#7058·firejail

io_uring filtering

Author: ssokolowCreated Feb 10, 2026Updated Sep 17, 2026
Labelsenhancement

Is your feature request related to a problem? Please describe.

To quote Jens Axboe's submission to enable BPF filtering of io_uring in Linux 7.0:

seccomp and io_uring don't play along nicely, as most of the interesting data to filter on resides somewhat out-of-band, in the submission queue ring.

As a result, things like containers and systemd that apply seccomp filters, can't filter io_uring operations.

That leaves them with just one choice if filtering is critical - filter the actual io_uring_setup(2) system call to simply disallow io_uring. That's rather unfortunate, and has limited us because of it

-- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=591beb0e3a03258ef9c01893a5209845799a7c33

Describe the solution you'd like

Support applying BPF filters to io_uring to complement seccomp filters.

Describe alternatives you've considered

Nothing. I trust Jens when he says that this is motivated by a lack of alternatives other than blocking access to io_uring.

Environment

This should be irrelevant for this feature request, but since you asked for it...

  • Name/version/arch of the Linux kernel (uname -srm): Linux 6.8.0-88-generic x86_64
  • Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Ubuntu 24.04.4 LTS (from lsb_release -a)
  • Version of Firejail (firejail --version): firejail version 0.9.72
  • If you use a development version of firejail, also the commit from which it: was compiled (git rev-parse HEAD):