Parrot-Sphinx in a container - firmwared

We’re attempting to build the Parrot-Sphinx software inside of a Singularity container. I think we’ve gotten close, however we’ve ran into an issue with firmwared. Our host OS is CentOS 7.7-1908. When attempting to start firmwared inside of the container we get an error with the kernel being too old. Our Kernel is 3.10.0-1062 and firmwared wants at least 3.18. Is there anyway to start firmwared on this older kernel? Our systems are based on CentOS 7 and unfortunately at this moment, kernel 3.10 is the newest we’ll have for some time. Any feedback is appreciated. Thank you.

Hi @brandon,

Parrot-Firmwared is a container engine of its own (like docker) and relies on some advanced linux namespace and other kernel features. The minimal recommended linux version for running Sphinx is 4.4.

That being said, running Sphinx/Firmwared in a container is quiet difficult.



Hi @ndessart. The post you linked was the post I was following to start to get this to work when I ran into the issue that I posted about. Unfortunately it doesn’t seem to entirely answer the problem I’m running into.

The minimal recommended linux version for running Sphinx is 4.4.

Is this just recommended or required? Is there any chance of getting it to run on an older kernel than this recommended one? CentOS 8 should work as it’s 4.18, but unfortunately everything we currently have is on CentOS 7 for the foreseeable future.

The post you linked has some good concerns. Most of which we have figured out, besides this one.

Any feedback is appreciated. Thanks!

Sphinx was initially developed during the Ubuntu 14.04 (Xenial) era under a 3.13, 3.16 and 3.19 (14.04.4) kernel and I think that at one point we needed a 3.18 kernel to be able to use a new AppArmor profile feature that was included in that kernel release.

Running Firmwared on a 3.10 kernel would imply that you disable some protections offered by AppArmor. Your host kernel would then give additional privileges to the simulated firmware. We can’t lower this requirement without performing an in-depth analysis of the implications.

Gotcha. That makes sense. I’ll have to do some exploring to see what I can do to make it work then in my environment. Thanks!

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.