Review: minijail 2026.05.18+git20261016.8787d1a-1
Package Information
| Description | utility to run a program inside a sandbox Minijail is a sandboxing and containment tool used in ChromeOS and Android. It launches a program with a restricted view of the system: it can enter new namespaces (mount, PID, network, user, IPC), pivot_root into a chosen filesystem, drop capabilities and switch user, and apply a seccomp-bpf filter that limits the program to a declared set of system calls. Minijail is intended for sandboxing known binaries, to reduce the damage a compromised service can do. It is not designed to safely run malicious code. This package contains the minijail0 command line tool. |
|---|---|
| Maintainer | Yunseong Kim <ysk@kzalloc.com> |
| Changed By | Yunseong Kim <ysk@kzalloc.com> |
| Sponsor | paulliu@debian.org |
| Distribution | unstable |
| Architecture | linux-any |
| VCS | git: https://salsa.debian.org/ysk/minijail.git (browse) |
| Closes | #860067 |
| Tracker | https://tracker.debian.org/pkg/minijail |
| Uploaded | 19 days ago |
New Package Report
.changes
| Distribution | unstable |
|---|---|
| Date | Mon, 24 Aug 2026 16:50:00 +0200 |
| Source | minijail |
| Version | 2026.05.18+git20261016.8787d1a-1 |
| Changed-By | Yunseong Kim <ysk@kzalloc.com> |
| Architecture | source amd64 |
Changelog
minijail (2026.05.18+git20261016.8787d1a-1) unstable; urgency=medium
.
* Initial release. (Closes: #860067)
* Package upstream Git snapshot 8787d1a.
* Update debian/gbp.conf to use separate Debian and upstream branches
and enable pristine-tar..dsc
| Component | main |
|---|---|
| Package-List | libminijail-dev deb libdevel optional arch=linux-any libminijail1 deb libs optional arch=linux-any minijail deb admin optional arch=linux-any |
| Section | libdevel |
| Priority | optional |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: minijail
Upstream-Contact: minijail@chromium.org
Source: https://chromium.googlesource.com/chromiumos/platform/minijail
Files: *
Copyright: 2011-2026 The ChromiumOS Authors
License: BSD-3-Clause
Files:
Android.bp
CleanSpec.mk
examples/drop_privs.cpp
test/libminijail_test.cpp
tools/Android.bp
Copyright:
2015-2019 The Android Open Source Project
License: Apache-2.0
Files: debian/*
Copyright: 2026 Yunseong Kim <ysk@kzalloc.com>
License: BSD-3-Clause
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 19 days ago.
Proposes a replacement debian/watch:
debian/watch in version 5 format
Report
DFSG NEW review for minijail version 2026.05.18+git20261016.8787d1a-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 2 minor
- debian/watch: old format (version 4)
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
The tree is entirely free: all upstream sources are BSD-3-Clause (The ChromiumOS Authors), with a small set of Android-origin files (Android.bp, CleanSpec.mk, examples/drop_privs.cpp, test/libminijail_test.cpp, tools/Android.bp) under Apache-2.0, and the Debian packaging under BSD-3-Clause by the maintainer. debian/copyright is DEP-5 machine-readable, is accurate, and every copyright holder found in the source is named. No non-free terms, no missing licences, no binary/blob files, and all generated code has its generator present.
Packaging
Clean and well-maintained packaging. Source format 3.0 (quilt), compat 13 with dh $@, hardening +all, correct binary split (minijail / libminijail1 / libminijail-dev) with Multi-Arch: same on the libraries, core dump/soname handling via a symbols file and a SONAME patch, proper Architecture (linux-any), Standard-Version 4.7.2 (current), and Vcs-* pointing at the maintainer's salsa repo. Four small, DEP-3-commented patches with sensible rationale. Test suite disabled with a comment (needs namespaces/seccomp in a build chroot), which is justified.
Issues
minor packaging 1. debian/watch is in the old version 4 format ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence:
version=4 - Problem: Version 5 is the current format of
debian/watch. - Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
minor packaging 2. uscan finds only upstream versions older than the packaged one ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence: upstream
2026.05.18, packaged2026.05.18+git20261016.8787d1a - Problem: The newest version uscan finds with
debian/watchis older than the version indebian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare. - Fix: Check where
debian/watchlooks and how it mangles versions.
Verified ◂
- Prescanned copyright-holder report: 118 files scanned; every holder found (The ChromiumOS Authors, The Android Open Source Project) is named in debian/copyright — no missing holder confirmed.
- All C/C++/headers/scripts carrying notices (2011-2022 The ChromiumOS Authors) fall under
Files: *BSD-3-Clause; all Android-licensed files (Android.bp, CleanSpec.mk, examples/drop_privs.cpp, test/libminijail_test.cpp, tools/Android.bp) carry the Apache-2.0 header and are listed in the Apache stanza of debian/copyright. - LICENSE and NOTICE at top level reproduce the BSD-3-Clause text ("Neither the name of Google LLC nor the names of its contributors" condition 3), matching the BSD-3-Clause paragraph in debian/copyright.
- linux-x86/libconstants.gen.c and libsyscalls.gen.c are generated at build time (marked
GENERATED BY MAKEFILE) from gen_constants.sh / gen_syscalls.sh and headers present in the tree; not built blobs shipped without source. - Rust crates (rust/minijail, rust/minijail-sys) and tools/*.py carry ChromiumOS Authors BSD notices, covered by
Files: *; // tools/testdata/arch_64.json and policy/conf data are covered by Files: * as upstream code. - debian/copyright: no Files-Excluded; Apache-2.0 text correctly pointed at /usr/share/common-licenses/Apache-2.0; BSD-3-Clause full text included.
- debian/rules: hardening=+all; dpkg-buildflags CFLAGS/CPPFLAGS/LDFLAGS pass through to common.mk which appends (CFLAGS += ...), so hardening flags are not clobbered.
- 0001-add-soname patch sets
-Wl,-soname,libminijail.so.1; symbols file taglibminijail.so.1and SONAME match; .install files and override_dh_auto_install paths are consistent (dev gets .so symlink + pkgconfig, libs get .so.1, minijail gets binary + preload under usr/lib/*/minijail). - override_dh_auto_test is empty at compat 13, so
dhskips it under nocheck; tests need namespaces/seccomp unavailable in a build chroot (per rules comment) — justified, not a fault. - Standards-Version 4.7.2 first two components match current Policy (4.7); not an issue.
- Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
None.
Proposed: debian/watch in version 5 format ◂
debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.
Version: 5
# Upstream tags releases as linux-vYYYY.MM.DD in the ChromiumOS git repo.
Source: https://chromium.googlesource.com/chromiumos/platform/minijail
Matching-Pattern: refs/tags/linux-v@ANY_VERSION@
Dversionmangle: auto
Mode: git
Pgpmode: none
Uversionmangle: s/^linux-v//
Uploader's response to the LLM review
The uploader was emailed about the review 19 days ago.
Review Information
accepted — allocated to awm 19 days ago, started 19 days ago, completed 19 days ago.