github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1324] seccomp.keep fails on Arch #906

New issue

Closed

opened 2026-05-05 07:07:10 -06:00 by gitea-mirror · 4 comments

gitea-mirror commented

2026-05-05 07:07:10 -06:00

Owner

Originally created by @tsankuanglee on GitHub (May 31, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1324

I'm getting this on Arch. I wonder whether it's an Arch only problem.

$ uname -a
Linux localhost 4.11.3-1-ARCH #1 SMP PREEMPT Sun May 28 10:40:17 CEST 2017 x86_64 GNU/Linux
$ cat test.profile
seccomp.keep poll
$ firejail --profile=test.profile
Reading profile test.profile
Parent pid 13292, child pid 13293
Error: proc 13292 cannot sync with peer: unexpected EOF
Peer 13293 unexpectedly killed (Bad system call)

Originally created by @tsankuanglee on GitHub (May 31, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1324 I'm getting this on Arch. I wonder whether it's an Arch only problem. ``` $ uname -a Linux localhost 4.11.3-1-ARCH #1 SMP PREEMPT Sun May 28 10:40:17 CEST 2017 x86_64 GNU/Linux $ cat test.profile seccomp.keep poll $ firejail --profile=test.profile Reading profile test.profile Parent pid 13292, child pid 13293 Error: proc 13292 cannot sync with peer: unexpected EOF Peer 13293 unexpectedly killed (Bad system call) ```

gitea-mirror

2026-05-05 07:07:10 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 07:07:19 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 1, 2017):

seccomp.keep lines are usually very large. A simple /bin/bash session will get you around 50 syscalls, while a regular GUI program is over 100 - you have an example here: https://github.com/netblue30/firejail/issues/1323

Also, read this document: https://firejail.wordpress.com/documentation-2/seccomp-guide/. Is not as up to date as it should be, but it will get you started.

@netblue30 commented on GitHub (Jun 1, 2017): seccomp.keep lines are usually very large. A simple /bin/bash session will get you around 50 syscalls, while a regular GUI program is over 100 - you have an example here: https://github.com/netblue30/firejail/issues/1323 Also, read this document: https://firejail.wordpress.com/documentation-2/seccomp-guide/. Is not as up to date as it should be, but it will get you started.

gitea-mirror commented

2026-05-05 07:07:22 -06:00

Author

Owner

@tsankuanglee commented on GitHub (Jun 5, 2017):

Thanks a lot for the link. I had actually read that post before posting. The problem here is that it fails on Arch regardless what's given to seccomp.keep .

@tsankuanglee commented on GitHub (Jun 5, 2017): Thanks a lot for the link. I had actually read that post before posting. The problem here is that it fails on Arch regardless what's given to seccomp.keep .

gitea-mirror commented

2026-05-05 07:07:24 -06:00

Author

Owner

@netblue30 commented on GitHub (Jun 5, 2017):

Run a sandbox and use --debug to print out the debug messages, and put the output here.

@netblue30 commented on GitHub (Jun 5, 2017): Run a sandbox and use --debug to print out the debug messages, and put the output here.

gitea-mirror commented

2026-05-05 07:07:29 -06:00

Author

Owner

@tsankuanglee commented on GitHub (Jun 22, 2017):

Sorry for the late reply. Here's the output. (environment is the same)

$ uname -a
Linux quartet 4.11.5-1-ARCH #1 SMP PREEMPT Wed Jun 14 16:19:27 CEST 2017 x86_64 GNU/Linux
$ cat test.profile
seccomp.keep poll
$ firejail --profile=test.profile --debug
Reading profile test.profile
Autoselecting /bin/bash as shell
Command name #/bin/bash#
DISPLAY=:1.0 parsed as 1
Using the local network stack
Parent pid 19647, child pid 19648
Initializing child process
Host network configured
PID namespace installed
Mounting tmpfs on /run/firejail/mnt directory
Creating empty /run/firejail/mnt/seccomp.protocol file
Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var
Mounting tmpfs on /var/lock
Mounting tmpfs on /var/tmp
Mounting tmpfs on /var/log
Mounting tmpfs on /var/lib/nginx
Create the new utmp file
Mount the new utmp file
Cleaning /home directory
Sanitizing /etc/passwd, UID_MIN 1000
Sanitizing /etc/group, GID_MIN 1000
Disable /home/me/.config/firejail
Disable /run/firejail/network                                                                                                                                                                                                                                                  
Disable /run/firejail/bandwidth                                                                                                                                                                                                                                                
Disable /run/firejail/name                                                                                                                                                                                                                                                     
Disable /run/firejail/x11
Remounting /proc and /proc/sys filesystems
Remounting /sys directory
Disable /sys/firmware
Disable /sys/hypervisor
Disable /sys/module
Disable /sys/power
Disable /sys/kernel/debug
Disable /sys/kernel/vmcoreinfo
Disable /proc/sys/fs/binfmt_misc
Disable /proc/sys/kernel/core_pattern
Disable /proc/sys/kernel/modprobe
Disable /proc/sysrq-trigger
Disable /proc/sys/vm/panic_on_oom
Disable /proc/irq
Disable /proc/bus
Disable /proc/config.gz
Disable /proc/sched_debug
Disable /proc/timer_list
Disable /proc/kcore
Disable /proc/kallsyms
Disable /usr/lib/modules (requested /lib/modules)
Disable /boot
Disable /dev/port
Disable /dev/kmsg
Disable /proc/kmsg
Disable /sys/fs
Current directory: /home/me/jails
DISPLAY=:1.0 parsed as 1
Masking all X11 sockets except /tmp/.X11-unix/X1
Build drop seccomp filter
sbox run: /usr/lib/firejail/fseccomp keep /run/firejail/mnt/seccomp poll (null)
sbox file descriptors:
total 0
lrwx------ 1 me me 64 Jun 22 01:01 0 -> /dev/null
lrwx------ 1 me me 64 Jun 22 01:01 1 -> /dev/pts/1
lrwx------ 1 me me 64 Jun 22 01:01 2 -> /dev/pts/1
lr-x------ 1 me me 64 Jun 22 01:01 3 -> /proc/3/fd
Dropping all capabilities
Username me, no supplementary groups
seccomp filter configured
sbox run: /usr/lib/firejail/fseccomp print /run/firejail/mnt/seccomp (null)
sbox file descriptors:
total 0
lrwx------ 1 me me 64 Jun 22 01:01 0 -> /dev/null
lrwx------ 1 me me 64 Jun 22 01:01 1 -> /dev/pts/1
lrwx------ 1 me me 64 Jun 22 01:01 2 -> /dev/pts/1
lr-x------ 1 me me 64 Jun 22 01:01 3 -> /proc/5/fd
SECCOMP Filter:
  VALIDATE_ARCHITECTURE
  EXAMINE_SYSCAL
  UNKNOWN ENTRY!!!
  UNKNOWN ENTRY!!!
  UNKNOWN ENTRY!!!
  WHITELIST 105 setuid
  WHITELIST 106 setgid
  WHITELIST 116 setgroups
  WHITELIST 32 dup
  WHITELIST 157 prctl
  WHITELIST 7 poll
  KILL_PROCESS
configuring 20 seccomp entries from /run/firejail/mnt/seccomp
Error: proc 19647 cannot sync with peer: unexpected EOF
Peer 19648 unexpectedly killed (Bad system call)

