github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

[GH-ISSUE #933] fseccomp Error with --chroot option #635

New issue
Closed
opened 2026-05-05 06:19:14 -06:00 by gitea-mirror · 7 comments
gitea-mirror commented 2026-05-05 06:19:14 -06:00
Owner
Copy link

Originally created by @maurorappa on GitHub (Nov 22, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/933

I'm trying to use the chroot option with no luck.
First I try a standard linux chroot setup:

root@sandbox:~# tree chroot/
chroot/
├── lib
│   └── x86_64-linux-gnu
│       ├── libc.so.6
│       └── libprocps.so.3
├── lib64
│   └── ld-linux-x86-64.so.2
└── uptime

I create the proc directory, mount and run the uptime

root@sandbox:~# mkdir chroot/proc
root@sandbox:~# mount -o bind /proc/ chroot/proc/
root@sandbox:~# chroot chroot/ ./uptime
 10:46:37 up  3:57,  0 users,  load average: 0.02, 0.03, 0.05

I can do the same with firejail:

root@sandbox:~# firejail --noprofile chroot/uptime
Parent pid 11867, child pid 11868
The new log directory is /proc/11868/root/var/log
Child process initialized
 10:51:47 up  4:02,  0 users,  load average: 0.00, 0.02, 0.05

Now I want to use --chroot; after creating the directories dev, var/tmp and tmp,
but I get:

root@sandbox:~# firejail --noprofile --debug  --chroot=chroot/ ./uptime
Autoselecting /bin/bash as shell
Command name #uptime#
Enabling IPC namespace
Using the local network stack
Parent pid 11951, child pid 11952
The new log directory is /proc/11952/root/var/log
Host network configured
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp.i386 file
Creating empty /run/firejail/mnt/seccomp.amd64 file
Creating empty /run/firejail/mnt/seccomp file
Creating empty /run/firejail/mnt/seccomp.protocol file
Mounting /dev on chroot//dev
Updating /etc/resolv.conf in chroot//etc/resolv.conf
Warning: cannot open chroot//etc/resolv.conf, file not copied
Warning: /etc/resolv.conf not initialized
Chrooting into chroot/
Warning: /var/lock not mounted
Mounting tmpfs on /var/tmp
Warning: cannot mount tmpfs on top of /var/log
Warning: cannot find /var/run/utmp
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Warning: failed to unmount /sys
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/timer_stats
Disable /proc/kcore
Disable /proc/kallsyms
Disable /dev/port
Warning: whitelist feature is disabled in chroot
Build secondary 32-bit filter
sbox run: /usr/local/lib/firejail/fseccomp secondary 32 /run/firejail/mnt/seccomp.i386 (null) 
Dropping all capabilities
Username root, no supplementary groups
execl: No such file or directory
Error: failed to run /usr/local/lib/firejail/fseccomp
Error: cannot establish communication with the parent, exiting...

I'm using version 0.9.45 built from source, the binary is present /usr/local/lib/firejail/fseccomp and the related files too:

root@sandbox:~# tree /var/run/firejail/
/var/run/firejail/
├── appimage
├── bandwidth
├── firejail.ro.dir
├── firejail.ro.file
├── mnt
├── name
├── network
└── x11

