github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #869] Can you use dirtycow to break out of firejail? [ QUESTION] #591

New issue

Closed

opened 2026-05-05 06:14:14 -06:00 by gitea-mirror · 6 comments

gitea-mirror commented

2026-05-05 06:14:14 -06:00

Owner

Originally created by @suedi on GitHub (Oct 23, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/869

Can you use dirtycow to break out of firejail?

DirtyCow as in https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails

Originally created by @suedi on GitHub (Oct 23, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/869 Can you use dirtycow to break out of firejail? DirtyCow as in https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails

gitea-mirror

2026-05-05 06:14:14 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:14:20 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Oct 23, 2016):

I'm working on testing that in a VM. 😄

@Fred-Barclay commented on GitHub (Oct 23, 2016): I'm working on testing that in a VM. :smile:

gitea-mirror commented

2026-05-05 06:14:22 -06:00

Author

Owner

@reinerh commented on GitHub (Oct 23, 2016):

The ptrace-based exploits are prevented with "firejail --seccomp", as this drops ptracing by default.
When --apparmor is used with the default apparmor firejail profile, there should also no access to /proc/self/mem, so those would also not work.

You could also try adding madvise to the list of syscalls dropped with seccomp for additional protection, though I'm not sure how often this is used legitimately.

@reinerh commented on GitHub (Oct 23, 2016): The ptrace-based exploits are prevented with "firejail --seccomp", as this drops ptracing by default. When --apparmor is used with the default apparmor firejail profile, there should also no access to /proc/self/mem, so those would also not work. You could also try adding madvise to the list of syscalls dropped with seccomp for additional protection, though I'm not sure how often this is used legitimately.

gitea-mirror commented

2026-05-05 06:14:23 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 25, 2016):

I would say you need to update the kernel.

@netblue30 commented on GitHub (Oct 25, 2016): I would say you need to update the kernel.

gitea-mirror commented

2026-05-05 06:14:26 -06:00

Author

Owner

@suedi commented on GitHub (Oct 26, 2016):

Yeah, that's wot I wos fraid of now I have to find time to re-compile the kernel :(

closing...

@suedi commented on GitHub (Oct 26, 2016): Yeah, that's wot I wos fraid of now I have to find time to re-compile the kernel :( closing...

gitea-mirror commented

2026-05-05 06:14:28 -06:00

Author

Owner

@Fred-Barclay commented on GitHub (Oct 26, 2016):

@suedi What distro are you using?

I know that Debian and Ubuntu (and Mint) have already got the fixes in their repos, so no need to recompile if you use either. I suspect most other distros that use installable binaries have updates too, so unless you use a distro that requires you to recompile you shouldn't have to.

@Fred-Barclay commented on GitHub (Oct 26, 2016): @suedi What distro are you using? I know that Debian and Ubuntu (and Mint) have already got the fixes in their repos, so no need to recompile if you use either. I suspect most other distros that use installable binaries have updates too, so unless you use a distro that requires you to recompile you shouldn't have to.

gitea-mirror commented

2026-05-05 06:14:30 -06:00

Author

Owner

@suedi commented on GitHub (Oct 27, 2016):

Yeah, on my rpi I already updated but on my other comps
I roll my own with AUFS patches so will need to re-compile me thinks

@suedi commented on GitHub (Oct 27, 2016): Yeah, on my rpi I already updated but on my other comps I roll my own with AUFS patches so will need to re-compile me thinks

gitea-mirror referenced this issue

2026-05-05 10:05:49 -06:00

[PR #591] [MERGED] Fixed conffiles warning for soffice #3675

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#591

No description provided.

Rows
Columns