firejail

Note: The RELNOTES file was updated on January 3, 2026; the code archives below preserve the previous RELNOTES version.

firejail (0.9.78) baseline; urgency=low

• feature: add arg-max-count / arg-max-len to firejail.config (#4633 #6878)
• feature: add env-max-count / env-max-len to firejail.config (#3678 #6951)
• feature: add --xephyr-extra-params= command (#6952)
• feature: replace...

firejail (0.9.76) baseline; urgency=low

• feature: use globbing in hardcoded numbered /dev paths (#2723 #6704)
• feature: add warn command (#6710)
• feature: use non-blocking flock calls (#6761)
• modif: block TPM devices & turn notpm command into keep-dev-tpm (#6698)
• modif: improve error messages in mountinfo.c (#6711)
• modif: use "Error:" in errExit message (#6716)
• modi...

firejail (0.9.74) baseline; urgency=low

• security: fix sscanf rv checks (CodeQL) (#6184)
• feature: private-etc rework: improve handling of /etc/resolv.conf and add private-etc groups (#6400 #5518 #5608 #5609 #5629 #5638 #5641 #5642 #5643 #5650 #5681 #5737 #5844 #5989 #6016 #6104 #5655 #6435 #6514 #6515)
• feature: Add "keep-shell-rc" command and option (#1127 #5634)
• featu...

• feature: On failing to remount a fuse filesystem, give warning instead of erroring out (#5240 #5242)
  • feature: Update syscall tables and seccomp groups (#5188)
  • feature: improve force-nonewprivs security guarantees (#5217 #5271)
  • feature: add support for restricting the creation of Linux namespaces (--restrict-namespaces, --restrict-namespaces=), implemented as a seccomp...

• security: CVE-2022-31214 - root escalation in --join logic Reported by Matthias Gerstner, working exploit code was provided to our development team. In the same time frame, the problem was independently reported by Birk Blechschmidt. Full working exploit code was also provided.
  • feature: enable shell tab completion with --tab (#4936)
  • feature: disable user profiles at c...