Please let me know what I'm doing wrong or if there's an issue.
Cheers

Originally created by @maurorappa on GitHub (Nov 22, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/933 I'm trying to use the chroot option with no luck. First I try a standard linux chroot setup: ``` root@sandbox:~# tree chroot/ chroot/ ├── lib │   └── x86_64-linux-gnu │   ├── libc.so.6 │   └── libprocps.so.3 ├── lib64 │   └── ld-linux-x86-64.so.2 └── uptime ``` I create the proc directory, mount and run the uptime ``` root@sandbox:~# mkdir chroot/proc root@sandbox:~# mount -o bind /proc/ chroot/proc/ root@sandbox:~# chroot chroot/ ./uptime 10:46:37 up 3:57, 0 users, load average: 0.02, 0.03, 0.05 ``` I can do the same with firejail: ``` root@sandbox:~# firejail --noprofile chroot/uptime Parent pid 11867, child pid 11868 The new log directory is /proc/11868/root/var/log Child process initialized 10:51:47 up 4:02, 0 users, load average: 0.00, 0.02, 0.05 ``` Now I want to use --chroot; after creating the directories dev, var/tmp and tmp, but I get: ``` root@sandbox:~# firejail --noprofile --debug --chroot=chroot/ ./uptime Autoselecting /bin/bash as shell Command name #uptime# Enabling IPC namespace Using the local network stack Parent pid 11951, child pid 11952 The new log directory is /proc/11952/root/var/log Host network configured Initializing child process PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp.i386 file Creating empty /run/firejail/mnt/seccomp.amd64 file Creating empty /run/firejail/mnt/seccomp file Creating empty /run/firejail/mnt/seccomp.protocol file Mounting /dev on chroot//dev Updating /etc/resolv.conf in chroot//etc/resolv.conf Warning: cannot open chroot//etc/resolv.conf, file not copied Warning: /etc/resolv.conf not initialized Chrooting into chroot/ Warning: /var/lock not mounted Mounting tmpfs on /var/tmp Warning: cannot mount tmpfs on top of /var/log Warning: cannot find /var/run/utmp Remounting /proc and /proc/sys filesystems Remounting /sys directory Warning: failed to unmount /sys Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/kernel/hotplug Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/sched_debug Disable /proc/timer_list Disable /proc/timer_stats Disable /proc/kcore Disable /proc/kallsyms Disable /dev/port Warning: whitelist feature is disabled in chroot Build secondary 32-bit filter sbox run: /usr/local/lib/firejail/fseccomp secondary 32 /run/firejail/mnt/seccomp.i386 (null) Dropping all capabilities Username root, no supplementary groups execl: No such file or directory Error: failed to run /usr/local/lib/firejail/fseccomp Error: cannot establish communication with the parent, exiting... ``` I'm using version 0.9.45 built from source, the binary is present /usr/local/lib/firejail/fseccomp and the related files too: ``` root@sandbox:~# tree /var/run/firejail/ /var/run/firejail/ ├── appimage ├── bandwidth ├── firejail.ro.dir ├── firejail.ro.file ├── mnt ├── name ├── network └── x11 ``` Please let me know what I'm doing wrong or if there's an issue. Cheers
gitea-mirror 2026-05-05 06:19:14 -06:00
gitea-mirror commented 2026-05-05 06:19:20 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Nov 22, 2016):

It got broken a few days ago, I put a fix in yesterday. Give it a new try.

<!-- gh-comment-id:262271468 --> @netblue30 commented on GitHub (Nov 22, 2016): It got broken a few days ago, I put a fix in yesterday. Give it a new try.
gitea-mirror commented 2026-05-05 06:19:22 -06:00
Author
Owner
Copy link

@maurorappa commented on GitHub (Nov 22, 2016):

I did:

root@sandbox:~#  firejail --noprofile --debug  --chroot=chroot/ ./uptime
Autoselecting /bin/bash as shell
Command name #uptime#
Enabling IPC namespace
Using the local network stack
Parent pid 2981, child pid 2982
The new log directory is /proc/2982/root/var/log
Host network configured
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Warning: cannot open /usr/local/lib/firejail/seccomp.i386, file not copied
Warning: cannot open /usr/local/lib/firejail/seccomp.amd64, file not copied
Warning: cannot open /usr/local/lib/firejail/seccomp, file not copied
Creating empty /run/firejail/mnt/seccomp.protocol file
Mounting /dev on chroot//dev
Updating /etc/resolv.conf in chroot//etc/resolv.conf
Warning: cannot open chroot//etc/resolv.conf, file not copied
Warning: /etc/resolv.conf not initialized
Chrooting into chroot/
Warning: /var/lock not mounted
Mounting tmpfs on /var/tmp
Warning: cannot mount tmpfs on top of /var/log
Warning: cannot find /var/run/utmp
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Warning: failed to unmount /sys
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/timer_stats
Disable /proc/kcore
Disable /proc/kallsyms
Disable /dev/port
Warning: whitelist feature is disabled in chroot
Error: cannot read protocol filter file
Error: cannot establish communication with the parent, exiting...

