firejail directory #5946

New issue

Closed

opened 2026-05-05 10:47:51 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:47:51 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/6307
Author: @spiiroin
Created: 4/12/2024
Status: ✅ Merged
Merged: 4/25/2024
Merged by: @kmk3

Base: master ← Head: serialize_remounts

📝 Commits (3)

773073c refactor: make rundir lock variables global
53bc658 modif: improve flock handling
e53b6d6 modif: populate /run/firejail while holding flock

📊 Changes

4 files changed (+118 additions, -36 deletions)

View changed files

📝 src/firejail/chroot.c (+4 -1)
📝 src/firejail/firejail.h (+8 -1)
📝 src/firejail/main.c (+11 -33)
📝 src/firejail/preproc.c (+95 -1)

📄 Description

There are reports of firejail sandboxed applications occasionally taking long time (12 seconds) to start up. When this happens, it affects all sandboxed applications until the device is rebooted.

The reason for the slowdown seems to be a timing hazard in the way remounts under /run/firejail are handled. This gets triggered when multiple firejail processes are launched in parallel as part of user session bring up and results in some, dozens, hundreds, or even thousands of stray /run/firejail/xxx mounts. The amount of mount points then affects every mount operation that is done during sandbox filesystem construction.

To stop this from happening, arrange it so that only one firejail process at time is inspecting and/or modifying mountpoints under /run/firejail by doing:

Create /run/firejail directory using atomic operations
Create and obtain lock for /run/firejail/firejail-run.lock
Setup files, directories and mounts under /run/firejail
Release /run/firejail/firejail-run.lock

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/6307 **Author:** [@spiiroin](https://github.com/spiiroin) **Created:** 4/12/2024 **Status:** ✅ Merged **Merged:** 4/25/2024 **Merged by:** [@kmk3](https://github.com/kmk3) **Base:** `master` ← **Head:** `serialize_remounts` --- ### 📝 Commits (3) - [`773073c`](https://github.com/netblue30/firejail/commit/773073c8484914b31ce68cbd635212253bf96f4c) refactor: make rundir lock variables global - [`53bc658`](https://github.com/netblue30/firejail/commit/53bc6589745a9f09bbc42a12dd14f9e81b6fc93f) modif: improve flock handling - [`e53b6d6`](https://github.com/netblue30/firejail/commit/e53b6d66b1e9fb81e19af74946e63babf90a7dd6) modif: populate /run/firejail while holding flock ### 📊 Changes **4 files changed** (+118 additions, -36 deletions) <details> <summary>View changed files</summary> 📝 `src/firejail/chroot.c` (+4 -1) 📝 `src/firejail/firejail.h` (+8 -1) 📝 `src/firejail/main.c` (+11 -33) 📝 `src/firejail/preproc.c` (+95 -1) </details> ### 📄 Description There are reports of firejail sandboxed applications occasionally taking long time (12 seconds) to start up. When this happens, it affects all sandboxed applications until the device is rebooted. The reason for the slowdown seems to be a timing hazard in the way remounts under /run/firejail are handled. This gets triggered when multiple firejail processes are launched in parallel as part of user session bring up and results in some, dozens, hundreds, or even thousands of stray /run/firejail/xxx mounts. The amount of mount points then affects every mount operation that is done during sandbox filesystem construction. To stop this from happening, arrange it so that only one firejail process at time is inspecting and/or modifying mountpoints under /run/firejail by doing: 1) Create /run/firejail directory using atomic operations 2) Create and obtain lock for /run/firejail/firejail-run.lock 3) Setup files, directories and mounts under /run/firejail 4) Release /run/firejail/firejail-run.lock --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror

2026-05-05 10:47:51 -06:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#5946

No description provided.

Rows
Columns