DFSG NEW Queue

DFSG, Licensing & New Packages Team

Review: minijail 2026.05.18+git20261016.8787d1a-1

Package Information

Descriptionutility to run a program inside a sandbox

Minijail is a sandboxing and containment tool used in ChromeOS and Android. It launches a program with a restricted view of the system: it can enter new namespaces (mount, PID, network, user, IPC), pivot_root into a chosen filesystem, drop capabilities and switch user, and apply a seccomp-bpf filter that limits the program to a declared set of system calls.

Minijail is intended for sandboxing known binaries, to reduce the damage a compromised service can do. It is not designed to safely run malicious code.

This package contains the minijail0 command line tool.

MaintainerYunseong Kim <ysk@kzalloc.com>
Changed ByYunseong Kim <ysk@kzalloc.com>
Sponsorpaulliu@debian.org
Distributionunstable
Architecturelinux-any
VCSgit: https://salsa.debian.org/ysk/minijail.git (browse)
Closes#860067
Trackerhttps://tracker.debian.org/pkg/minijail
Uploaded19 days ago

New Package Report

.changes◂
DateMon, 24 Aug 2026 16:50:00 +0200
Sourceminijail
Version2026.05.18+git20261016.8787d1a-1
Changed-ByYunseong Kim <ysk@kzalloc.com>
Architecturesource amd64
Distributionunstable
Changelog◂
minijail (2026.05.18+git20261016.8787d1a-1) unstable; urgency=medium
 .
   * Initial release. (Closes: #860067)
   * Package upstream Git snapshot 8787d1a.
   * Update debian/gbp.conf to use separate Debian and upstream branches
     and enable pristine-tar.
.dsc◂
Priorityoptional
Componentmain
Package-Listlibminijail-dev deb libdevel optional arch=linux-any
libminijail1 deb libs optional arch=linux-any
minijail deb admin optional arch=linux-any
Sectionlibdevel
debian/copyright◂
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: minijail
Upstream-Contact: minijail@chromium.org
Source: https://chromium.googlesource.com/chromiumos/platform/minijail

Files: *
Copyright: 2011-2026 The ChromiumOS Authors
License: BSD-3-Clause

Files:
 Android.bp
 CleanSpec.mk
 examples/drop_privs.cpp
 test/libminijail_test.cpp
 tools/Android.bp
Copyright:
 2015-2019 The Android Open Source Project
License: Apache-2.0

Files: debian/*
Copyright: 2026 Yunseong Kim <ysk@kzalloc.com>
License: BSD-3-Clause

License: BSD-3-Clause
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:
 .
 1. Redistributions of source code must retain the above copyright notice, this
 list of conditions and the following disclaimer.
 .
 2. Redistributions in binary form must reproduce the above copyright notice,
 this list of conditions and the following disclaimer in the documentation
 and/or other materials provided with the distribution.
 .
 3. Neither the name of the copyright holder nor the names of its contributors
 may be used to endorse or promote products derived from this software without
 specific prior written permission.
 .
 THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
 FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

License: Apache-2.0
 Licensed under the Apache License, Version 2.0 (the "License");
 you may not use this file except in compliance with the License.
 You may obtain a copy of the License at
 .
     http://www.apache.org/licenses/LICENSE-2.0
 .
 Unless required by applicable law or agreed to in writing, software
 distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
 .
 On Debian systems, the complete text of the Apache License Version 2.0
 can be found in "/usr/share/common-licenses/Apache-2.0".

DFSG Assistant LLM REVIEW 0 blocker, 0 important, 2 minor

This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.

Reviewed 19 days ago.

Proposes a replacement debian/watch: debian/watch in version 5 format

Report◂

DFSG NEW review for minijail version 2026.05.18+git20261016.8787d1a-1

Summary

  • Licensing is DFSG-compliant and debian/copyright is accurate: Yes
  • Packaging is of good quality: Yes
  • Issues: 0 blocker, 0 important, 2 minor
  • debian/watch: old format (version 4)
  • debian/copyright: machine-readable
  • Scan before the review: nothing found

Licensing

The tree is entirely free: all upstream sources are BSD-3-Clause (The ChromiumOS Authors), with a small set of Android-origin files (Android.bp, CleanSpec.mk, examples/drop_privs.cpp, test/libminijail_test.cpp, tools/Android.bp) under Apache-2.0, and the Debian packaging under BSD-3-Clause by the maintainer. debian/copyright is DEP-5 machine-readable, is accurate, and every copyright holder found in the source is named. No non-free terms, no missing licences, no binary/blob files, and all generated code has its generator present.

