{"action":"created","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/730","repository_url":"https://api.github.com/repos/netblue30/firejail","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/730/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/730/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/730/events","html_url":"https://github.com/netblue30/firejail/issues/730","id":171930208,"number":730,"title":"Wishlist: easier way to allow additional system calls","user":{"login":"lheckemann","id":341954,"avatar_url":"https://avatars.githubusercontent.com/u/341954?v=3","gravatar_id":"","url":"https://api.github.com/users/lheckemann","html_url":"https://github.com/lheckemann","followers_url":"https://api.github.com/users/lheckemann/followers","following_url":"https://api.github.com/users/lheckemann/following{/other_user}","gists_url":"https://api.github.com/users/lheckemann/gists{/gist_id}","starred_url":"https://api.github.com/users/lheckemann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lheckemann/subscriptions","organizations_url":"https://api.github.com/users/lheckemann/orgs","repos_url":"https://api.github.com/users/lheckemann/repos","events_url":"https://api.github.com/users/lheckemann/events{/privacy}","received_events_url":"https://api.github.com/users/lheckemann/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/netblue30/firejail/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2016-08-18T15:29:56Z","updated_at":"2016-08-22T11:24:21Z","closed_at":null,"body":"For debugging software within jails, I like to be able to use tools like strace and gdb, which use the `ptrace` system call. However, I currently don't know of a way of allowing ptrace while keeping seccomp enabled without copying the default list of blocked system calls and removing ptrace, which makes for extremely unwieldy command lines. Something like `--seccomp.blacklist=!ptrace` or `--seccomp.allow=ptrace` would be nice (as opposed to `--seccomp.keep=ptrace` which seems to allow nothing but ptrace...).\r\n\r\nOr would it make more sense to use gdb on firejail and skip ahead to the `exec` system call when doing this?"},"comment":{"url":"https://api.github.com/repos/netblue30/firejail/issues/comments/241384799","html_url":"https://github.com/netblue30/firejail/issues/730#issuecomment-241384799","issue_url":"https://api.github.com/repos/netblue30/firejail/issues/730","id":241384799,"user":{"login":"netblue30","id":13711990,"avatar_url":"https://avatars.githubusercontent.com/u/13711990?v=3","gravatar_id":"","url":"https://api.github.com/users/netblue30","html_url":"https://github.com/netblue30","followers_url":"https://api.github.com/users/netblue30/followers","following_url":"https://api.github.com/users/netblue30/following{/other_user}","gists_url":"https://api.github.com/users/netblue30/gists{/gist_id}","starred_url":"https://api.github.com/users/netblue30/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/netblue30/subscriptions","organizations_url":"https://api.github.com/users/netblue30/orgs","repos_url":"https://api.github.com/users/netblue30/repos","events_url":"https://api.github.com/users/netblue30/events{/privacy}","received_events_url":"https://api.github.com/users/netblue30/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T11:24:21Z","updated_at":"2016-08-22T11:24:21Z","body":"> Wouldn't it be better to have a more generic option like --seccomp.add=ptrace so that we can make use of the standard blacklist, unblocking individual calls?\r\n\r\nProbably, but it will complicate the code - we are still SUID, so we need to keep it as simple as possible.\r\nOK, it will be --allow-debuggers "}}
{"actor":{"display_login":"netblue30"}}