Review: minijail 2026.05.18+git20261016.8787d1a-2
Package Information
| Description | utility to run a program inside a sandbox Minijail is a sandboxing and containment tool used in ChromeOS and Android. It launches a program with a restricted view of the system: it can enter new namespaces (mount, PID, network, user, IPC), pivot_root into a chosen filesystem, drop capabilities and switch user, and apply a seccomp-bpf filter that limits the program to a declared set of system calls. Minijail is intended for sandboxing known binaries, to reduce the damage a compromised service can do. It is not designed to safely run malicious code. This package contains the minijail0 command line tool. |
|---|---|
| Maintainer | Yunseong Kim <ysk@kzalloc.com> |
| Changed By | Yunseong Kim <ysk@kzalloc.com> |
| Sponsor | paulliu@debian.org |
| Distribution | unstable |
| Architecture | linux-any all |
| VCS | git: https://salsa.debian.org/ysk/minijail.git (browse) |
| Popcon Installs | 2 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/minijail |
| Uploaded | 16 days ago |
New Package Report
.changes
| Date | Thu, 22 Oct 2026 11:02:31 +0200 |
|---|---|
| Source | minijail |
| Version | 2026.05.18+git20261016.8787d1a-2 |
| Changed-By | Yunseong Kim <ysk@kzalloc.com> |
| Architecture | source amd64 all |
| Distribution | unstable |
Changelog
minijail (2026.05.18+git20261016.8787d1a-2) unstable; urgency=medium
.
* Build the Rust crates under rust/ as librust-minijail-sys-dev and
librust-minijail-dev, laid out for the system cargo registry. They are
not published on crates.io and are needed to package crosvm. They
are installed unmodified: cargo resolves minijail's path dependency on
minijail-sys within the registry, and minijail-sys finds the system
libminijail through pkg-config. The debcargo-style Provides are
versioned with the crate versions, as the Rust packaging policy asks.
* Build the Python seccomp policy tools as python3-minijail
(compile_seccomp_policy, generate_seccomp_policy,
generate_constants_json), with manual pages from help2man; crosvm
compiles its policies with compile_seccomp_policy at build time.
Run their unit tests at build time.
* Add autopkgtests for the Rust crates and compile_seccomp_policy.
* Salsa CI: build the new Architecture: all package, and check
wrap-and-sort -ast formatting.
* Bump Standards-Version to 4.7.4, no changes needed.
* Add DEP-3 Description/Author/Forwarded headers to patch 0004.
* Convert debian/watch to version 5, and compare only the release part of
a +git snapshot version, so uscan reports the next release as newer..dsc
| Section | libdevel |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | libminijail-dev deb libdevel optional arch=linux-any libminijail1 deb libs optional arch=linux-any librust-minijail-dev deb rust optional arch=linux-any librust-minijail-sys-dev deb rust optional arch=linux-any minijail deb admin optional arch=linux-any python3-minijail deb python optional arch=all |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: minijail
Upstream-Contact: minijail@chromium.org
Source: https://chromium.googlesource.com/chromiumos/platform/minijail
Files: *
Copyright: 2011-2026 The ChromiumOS Authors
License: BSD-3-Clause
Files:
Android.bp
CleanSpec.mk
examples/drop_privs.cpp
test/libminijail_test.cpp
tools/Android.bp
Copyright:
2015-2019 The Android Open Source Project
License: Apache-2.0
Files: debian/*
Copyright: 2026 Yunseong Kim <ysk@kzalloc.com>
License: BSD-3-Clause
License: BSD-3-Clause
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
.
1. Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
.
2. Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
.
3. Neither the name of the copyright holder nor the names of its contributors
may be used to endorse or promote products derived from this software without
specific prior written permission.
.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache License Version 2.0
can be found in "/usr/share/common-licenses/Apache-2.0".
DFSG Assistant LLM REVIEW 0 blocker, 0 important, 0 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 16 days ago.