@tsankuanglee commented on GitHub (Jun 22, 2017): Sorry for the late reply. Here's the output. (environment is the same) ``` $ uname -a Linux quartet 4.11.5-1-ARCH #1 SMP PREEMPT Wed Jun 14 16:19:27 CEST 2017 x86_64 GNU/Linux $ cat test.profile seccomp.keep poll $ firejail --profile=test.profile --debug Reading profile test.profile Autoselecting /bin/bash as shell Command name #/bin/bash# DISPLAY=:1.0 parsed as 1 Using the local network stack Parent pid 19647, child pid 19648 Initializing child process Host network configured PID namespace installed Mounting tmpfs on /run/firejail/mnt directory Creating empty /run/firejail/mnt/seccomp.protocol file Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr, /etc, /var Mounting tmpfs on /var/lock Mounting tmpfs on /var/tmp Mounting tmpfs on /var/log Mounting tmpfs on /var/lib/nginx Create the new utmp file Mount the new utmp file Cleaning /home directory Sanitizing /etc/passwd, UID_MIN 1000 Sanitizing /etc/group, GID_MIN 1000 Disable /home/me/.config/firejail Disable /run/firejail/network Disable /run/firejail/bandwidth Disable /run/firejail/name Disable /run/firejail/x11 Remounting /proc and /proc/sys filesystems Remounting /sys directory Disable /sys/firmware Disable /sys/hypervisor Disable /sys/module Disable /sys/power Disable /sys/kernel/debug Disable /sys/kernel/vmcoreinfo Disable /proc/sys/fs/binfmt_misc Disable /proc/sys/kernel/core_pattern Disable /proc/sys/kernel/modprobe Disable /proc/sysrq-trigger Disable /proc/sys/vm/panic_on_oom Disable /proc/irq Disable /proc/bus Disable /proc/config.gz Disable /proc/sched_debug Disable /proc/timer_list Disable /proc/kcore Disable /proc/kallsyms Disable /usr/lib/modules (requested /lib/modules) Disable /boot Disable /dev/port Disable /dev/kmsg Disable /proc/kmsg Disable /sys/fs Current directory: /home/me/jails DISPLAY=:1.0 parsed as 1 Masking all X11 sockets except /tmp/.X11-unix/X1 Build drop seccomp filter sbox run: /usr/lib/firejail/fseccomp keep /run/firejail/mnt/seccomp poll (null) sbox file descriptors: total 0 lrwx------ 1 me me 64 Jun 22 01:01 0 -> /dev/null lrwx------ 1 me me 64 Jun 22 01:01 1 -> /dev/pts/1 lrwx------ 1 me me 64 Jun 22 01:01 2 -> /dev/pts/1 lr-x------ 1 me me 64 Jun 22 01:01 3 -> /proc/3/fd Dropping all capabilities Username me, no supplementary groups seccomp filter configured sbox run: /usr/lib/firejail/fseccomp print /run/firejail/mnt/seccomp (null) sbox file descriptors: total 0 lrwx------ 1 me me 64 Jun 22 01:01 0 -> /dev/null lrwx------ 1 me me 64 Jun 22 01:01 1 -> /dev/pts/1 lrwx------ 1 me me 64 Jun 22 01:01 2 -> /dev/pts/1 lr-x------ 1 me me 64 Jun 22 01:01 3 -> /proc/5/fd SECCOMP Filter: VALIDATE_ARCHITECTURE EXAMINE_SYSCAL UNKNOWN ENTRY!!! UNKNOWN ENTRY!!! UNKNOWN ENTRY!!! WHITELIST 105 setuid WHITELIST 106 setgid WHITELIST 116 setgroups WHITELIST 32 dup WHITELIST 157 prctl WHITELIST 7 poll KILL_PROCESS configuring 20 seccomp entries from /run/firejail/mnt/seccomp Error: proc 19647 cannot sync with peer: unexpected EOF Peer 19648 unexpectedly killed (Bad system call) ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#906

No description provided.

Rows
Columns