Release 0.9.70 discussion

[kmk3]

Release links:

• Project board: https://github.com/users/netblue30/projects/3
• GitHub Release: https://github.com/netblue30/firejail/releases/tag/0.9.70

Discussion for the previous release:

• Release 0.9.68 discussion #4770

Discussion for the next release:

• Release 0.9.72 discussion #5192

---

From commit e8cb03c ("I am preparing a point release for next week, fixes and
small number of new features. Check in everything you have out.", 2022-06-03)
by netblue30:

I am preparing a point release for next week

When exactly is the intended release date?

I'd like to fix an issue caused by #5142 and to finish the RELNOTES beforehand.

Relates to #5174.

[netblue30]

Sure, put all the fixes in - release sometime this week!

[rusty-snake]

Tracking this J4F

• Debian bullseye (CVE-2022-31214 backported)
• Ubuntu 20.04 LTS jammy
• Fedora 36
• OpenSUSE Leap 15.3
• OpenSUSE Tumbleweed (CVE-2022-31214 backported 2022-06-09)
• ArchLinux
• Manjaro

2022-06-09: Firejail 0.9.70 released
2022-06-11: Create post and add ArchLinux
2022-06-15: Add Manjaro
2022-06-18: Add OpenSUSE Tumbleweed CVE-2022-31214 backport
2022-07-09: Debian has backported CVE-2022-31214 in the mean time

[EdiDD]

[rusty-snake]

• System-wide: You can write to /proc/sys/kernel/seccomp/actions_logged but you likely don't want.
• System-wide: Maybe there are some other configuration options?
• Per-profile: You can allow the blocked syscall-calls but cosmetic reasons are bad reasons for weaking the sandbox.
• Revert+Compile
• Good way: none

What do you (all) think about something like

int seccomp_load(struct sock_fprog *prog) {
#ifdef SECCOMP_FILTER_FLAG_LOG
    if (arg_debug)
        return syscall(SYS_seccomp, SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, prog)
#endif
    return prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, prog)
}

[kmk3]

@EdiDD on Jun 14:

There are many log entries like: audit: SECCOMP ... and kernel: audit: ... in journal probably because of: * feature: always log seccomp errors (#5110) Is there a way to disable this or make these messages silently
ignored ?

This discussion is about organizing the release in general; to report a
bug or request a feature, please use
https://github.com/netblue30/firejail/issues/new/choose.

Creating a specific issue doesn't add noise and ensures that the matter in
question is properly tracked.