Report
DFSG NEW review for minijail version 2026.05.18+git20261016.8787d1a-2
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: Yes - Packaging is of good quality: Yes
- Issues: 0 blocker, 0 important, 0 minor
- debian/watch: version 5
- debian/copyright: machine-readable
- Scan before the review: nothing found
Licensing
debian/copyright is DEP-5 machine-readable (Format line correct), with a Files:* stanza for the bulk (BSD-3-Clause, The ChromiumOS Authors 2011-2026), an Apache-2.0 stanza naming exactly the five Android-sourced files (Android.bp, CleanSpec.mk, examples/drop_privs.cpp, test/libminijail_test.cpp, tools/Android.bp - header-verified Apache-2.0), and a debian/* stanza. Standalone license paragraphs give the full BSD-3-Clause text and refer Apache-2.0 to common-licenses. Every source file surveyed is either ChromiumOS-flagged BSD or Android Apache, both compatible and free. The prescan's author check found all holders named. linux-x86/*.gen.c are text C generated by gen_constants.sh/gen_syscalls.sh present in the tree, so they retain their preferred form. No non-free terms (no NC/ND, no field-of-use), no minified/binary/bytecode artifacts, no unlicensed files.
Packaging
Clean, current packaging. compat 13 via debhelper-compat; Build-Depends vs -Indep correctly split for the arch:all python3-minijail; Architecture linux-any and Multi-Arch same on the library/dev/rust packages; SONAME patch (Policy 8.1) with a complete symbols file (Base, Build-Depends-Package libminijail-dev); hardening=+all; libminijailpreload kept out of the public library dir into /usr/lib/*/minijail; Rust crates laid out as a cargo directory registry with correct debcargo-style Provides and pkg-config linkage to system libminijail; pybuild PEP 517 path with generated help2man manpages; autopkgtests (rust crates offline-registry build, compile_seccomp_policy) with correct Depends; the C test suite override is a justified namespace/chroot limitation; 4 DEP-3-headed patches all sound and marked Forwarded; Standards-Version 4.7.4 current; build deps resolvable (bindgen 0.72 present, libc 0.2 present). No policy violations, no upgrade or UX concerns found.
Issues
None.
Verified ◂
- debian/copyright read in full: correct DEP-5 Format, Files:* BSD-3-Clause, Apache stanza for exactly the 5 Android files, debian/* stanza, standalone BSD-3-Clause and Apache-2.0 license paragraphs
- Headers of all 5 Apache-stanza files confirmed Apache-2.0 (2015-2019 Android Open Source Project); copyright matches the stanza
- Root LICENSE/NOTICE/MODULE_LICENSE_BSD and all C/C++/Python/Rust sources surveyed carry ChromiumOS BSD-3-Clause; prescan author check: every holder found is named in debian/copyright
- linux-x86/libconstants.gen.c and libsyscalls.gen.c verified as text C generated by gen_constants.sh/gen_syscalls.sh in-tree (not built artifacts)
- debian/control, rules, changelog, source/format 3.0 (quilt), install/manpages/symbols/maintscript files, 4 patches with DEP-3 headers, tests/control, upstream/metadata, gbp.conf, salsa-ci.yml, README.source all read
- debian/patches/series lists the 4 patches present; patch 0001 SONAME libminijail.so.1 matches symbols file and package name
- Standards-Version 4.7.4 against current Policy 4.7.4.1: current
- Build deps resolvable: librust-bindgen-0.72+default-dev provided by librust-bindgen-dev 0.72.1, librust-libc-0.2+default-dev by librust-libc-dev 0.2.186
- uscan found the packaged version as the newest upstream release (upstream
2026.05.18, packaged2026.05.18+git20261016.8787d1a). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0).
Not confirmed ◂
- override_dh_auto_test-arch is empty on purpose (C suite needs namespaces/seccomp); whether the remaining build steps and autopkgtests pass in practice is for the build daemons, not determinable from the source alone
Proposed changes ◂
None.
Uploader's response to the LLM review
The uploader was emailed about the review 16 days ago.
Review Information
accepted — allocated to awm 16 days ago, started 16 days ago, completed 16 days ago.