github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #730] Wishlist: easier way to allow additional system calls #495

New issue

Closed

opened 2026-05-05 05:58:32 -06:00 by gitea-mirror · 9 comments

gitea-mirror commented

2026-05-05 05:58:32 -06:00

Owner

Originally created by @lheckemann on GitHub (Aug 18, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/730

For debugging software within jails, I like to be able to use tools like strace and gdb, which use the ptrace system call. However, I currently don't know of a way of allowing ptrace while keeping seccomp enabled without copying the default list of blocked system calls and removing ptrace, which makes for extremely unwieldy command lines. Something like --seccomp.blacklist=!ptrace or --seccomp.allow=ptrace would be nice (as opposed to --seccomp.keep=ptrace which seems to allow nothing but ptrace...).

Or would it make more sense to use gdb on firejail and skip ahead to the exec system call when doing this?

Originally created by @lheckemann on GitHub (Aug 18, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/730 For debugging software within jails, I like to be able to use tools like strace and gdb, which use the `ptrace` system call. However, I currently don't know of a way of allowing ptrace while keeping seccomp enabled without copying the default list of blocked system calls and removing ptrace, which makes for extremely unwieldy command lines. Something like `--seccomp.blacklist=!ptrace` or `--seccomp.allow=ptrace` would be nice (as opposed to `--seccomp.keep=ptrace` which seems to allow nothing but ptrace...). Or would it make more sense to use gdb on firejail and skip ahead to the `exec` system call when doing this?

gitea-mirror

2026-05-05 05:58:32 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 05:58:38 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Aug 19, 2016):

Would --seccomp.keep=ptrace do what you're looking for?

 --seccomp.keep=syscall,syscall,syscall
              Enable seccomp filter, and whitelist the syscalls specified by the command.

              Example:
              $ firejail --shell=none --seccomp.keep=poll,select,[...] transmission-gtk

@Fred-Barclay commented on GitHub (Aug 19, 2016): Would `--seccomp.keep=ptrace` do what you're looking for? ``` --seccomp.keep=syscall,syscall,syscall Enable seccomp filter, and whitelist the syscalls specified by the command. Example: $ firejail --shell=none --seccomp.keep=poll,select,[...] transmission-gtk ```

gitea-mirror commented

2026-05-05 05:58:40 -06:00

Author

Owner

@lheckemann commented on GitHub (Aug 19, 2016):

That results in the following seccomp filter:

  VALIDATE_ARCHITECTURE
  EXAMINE_SYSCAL
  WHITELIST 105 setuid
  WHITELIST 106 setgid
  WHITELIST 116 setgroups
  WHITELIST 32 dup
  WHITELIST 101 ptrace
  KILL_PROCESS

Which allows nothing but ptrace, causing such things as executing a shell, opening a file, or even writing to a previously opened file to fail. I meant to write --seccomp.keep, not --seccomp.whitelist (which doesn't exist) in the initial comment (fixed).

@lheckemann commented on GitHub (Aug 19, 2016): That results in the following seccomp filter: ``` VALIDATE_ARCHITECTURE EXAMINE_SYSCAL WHITELIST 105 setuid WHITELIST 106 setgid WHITELIST 116 setgroups WHITELIST 32 dup WHITELIST 101 ptrace KILL_PROCESS ``` Which allows nothing but ptrace, causing such things as executing a shell, opening a file, or even writing to a previously opened file to fail. I meant to write `--seccomp.keep`, not `--seccomp.whitelist` (which doesn't exist) in the initial comment (fixed).

gitea-mirror commented

2026-05-05 05:58:42 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 20, 2016):

Unfortunately, just allowing ptrace syscall will not be enough. It also needs to be able to run SUID binaries inside the sandbox - strace is SUID. This is how you can run it:

$ sudo strace -f firejail --noprofile application

Or you can just start a sandbox with --noprofile and run strace inside the sandbox:

$ firejail --noprofile
Parent pid 9690, child pid 9691
Child process initialized
netblue@debian:~/work/github/firejail$ strace -f application

I'll add a description in FAQ.

