Review: minijail 2026.05.18+git20261016.8787d1a-2
Package Information
| Description | utility to run a program inside a sandbox Minijail is a sandboxing and containment tool used in ChromeOS and Android. It launches a program with a restricted view of the system: it can enter new namespaces (mount, PID, network, user, IPC), pivot_root into a chosen filesystem, drop capabilities and switch user, and apply a seccomp-bpf filter that limits the program to a declared set of system calls. Minijail is intended for sandboxing known binaries, to reduce the damage a compromised service can do. It is not designed to safely run malicious code. This package contains the minijail0 command line tool. |
|---|---|
| Maintainer | Yunseong Kim <ysk@kzalloc.com> |
| Changed By | Yunseong Kim <ysk@kzalloc.com> |
| Sponsor | paulliu@debian.org |
| Distribution | unstable |
| Architecture | linux-any all |
| VCS | git: https://salsa.debian.org/ysk/minijail.git (browse) |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/minijail |
| Uploaded | 17 days ago |
New Package Report
.changes
| Date | Wed, 21 Oct 2026 12:26:01 +0200 |
|---|---|
| Source | minijail |
| Version | 2026.05.18+git20261016.8787d1a-2 |
| Changed-By | Yunseong Kim <ysk@kzalloc.com> |
| Architecture | source amd64 all |
| Distribution | unstable |
Changelog
minijail (2026.05.18+git20261016.8787d1a-2) unstable; urgency=medium
.
* Build the Rust crates under rust/ as librust-minijail-sys-dev and
librust-minijail-dev, laid out for the system cargo registry. They are
not published on crates.io and are needed to package crosvm. They
are installed unmodified: cargo resolves minijail's path dependency on
minijail-sys within the registry, and minijail-sys finds the system
libminijail through pkg-config. The debcargo-style Provides are
versioned with the crate versions, as the Rust packaging policy asks.
* Build the Python seccomp policy tools as python3-minijail
(compile_seccomp_policy, generate_seccomp_policy,
generate_constants_json), with manual pages from help2man; crosvm
compiles its policies with compile_seccomp_policy at build time.
Run their unit tests at build time.
* Add autopkgtests for the Rust crates and compile_seccomp_policy.
* Salsa CI: build the new Architecture: all package, and check
wrap-and-sort -ast formatting.
* Bump Standards-Version to 4.7.4, no changes needed..dsc
| Package-List | libminijail-dev deb libdevel optional arch=linux-any libminijail1 deb libs optional arch=linux-any librust-minijail-dev deb rust optional arch=linux-any librust-minijail-sys-dev deb rust optional arch=linux-any minijail deb admin optional arch=linux-any python3-minijail deb python optional arch=all |
|---|---|
| Section | libdevel |
| Priority | optional |
| Component | main |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: minijail
Upstream-Contact: minijail@chromium.org
Source: https://chromium.googlesource.com/chromiumos/platform/minijail
Files: *
Copyright: 2011-2026 The ChromiumOS Authors
License: BSD-3-Clause
Files:
Android.bp
CleanSpec.mk
examples/drop_privs.cpp
test/libminijail_test.cpp
tools/Android.bp
Copyright:
2015-2019 The Android Open Source Project
License: Apache-2.0
Files: debian/*
Copyright: 2026 Yunseong Kim <ysk@kzalloc.com>
License: BSD-3-Clause
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 3 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 17 days ago.
Proposes a replacement debian/watch:
debian/watch in version 5 format
Report
DFSG NEW review for minijail version 2026.05.18+git20261016.8787d1a-2
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 3 minor
- debian/watch: old format (version 4)
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
Every file in the tree is covered by debian/copyright, which is correct and accurate. All non-Android source files carry The ChromiumOS Authors headers and the included BSD-3-Clause license; the five Android Open Source Project files (Android.bp, CleanSpec.mk, examples/drop_privs.cpp, test/libminijail_test.cpp, tools/Android.bp) carry Apache-2.0 and are matched by a specific stanza, with the full Apache-2.0 text (pointing to /usr/share/common-licenses/Apache-2.0) given. No GPL/LGPL/copyleft, no non-commercial/no-modification/field-of-use terms, no embedded third-party code, no images/fonts/firmware, and no built files lacking their preferred form: the two checked-in generated tables under linux-x86/ are machine-generated from in-tree scripts (gen_syscalls.sh/gen_constants.sh + headers) and are regenerated by the Makefile at build time, not shipped. The root LICENSE file is the full BSD-3-Clause text. The prescan's author check found every declared holder named in debian/copyright. DFSG-compliant.
Packaging
Packaging is of good quality. Debian Policy 4.7.4.1 is current; Standards-Version 4.7.4 is fine. debhelper compat 13 with explicit relationship substvars (correct at this level). Binary split (minijail/libminijail1/libminijail-dev, two Rust dev packages, python3-minijail), Multi-Arch: same on the C and Rust packages, Architecture: linux-any on the linux parts, hardening=+all, per-arch/indep split in rules, generated per-build syscall tables from in-tree scripts, an SONAME patch adding needed Policy 8.1 compliance, a tracked symbols file, sane autopkgtests for the rust crates and compile_seccomp_policy, no maintainer scripts, and rust/bindgen/pkg-config build deps that resolve against the archive. The only nit is that patch 0004 lacks DEP-3 headers.
