github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #1447] Feature: allow any syscall to be blacklisted with aid of LD_PRELOAD library #974

New issue

Closed

opened 2026-05-05 07:14:39 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 07:14:39 -06:00

Owner

Originally created by @topimiettinen on GitHub (Aug 9, 2017).
Original GitHub issue: https://github.com/netblue30/firejail/issues/1447

Currently Firejail can't let seccomp filters block certain system calls because they are used later by Firejail itself after installing the seccomp filter. But Firejail could install a LD_PRELOADed shared library (like libtrace and libtracelog), which would install a seccomp filter for these remaining system calls, in case they are specified by seccomp.drop etc. For example, blocking execve would be very useful. The protection given with this late filter would not be as tight as with the filter installed earlier because some shared libraries may have a chance to run before even a library constructor is run, but the main application would still be fully controlled.

Originally created by @topimiettinen on GitHub (Aug 9, 2017). Original GitHub issue: https://github.com/netblue30/firejail/issues/1447 Currently Firejail can't let seccomp filters block certain system calls because they are used later by Firejail itself after installing the seccomp filter. But Firejail could install a LD_PRELOADed shared library (like libtrace and libtracelog), which would install a seccomp filter for these remaining system calls, in case they are specified by seccomp.drop etc. For example, blocking execve would be very useful. The protection given with this late filter would not be as tight as with the filter installed earlier because some shared libraries may have a chance to run before even a library constructor is run, but the main application would still be fully controlled.

gitea-mirror

2026-05-05 07:14:39 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 07:14:43 -06:00

Author

Owner

@netblue30 commented on GitHub (Aug 10, 2017):

This would be very cool, give it a try!

@netblue30 commented on GitHub (Aug 10, 2017): This would be very cool, give it a try!

gitea-mirror commented

2026-05-05 07:14:45 -06:00

Author

Owner

@Ferroin commented on GitHub (Aug 10, 2017):

On the note of exec calls specifically, you may find noexec helpful as a starting point.

@Ferroin commented on GitHub (Aug 10, 2017): On the note of exec calls specifically, you may find [noexec](http://noexec.sourceforge.net/) helpful as a starting point.

gitea-mirror commented

2026-05-05 07:14:47 -06:00

Author

Owner

@topimiettinen commented on GitHub (Aug 13, 2017):

@Ferroin: noexec library just overrides libc symbols. That works to a degree, but it can be circumvented. Blocking with a seccomp filter is much more robust.

@topimiettinen commented on GitHub (Aug 13, 2017): @Ferroin: noexec library just overrides libc symbols. That works to a degree, but it can be circumvented. Blocking with a seccomp filter is much more robust.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#974

No description provided.

Rows
Columns