how can I solve it? :)

<!-- gh-comment-id:262281213 --> @maurorappa commented on GitHub (Nov 22, 2016): I did: ``` root@sandbox:~# firejail --noprofile --debug --chroot=chroot/ ./uptime Autoselecting /bin/bash as shell Command name #uptime# Enabling IPC namespace Using the local network stack Parent pid 2981, child pid 2982 The new log directory is /proc/2982/root/var/log Host network configured Initializing child process PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Warning: cannot open /usr/local/lib/firejail/seccomp.i386, file not copied Warning: cannot open /usr/local/lib/firejail/seccomp.amd64, file not copied Warning: cannot open /usr/local/lib/firejail/seccomp, file not copied Creating empty /run/firejail/mnt/seccomp.protocol file Mounting /dev on chroot//dev Updating /etc/resolv.conf in chroot//etc/resolv.conf Warning: cannot open chroot//etc/resolv.conf, file not copied Warning: /etc/resolv.conf not initialized Chrooting into chroot/ Warning: /var/lock not mounted Mounting tmpfs on /var/tmp Warning: cannot mount tmpfs on top of /var/log Warning: cannot find /var/run/utmp Remounting /proc and /proc/sys filesystems Remounting /sys directory Warning: failed to unmount /sys Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/kernel/hotplug Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/sched_debug Disable /proc/timer_list Disable /proc/timer_stats Disable /proc/kcore Disable /proc/kallsyms Disable /dev/port Warning: whitelist feature is disabled in chroot Error: cannot read protocol filter file Error: cannot establish communication with the parent, exiting... ``` how can I solve it? :)
gitea-mirror commented 2026-05-05 06:19:24 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Nov 22, 2016):

Two problems:

Warning: cannot open /usr/local/lib/firejail/seccomp.i386, file not copied

How did you compile and install it? Do ls in that directory, you should get:

$ ls /usr/local/lib/firejail/
faudit  firecfg.config  fseccomp    ftee           libtracelog.so  seccomp        seccomp.debug
fcopy   fnet            fshaper.sh  libconnect.so  libtrace.so     seccomp.amd64  seccomp.i386
<!-- gh-comment-id:262318396 --> @netblue30 commented on GitHub (Nov 22, 2016): Two problems: > Warning: cannot open /usr/local/lib/firejail/seccomp.i386, file not copied How did you compile and install it? Do ls in that directory, you should get: ````` $ ls /usr/local/lib/firejail/ faudit firecfg.config fseccomp ftee libtracelog.so seccomp seccomp.debug fcopy fnet fshaper.sh libconnect.so libtrace.so seccomp.amd64 seccomp.i386 `````
gitea-mirror commented 2026-05-05 06:19:27 -06:00
Author
Owner
Copy link

@netblue30 commented on GitHub (Nov 22, 2016):

I seem to be getting the same thing as you if I delete /usr/local/lib/firejail directory:

# rm -fr /usr/local/lib/firejail
root@debian:/home/netblue/work/github/firejail# firejail --chroot=/tmp/chroot
Warning: default profile disabled by --chroot option
Parent pid 24784, child pid 24785
The new log directory is /proc/24785/root/var/log
Warning: cannot open /usr/local/lib/firejail/seccomp.i386, file not copied
Warning: cannot open /usr/local/lib/firejail/seccomp.amd64, file not copied
Warning: cannot open /usr/local/lib/firejail/seccomp, file not copied
Warning: cannot find /var/run/utmp
Warning: failed to unmount /sys
Warning: whitelist feature is disabled in chroot
Error: cannot read protocol filter file
Error: cannot establish communication with the parent, exiting...

