io_uring filtering
Is your feature request related to a problem? Please describe.
To quote Jens Axboe's submission to enable BPF filtering of io_uring in Linux 7.0:
seccomp and io_uring don't play along nicely, as most of the interesting data to filter on resides somewhat out-of-band, in the submission queue ring.
As a result, things like containers and systemd that apply seccomp filters, can't filter io_uring operations.
That leaves them with just one choice if filtering is critical - filter the actual io_uring_setup(2) system call to simply disallow io_uring. That's rather unfortunate, and has limited us because of it
Describe the solution you'd like
Support applying BPF filters to io_uring to complement seccomp filters.
Describe alternatives you've considered
Nothing. I trust Jens when he says that this is motivated by a lack of alternatives other than blocking access to io_uring.
Environment
This should be irrelevant for this feature request, but since you asked for it...
- Name/version/arch of the Linux kernel (
uname -srm): Linux 6.8.0-88-generic x86_64 - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux"): Ubuntu 24.04.4 LTS (from
lsb_release -a) - Version of Firejail (
firejail --version): firejail version 0.9.72 If you use a development version of firejail, also the commit from which it: was compiled (git rev-parse HEAD):
Source: netblue30/firejail