[GH-ISSUE #87] Blacklist based seccomp filter can be bypassed on x86_64 using x32 syscall #51

New issue

Closed

opened 2026-05-05 04:53:54 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 04:53:54 -06:00

Owner

Originally created by @dzamlo on GitHub (Oct 21, 2015).
Original GitHub issue: https://github.com/netblue30/firejail/issues/87

If your kernel support x32 executable (the CONFIG_X86_X32=y option), you can use them to bypass Blacklist based seccomp filter. x32 syscall are made with the same arch value as x86_64 but use different syscall number. This mean than the
VALIDATE_ARCHITECTURE test don't reject x32 executable.

All syscall number from x32 executable have the bit 30 set to 1. You can check if the syscall number is bigger than 0x40000000 and reject the syscall if this the case.

Originally created by @dzamlo on GitHub (Oct 21, 2015). Original GitHub issue: https://github.com/netblue30/firejail/issues/87 If your kernel support x32 executable (the CONFIG_X86_X32=y option), you can use them to bypass Blacklist based seccomp filter. x32 syscall are made with the same arch value as x86_64 but use different syscall number. This mean than the VALIDATE_ARCHITECTURE test don't reject x32 executable. All syscall number from x32 executable have the bit 30 set to 1. You can check if the syscall number is bigger than 0x40000000 and reject the syscall if this the case.