I'll mark it as an enhancement: check $PREFIX/lib/firejail directory and stop the sandbox if is not present. Somehow, you don't have the software installed properly.

<!-- gh-comment-id:262319515 --> @netblue30 commented on GitHub (Nov 22, 2016): I seem to be getting the same thing as you if I delete /usr/local/lib/firejail directory: ````` # rm -fr /usr/local/lib/firejail root@debian:/home/netblue/work/github/firejail# firejail --chroot=/tmp/chroot Warning: default profile disabled by --chroot option Parent pid 24784, child pid 24785 The new log directory is /proc/24785/root/var/log Warning: cannot open /usr/local/lib/firejail/seccomp.i386, file not copied Warning: cannot open /usr/local/lib/firejail/seccomp.amd64, file not copied Warning: cannot open /usr/local/lib/firejail/seccomp, file not copied Warning: cannot find /var/run/utmp Warning: failed to unmount /sys Warning: whitelist feature is disabled in chroot Error: cannot read protocol filter file Error: cannot establish communication with the parent, exiting... ````` I'll mark it as an enhancement: check $PREFIX/lib/firejail directory and stop the sandbox if is not present. Somehow, you don't have the software installed properly.
gitea-mirror commented 2026-05-05 06:19:30 -06:00
Author
Owner
Copy link

@maurorappa commented on GitHub (Nov 22, 2016):

thanks for the quick reply!
I simply did configure make and make install again, now I have

root@sandbox:~# ls /usr/local/lib/firejail/
faudit  firecfg.config  fseccomp    ftee           libtracelog.so  seccomp        seccomp.debug
fcopy   fnet            fshaper.sh  libconnect.so  libtrace.so     seccomp.amd64  seccomp.i386

but it seems it didn't solve my issue:


root@sandbox:~# firejail --noprofile --debug  --chroot=chroot/ ./uptime
Autoselecting /bin/bash as shell
Command name #uptime#
Enabling IPC namespace
Using the local network stack
Parent pid 5654, child pid 5655
The new log directory is /proc/5655/root/var/log
Host network configured
Initializing child process
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp.protocol file
Mounting /dev on chroot//dev
Updating /etc/resolv.conf in chroot//etc/resolv.conf
Warning: cannot open chroot//etc/resolv.conf, file not copied
Warning: /etc/resolv.conf not initialized
Chrooting into chroot/
Warning: /var/lock not mounted
Mounting tmpfs on /var/tmp
Warning: cannot mount tmpfs on top of /var/log
Warning: cannot find /var/run/utmp
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Warning: failed to unmount /sys
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/kernel/hotplug
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/timer_stats
Disable /proc/kcore
Disable /proc/kallsyms
Disable /dev/port
Warning: whitelist feature is disabled in chroot
Error: cannot read protocol filter file
Error: cannot establish communication with the parent, exiting...

any help is appreciated :)

<!-- gh-comment-id:262352036 --> @maurorappa commented on GitHub (Nov 22, 2016): thanks for the quick reply! I simply did `configure` `make` and `make install` again, now I have ``` root@sandbox:~# ls /usr/local/lib/firejail/ faudit firecfg.config fseccomp ftee libtracelog.so seccomp seccomp.debug fcopy fnet fshaper.sh libconnect.so libtrace.so seccomp.amd64 seccomp.i386 ``` but it seems it didn't solve my issue: ``` root@sandbox:~# firejail --noprofile --debug --chroot=chroot/ ./uptime Autoselecting /bin/bash as shell Command name #uptime# Enabling IPC namespace Using the local network stack Parent pid 5654, child pid 5655 The new log directory is /proc/5655/root/var/log Host network configured Initializing child process PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp.protocol file Mounting /dev on chroot//dev Updating /etc/resolv.conf in chroot//etc/resolv.conf Warning: cannot open chroot//etc/resolv.conf, file not copied Warning: /etc/resolv.conf not initialized Chrooting into chroot/ Warning: /var/lock not mounted Mounting tmpfs on /var/tmp Warning: cannot mount tmpfs on top of /var/log Warning: cannot find /var/run/utmp Remounting /proc and /proc/sys filesystems Remounting /sys directory Warning: failed to unmount /sys Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/kernel/hotplug Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/sched_debug Disable /proc/timer_list Disable /proc/timer_stats Disable /proc/kcore Disable /proc/kallsyms Disable /dev/port Warning: whitelist feature is disabled in chroot Error: cannot read protocol filter file Error: cannot establish communication with the parent, exiting... ``` any help is appreciated :)
gitea-mirror commented 2026-05-05 06:19:33 -06:00
Author
Owner
Copy link

