The firejail process is visible inside the sandbox through ps

[vukitoso]

Hello.
I noticed that inside the sandbox, if you execute "ps uaxf", you can see the firejail process

$ firejail --noprofile
Parent pid 14487, child pid 14488
Child process initialized in 8.89 ms
$ ps auxf
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
user         1  0.0  0.0   4060  1660 pts/4    S    16:04   0:00 firejail --noprofile
user         2  1.0  0.0   8120  4976 pts/4    S    16:04   0:00 /bin/bash
user         4  0.0  0.0  10568  3188 pts/4    R+   16:04   0:00  \_ ps auxf

I want to understand why the "firejail" process is visible? After all, this is an isolated sandbox with its own processes.

[rusty-snake]

Because pid1 is special and the most programs are not written to be pid1, therefore firejail needs it's own pid1. There might be more reasons IDK.

Also note that this is not the firejail process you started in your shell.

[vukitoso]

is it possible from the sandbox to inject into the firejail process with PID = 1 to inject your code? (process injection)

[vukitoso]

IDK

what is IDK?

[rusty-snake]

LMGDDGTFY https://duckduckgo.com/?q=abbreviation+IDK

[vukitoso]

IDK = I don’t know?