{"action":"opened","issue":{"url":"https://api.github.com/repos/netblue30/firejail/issues/1","labels_url":"https://api.github.com/repos/netblue30/firejail/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/netblue30/firejail/issues/1/comments","events_url":"https://api.github.com/repos/netblue30/firejail/issues/1/events","html_url":"https://github.com/netblue30/firejail/issues/1","id":99898675,"number":1,"title":"Modify seccomp arguments in profile config for more flexibility","user":{"login":"boltronics","id":250531,"avatar_url":"https://avatars.githubusercontent.com/u/250531?v=3","gravatar_id":"","url":"https://api.github.com/users/boltronics","html_url":"https://github.com/boltronics","followers_url":"https://api.github.com/users/boltronics/followers","following_url":"https://api.github.com/users/boltronics/following{/other_user}","gists_url":"https://api.github.com/users/boltronics/gists{/gist_id}","starred_url":"https://api.github.com/users/boltronics/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/boltronics/subscriptions","organizations_url":"https://api.github.com/users/boltronics/orgs","repos_url":"https://api.github.com/users/boltronics/repos","events_url":"https://api.github.com/users/boltronics/events{/privacy}","received_events_url":"https://api.github.com/users/boltronics/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-08-09T13:54:51Z","updated_at":"2015-08-09T13:54:51Z","closed_at":null,"body":"At the time of writing, firejail supports:\r\n\r\n```\r\n       seccomp\r\n              Enable default seccomp filter.\r\n\r\n       seccomp syscall,syscall,syscall\r\n              Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter.\r\n\r\n       seccomp.drop syscall,syscall,syscall\r\n              Enable seccomp filter and blacklist  the system calls in the list.\r\n\r\n       seccomp.keep syscall,syscall,syscall\r\n              Enable seccomp filter and whitelist the system calls in the list.\r\n```\r\n\r\nWhat I actually want is the default seccomp filter, with some additional system calls on top of the default seccomp filter. Additionally, I might want to remove some system calls in the same profile. To facilitate this functionality, I suggest changing the second seccomp usage option to work like follows:\r\n\r\n```\r\n       seccomp -syscall,-syscall,-syscall,+syscall,+syscall,+syscall\r\n              Enable seccomp filter and whitelist and/or blacklist additional system calls in the list on top of the default seccomp filter.\r\n```\r\n\r\nRegardless of how the information is specified in the profile, it would be very helpful to somehow just say \"use the default filter +/- these other system calls\". This should cut down the work required for people following the [Firejail Seccomp Guide](https://l3net.wordpress.com/2015/04/13/firejail-seccomp-guide/)."}}