@netblue30 commented on GitHub (Aug 20, 2016): Unfortunately, just allowing ptrace syscall will not be enough. It also needs to be able to run SUID binaries inside the sandbox - strace is SUID. This is how you can run it: ``` $ sudo strace -f firejail --noprofile application ``` Or you can just start a sandbox with --noprofile and run strace inside the sandbox: ``` $ firejail --noprofile Parent pid 9690, child pid 9691 Child process initialized netblue@debian:~/work/github/firejail$ strace -f application ``` I'll add a description in FAQ.

gitea-mirror commented

2026-05-05 05:58:44 -06:00

Author

Owner

@lheckemann commented on GitHub (Aug 20, 2016):

strace isn't SUID on my system, and I don't see any reason why it would need to be.
firejail --ignore=seccomp --noblacklist=/usr/bin/strace strace echo hello works just fine for me...

@lheckemann commented on GitHub (Aug 20, 2016): strace isn't SUID on my system, and I don't see any reason why it would need to be. `firejail --ignore=seccomp --noblacklist=/usr/bin/strace strace echo hello` works just fine for me...

gitea-mirror commented

2026-05-05 05:58:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 20, 2016):

You are right, I forgot about the blacklist! I'll bring a command line flag in, something like "firejail --debug-ptrace [...] application"

@netblue30 commented on GitHub (Aug 20, 2016): You are right, I forgot about the blacklist! I'll bring a command line flag in, something like "firejail --debug-ptrace [...] application"

gitea-mirror commented

2026-05-05 05:58:48 -06:00

Author

Owner

@lheckemann commented on GitHub (Aug 22, 2016):

Wouldn't it be better to have a more generic option like --seccomp.add=ptrace so that we can make use of the standard blacklist, unblocking individual calls?

EDIT: would --allow-debuggers maybe be a better name for the option than --debug-ptrace if you decide to go with that route? Its function being allowing the ptrace syscall and disabling blacklisting for strace, gdb, ltrace, etc?

@lheckemann commented on GitHub (Aug 22, 2016): Wouldn't it be better to have a more generic option like `--seccomp.add=ptrace` so that we can make use of the standard blacklist, unblocking individual calls? EDIT: would `--allow-debuggers` maybe be a better name for the option than `--debug-ptrace` if you decide to go with that route? Its function being allowing the ptrace syscall and disabling blacklisting for strace, gdb, ltrace, etc?

gitea-mirror commented

2026-05-05 05:58:49 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 22, 2016):

Wouldn't it be better to have a more generic option like --seccomp.add=ptrace so that we can make use of the standard blacklist, unblocking individual calls?

Probably, but it will complicate the code - we are still SUID, so we need to keep it as simple as possible.
OK, it will be --allow-debuggers

@netblue30 commented on GitHub (Aug 22, 2016): > Wouldn't it be better to have a more generic option like --seccomp.add=ptrace so that we can make use of the standard blacklist, unblocking individual calls? Probably, but it will complicate the code - we are still SUID, so we need to keep it as simple as possible. OK, it will be --allow-debuggers

gitea-mirror commented

2026-05-05 05:58:52 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 22, 2016):

All set, you can try it out.

$ man firejail
[...]
      --allow-debuggers
              Allow tools such as strace and gdb inside the sandbox.

              Example:
              $  firejail  --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox
[...]

@netblue30 commented on GitHub (Aug 22, 2016): All set, you can try it out. ``` $ man firejail [...] --allow-debuggers Allow tools such as strace and gdb inside the sandbox. Example: $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox [...] ```

gitea-mirror commented

2026-05-05 05:58:53 -06:00

Author

Owner

@lheckemann commented on GitHub (Aug 23, 2016):

Great, thanks!

@lheckemann commented on GitHub (Aug 23, 2016): Great, thanks!

gitea-mirror referenced this issue

2026-05-05 10:05:16 -06:00

[PR #495] [MERGED] blacklisted g++ #3646

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#495

No description provided.

Rows
Columns