=8ed936b5671bfb33d89bc60bdcc7cf0470ba52fe) > > With the introduction of mount namespaces and bind mounts it became possible to access files and directories that on some paths are mount points but are not mount points on other paths. It is very confusing when rm -rf somedir returns -EBUSY simply because somedir is mounted somewhere else. With the addition of user namespaces allowing unprivileged mounts this condition has gone from annoying to allowing a DOS attack on other users in the system. > > The possibility for mischief is removed by updating the vfs to support rename, unlink and rmdir on a dentry that is a mountpoint and by lazily unmounting mountpoints on deleted dentries. > > ... I wanted to share the knowledge in case it helps you devise a tweak to the way firejail blacklists files, or at the very least so others know which patch they need to backport to older kernels.

gitea-mirror

2026-05-05 05:58:31 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:58:35 -06:00

Author

Owner

@david-drinn commented on GitHub (Aug 18, 2016):

~~Also, you might look at how systemd-nspawn binds directories in containers it spawns. It does not appear to have the aforementioned problem.~~

Incorrect. While systemd-nspawn does not bind-ro /etc/passwd etc. by default as firejail does, if you do bind it yourself, or any other such file, you run into the same issue.

@david-drinn commented on GitHub (Aug 18, 2016): ~~Also, you might look at how `systemd-nspawn` binds directories in containers it spawns. It does not appear to have the aforementioned problem.~~ Incorrect. While `systemd-nspawn` does not bind-ro `/etc/passwd` etc. by default as firejail does, if you do bind it yourself, or any other such file, you run into the same issue.

gitea-mirror commented

2026-05-05 05:58:38 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 20, 2016):

Thank you for the info, I'll modify known problem page.

@netblue30 commented on GitHub (Aug 20, 2016): Thank you for the info, I'll modify known problem page.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#493

No description provided.

Rows
Columns