@chiraag-nataraj commented on GitHub (Aug 20, 2018):

@maurorappa Is this still an issue?

<!-- gh-comment-id:414361090 --> @chiraag-nataraj commented on GitHub (Aug 20, 2018): @maurorappa Is this still an issue?
gitea-mirror commented 2026-05-05 06:19:35 -06:00
Author
Owner
Copy link

@chiraag-nataraj commented on GitHub (May 23, 2019):

@maurorappa I'm going to close this for now due to inactivity, but please feel free to re-open if you still have this issue.

<!-- gh-comment-id:495140013 --> @chiraag-nataraj commented on GitHub (May 23, 2019): @maurorappa I'm going to close this for now due to inactivity, but please feel free to re-open if you still have this issue.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
master
serialize_remounts_v2
landlock_v4
landlock
release-0.9.64
release-0.9.62
gitlab_ci
LTSbase
fred_ctests
docs
0.9.80
0.9.80-rc1
0.9.78
0.9.76
0.9.76-rc4
0.9.76-rc3
0.9.76-rc2
0.9.76-rc1
0.9.74
landlock-split
0.9.72
0.9.72rc1
0.9.70
0.9.68
0.9.68rc1
0.9.66
0.9.66rc1
0.9.64.4
0.9.64.2
0.9.64
0.9.64rc1
0.9.62.4
0.9.62.2
0.9.62
0.9.56.2-LTS
0.9.60
0.9.60-rc1
0.9.58.2
0.9.58
0.9.58-rc1
0.9.56-LTS-release
0.9.56-LTS
0.9.56
0.9.56-rc1
0.9.54
0.9.54-rc2
0.9.54-rc1
0.9.52
0.9.38.12
0.9.50
0.9.50-rc1
0.9.48
0.9.46
0.9.46-rc1
0.9.44.10
0.9.44.8
0.9.44.6
0.9.38.10
0.9.44.4
0.9.38.8
0.9.44.2
0.9.44
0.9.44-rc1
0.9.38.4
0.9.42
0.9.42-rc2
0.9.38.2
0.9.42-rc1
disable-globalcfg
0.9.40
0.9.40-rc1
0.9.38
0.9.38-rc1
0.9.36
0.9.36-rc1
0.9.34
0.9.34-rc1
0.9.32
0.9.32-rc1
0.9.30
0.9.30-rc1
Labels
Clear labels   
LTS merge

   
LTS merge

   
bug

   
bug

   
converted-to-discussion

   
doc-todo

   
documentation

   
duplicate

   
enhancement

   
file-transfer

   
firecfg

   
firejail-in-firejail

   
firetools

   
graphics

   
help wanted

   
information_old

   
installation

   
invalid

   
modif

   
moved

   
needinfo

   
networking

   
notabug

   
notourbug

   
old-version

   
overlayfs

   
packaging

   
profile-request

   
pull-request

Mirrored from GitHub Pull Request

  
question

   
question_old

   
removal

   
runtime-permissions

   
sandbox-ipc

   
security

   
stale

   
wiki

   
wiki

   
wontfix

   
wordpress

   
workaround
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#635
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?