Packaging

Clean and well-maintained packaging. Source format 3.0 (quilt), compat 13 with dh $@, hardening +all, correct binary split (minijail / libminijail1 / libminijail-dev) with Multi-Arch: same on the libraries, core dump/soname handling via a symbols file and a SONAME patch, proper Architecture (linux-any), Standard-Version 4.7.2 (current), and Vcs-* pointing at the maintainer's salsa repo. Four small, DEP-3-commented patches with sensible rationale. Test suite disabled with a comment (needs namespaces/seccomp in a build chroot), which is justified.

Issues

minor packaging 1. debian/watch is in the old version 4 format ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: version=4
  • Problem: Version 5 is the current format of debian/watch.
  • Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
minor packaging 2. uscan finds only upstream versions older than the packaged one ◂
  • Files: debian/watch
  • Basis: found by the review tooling's own checks
  • Evidence: upstream 2026.05.18, packaged 2026.05.18+git20261016.8787d1a
  • Problem: The newest version uscan finds with debian/watch is older than the version in debian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare.
  • Fix: Check where debian/watch looks and how it mangles versions.
Verified ◂
  • Prescanned copyright-holder report: 118 files scanned; every holder found (The ChromiumOS Authors, The Android Open Source Project) is named in debian/copyright — no missing holder confirmed.
  • All C/C++/headers/scripts carrying notices (2011-2022 The ChromiumOS Authors) fall under Files: * BSD-3-Clause; all Android-licensed files (Android.bp, CleanSpec.mk, examples/drop_privs.cpp, test/libminijail_test.cpp, tools/Android.bp) carry the Apache-2.0 header and are listed in the Apache stanza of debian/copyright.
  • LICENSE and NOTICE at top level reproduce the BSD-3-Clause text ("Neither the name of Google LLC nor the names of its contributors" condition 3), matching the BSD-3-Clause paragraph in debian/copyright.
  • linux-x86/libconstants.gen.c and libsyscalls.gen.c are generated at build time (marked GENERATED BY MAKEFILE) from gen_constants.sh / gen_syscalls.sh and headers present in the tree; not built blobs shipped without source.
  • Rust crates (rust/minijail, rust/minijail-sys) and tools/*.py carry ChromiumOS Authors BSD notices, covered by Files: *; // tools/testdata/arch_64.json and policy/conf data are covered by Files: * as upstream code.
  • debian/copyright: no Files-Excluded; Apache-2.0 text correctly pointed at /usr/share/common-licenses/Apache-2.0; BSD-3-Clause full text included.
  • debian/rules: hardening=+all; dpkg-buildflags CFLAGS/CPPFLAGS/LDFLAGS pass through to common.mk which appends (CFLAGS += ...), so hardening flags are not clobbered.
  • 0001-add-soname patch sets -Wl,-soname,libminijail.so.1; symbols file tag libminijail.so.1 and SONAME match; .install files and override_dh_auto_install paths are consistent (dev gets .so symlink + pkgconfig, libs get .so.1, minijail gets binary + preload under usr/lib/*/minijail).
  • override_dh_auto_test is empty at compat 13, so dh skips it under nocheck; tests need namespaces/seccomp unavailable in a build chroot (per rules comment) — justified, not a fault.
  • Standards-Version 4.7.2 first two components match current Policy (4.7); not an issue.
  • Every pointer of debian/copyright to /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂

None.

Proposed: debian/watch in version 5 format ◂

debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.

Version: 5

# Upstream tags releases as linux-vYYYY.MM.DD in the ChromiumOS git repo.
Source: https://chromium.googlesource.com/chromiumos/platform/minijail
Matching-Pattern: refs/tags/linux-v@ANY_VERSION@
Dversionmangle: auto
Mode: git
Pgpmode: none
Uversionmangle: s/^linux-v//

Uploader's response to the LLM review

The uploader was emailed about the review 19 days ago.

Review Information

accepted — allocated to awm 19 days ago, started 19 days ago, completed 19 days ago.

Final Comment

Other Reviews of this Package

VersionHashAllocatedCompletedReviewerStatusDetails
2026.05.18+git20261016.8787d1a-2 72f5ab3a… 2026-10-22 08:20 2026-10-22 08:20 dfsg-uploader rejected VIEW
2026.05.18+git20261016.8787d1a-2 b11a9883… 2026-10-22 22:28 2026-10-22 22:33 awm accepted VIEW

Back to Dashboard | View all reviews for this package