Issues
minor packaging 1. Patch 0004 has no DEP-3 headers ◂
- Files:
debian/patches/0004-suppress-nonverbose-echo-when-verbose.patch - Basis: checked, in the package or with a reference tool
- Evidence: The header uses git format-patch fields only:
From:andSubject:; it has noDescription:,Author:/Forwarded:fields, unlike the other three patches in the series which carryDescription:,Author:andForwarded:. - Problem: Debian Policy 4.13 recommends DEP-3 headers for quilt patches; this patch is inconsistent with the rest of the series and lacks the rationale field (Description) and forwarding status expected for a packaging patch.
- Fix: Add
Description:,Author:andForwarded:(or Forwarded: not-needed) fields, matching the style of the other patches.
minor packaging 2. debian/watch is in the old version 4 format ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence:
version=4 - Problem: Version 5 is the current format of
debian/watch. - Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
minor packaging 3. uscan finds only upstream versions older than the packaged one ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence: upstream
2026.05.18, packaged2026.05.18+git20261016.8787d1a - Problem: The newest version uscan finds with
debian/watchis older than the version indebian/changelog, so the watch file does not find the packaged release: it may look in the wrong place, or the versions may need mangling to compare. - Fix: Check where
debian/watchlooks and how it mangles versions.
Verified ◂
- Every upstream source file carries either
Copyright ... The ChromiumOS Authors(BSD-3-Clause) orCopyright (C) ... The Android Open Source Project(Apache-2.0); grep across the tree found no other holder. debian/copyright'sFiles: *stanza (BSD-3-Clause) correctly covers all ChromiumOS files; the Android Apache-2.0 stanza lists exactly the five Apache-licensed files and no others.- Root LICENSE file is the full BSD-3-Clause text; NOTICE and MODULE_LICENSE_BSD (empty) are ChromeOS BSD-scope files.
- No GPL/LGPL/Apache/Mozilla/public-domain or non-free wording anywhere in the tree (grep for such terms only hit the five Apache-2.0 files and debian/copyright).
- No binary/embedded artifacts found by inspection: no .so/.jar/.class/.pyc/.png/fonts/etc. The only generated files are linux-x86/libconstants.gen.c and libsyscalls.gen.c, which the Makefile regenerates from in-tree scripts/headers at build time and which are only used by Android's host build, so they are not a missing-preferred-form problem.
- python3-minijail tools import only the Python standard library; the auparse import in generate_seccomp_policy.py is guarded by try/except ImportError and optional, so no extra runtime dependency is needed.
- Rust deps librust-bindgen-0.72+default-dev, librust-pkg-config-0.3+default-dev, librust-libc-0.2+default-dev are provided by libminijail's build deps in the archive; rustc/cargo/gcc autopkgtest deps are present.
- Current Policy is 4.7.4.1; Standards-Version 4.7.4 is acceptable (first two components match).
- Patch 0004 aside, the other three patches have proper DEP-3 headers; all four have clear, narrow purposes.
- The empty
override_dh_auto_test-archintentionally skips the upstream C test suite because it enters namespaces and installs seccomp filters that fail in a build chroot; the self-contained Python unit tests run and the autopkgtest coverage (rust crates + compile_seccomp_policy) is reasonable. - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- Symbols in libminijail1.symbols match the exported ABI of the built library (could not build to check; a mismatch would surface as a dpkg-gensymbols failure on the buildd, which is not inferable from the source alone).
Proposed: debian/watch in version 5 format ◂
debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.
Version: 5
# Upstream tags releases as linux-vYYYY.MM.DD in the ChromiumOS git repo.
Source: https://chromium.googlesource.com/chromiumos/platform/minijail
Matching-Pattern: refs/tags/linux-v@ANY_VERSION@
Dversionmangle: auto
Mode: git
Pgpmode: none
Uversionmangle: s/^linux-v//
Uploader's response to the LLM review
The uploader rejected this upload in response to the review.
Review Information
rejected — allocated to dfsg-uploader 16 days ago, started 16 days ago, completed 16 days ago.
Final Comment
The uploader rejected this upload in response to the automated (LLM) review of it, so that they can fix the problems it found and upload again.
The uploader said:
All three points are minor and are fixed for the next upload; please keep this one in NEW.
- Patch 0004 now uses DEP-3 Description/Author/Forwarded headers, like the other patches.
- debian/watch is converted to version 5.
- The watch file now strips the +git. snapshot suffix before comparing, so uscan reports the package as up to date with linux-v2026.05.18 and will detect the next upstream release.
The changes are committed on Salsa (salsa.debian.org/ysk/minijail, branch debian/latest) and will be in -3, a source-only upload after this one is accepted, for testing migration.