Flood of seccomp audit log entries

[EdiDD]

There are many log entries like: audit: SECCOMP ... and kernel: audit: ... in journal probably because of (firejail 0.9.70):

• Log blocked syscall #5110

Is there a way to disable this or make these messages silently ignored ?

[netblue30]

Bug! I have it on my computer so far for whois, transmission, and Tor browser. Log example:

Jun 17 07:50:36 debian kernel: [ 4566.037606] audit: type=1326 audit(1655466636.900:143): auid=1000 uid=1000 gid=1000 ses=2 subj==firejail-default (enforce) pid=7841 comm=517420626561726572207468726561 exe="/usr/bin/transmission-qt" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f83e851f477 code=0x50000

Syscall 41 is "socket" (you can get the name by running "firejail --debug-syscalls"). In the profile I had to add "netlink" and "unix":

protocol unix,inet,inet6,netlink

Let's look in the logs for some more programs generating this kind of messages. Thanks for the bug!

[rusty-snake]

Previous discussion with suggested fix (and deleted comment 👎): #5181 (comment)
Please link to previous discussion if you move them.

---

-protocol inet,inet6
+protocol unix,inet,inet6,netlink

Do we really need to open all this?

[glitsj16]

Personally I tend to agree with @rusty-snake's comment above. It seems overkill to allow a potentially insecure netlink protocol 'just' to keep cleaner logs IMO. Perhaps a comment would be more appropriate instead?

Besides, users can always provide their own audit filtering via /etc/audit/rules.d for log sanity (audit tends to be very verbose by default). See this for some examples.

[netblue30]

Good point! I'll add instead a configuration flag in /etc/firejail/firejail.config to shut down the automatic logging, enabled by default. Will this work?

[glitsj16]

Good point! I'll add instead a configuration flag in /etc/firejail/firejail.config to shut down the automatic logging, enabled by default. Will this work?

It should work yes. I happen to have some extra time to test if you 'd like. Been doing some specific audit filtering lately in another context, that's why it occurred to me it might be a more appropriate way to deal with this. Once things settle down code-wise I can add a wiki item with some example rules for log sanitation. Thanks for looking into things!

[EdiDD]

Let's look in the logs for some more programs generating this kind of messages. Thanks for the bug!

It also occurs in curl

[netblue30]

I added "seccomp-log no" in /etc/firejail/firejail.config

c7e4c8e

[EdiDD]

Great! , waiting for a patched release. Thank you.

[glitsj16]

@netblue30 c7e4c8e works fine, thanks! Just one question: now this is 'fixed', can/should we revert 17774ad?

[netblue30]

Forgot about it. I've just revert it.

[kmk3]

@rusty-snake commented on May 20:

FTR: c0d314f

@SkewedZeppelin Can this be reverted as well?

[SkewedZeppelin]

@kmk3 did