github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1091] A question about noroot and seccomp with >3.5 kernels #746

New issue

Closed

opened 2026-05-05 06:33:39 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 06:33:39 -06:00

Owner

Originally created by @acrobat1 on GitHub (Feb 5, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1091

I've realized that the noroot option, according to the man page

requires a Linux kernel version 3.8 or newer

and also that the seccomp option , according to this article only works with kernel versions above 3.5

If you specify the additional --seccomp option, Firejail prevents programs in the sandbox from performing a couple of security-critical actions. Among other things, they are not allowed to load kernel modules, manage swap memory, run programs with root privileges (SUID), or restart the system. If an application tries to call one of these system functions, the kernel immediately terminates it. This totally useful safety net is only available as of the Linux kernel version 3.5, however.

Does this mean that with older kernels, such as found in Debian Stable (currently running a 3.16 kernel) , the noroot and seccomp options found in almost any profiles are in fact ignored - and therefore Firejail is running in a less effective way?

If so, should we consider installing a newer kernel from backports (4.8 is available) to really take advantage of using Firejail?

Originally created by @acrobat1 on GitHub (Feb 5, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1091 I've realized that the noroot option, according to the man page >requires a Linux kernel version 3.8 or newer and also that the seccomp option , according to [this article](http://www.linux-magazine.com/Issues/2015/173/Firejail) only works with kernel versions above 3.5 >If you specify the additional --seccomp option, Firejail prevents programs in the sandbox from performing a couple of security-critical actions. Among other things, they are not allowed to load kernel modules, manage swap memory, run programs with root privileges (SUID), or restart the system. If an application tries to call one of these system functions, the kernel immediately terminates it. This totally useful safety net is only available as of the Linux kernel version 3.5, however. Does this mean that with older kernels, such as found in Debian Stable (currently running a 3.16 kernel) , the **noroot** and **seccomp** options found in almost any profiles are in fact ignored - and therefore Firejail is running in a less effective way? If so, should we consider installing a newer kernel from backports (4.8 is available) to really take advantage of using Firejail?

gitea-mirror

2026-05-05 06:33:39 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 06:33:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 5, 2017):

If you have the 3.16 kernel both seccomp and noroot will work. If you have a 3.2 kernel, they are ignored. The only option that doesn't work on 3.16 kernel is overlayfs - it came in 3.18.

From a security perspective, the most critical feature is seccomp. You want to stay with a kernel 3.5 or newer.

@netblue30 commented on GitHub (Feb 5, 2017): If you have the 3.16 kernel both seccomp and noroot will work. If you have a 3.2 kernel, they are ignored. The only option that doesn't work on 3.16 kernel is overlayfs - it came in 3.18. From a security perspective, the most critical feature is seccomp. You want to stay with a kernel 3.5 or newer.

gitea-mirror commented

2026-05-05 06:33:51 -06:00

Author

Owner

@reinerh commented on GitHub (Feb 5, 2017):

@acrobat1 3.16 is newer than 3.5. :)

@reinerh commented on GitHub (Feb 5, 2017): @acrobat1 3.16 is newer than 3.5. :)

gitea-mirror commented

2026-05-05 06:33:55 -06:00

Author

Owner

@acrobat1 commented on GitHub (Feb 10, 2017):

It is... sorry for that...

And @netblue thanks anyways for the explanation.

@acrobat1 commented on GitHub (Feb 10, 2017): It is... sorry for that... And @netblue thanks anyways for the explanation.

gitea-mirror commented

2026-05-05 06:33:56 -06:00

Author

Owner

@netblue30 commented on GitHub (Feb 11, 2017):

No problem.

@netblue30 commented on GitHub (Feb 11, 2017): No problem.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#746

No description provided.

Rows
Columns