enum Mode {
LISTEN = 0; /* Listening on a TCP port */
- ONCE = 1; /* Running the command once only */
- RERUN = 2; /* Re-executing the command (forever) */
+ ONCE = 1; /* Running the command once only */
+ RERUN = 2; /* Re-executing the command (forever) */
EXECVE = 3; /* Executing command w/o the supervisor */
}
/* Should be self explanatory */
enum LogLevel {
- DEBUG = 0; /* Equivalent to the '-v' cmd-line option */
- INFO = 1; /* Default level */
+ DEBUG = 0; /* Equivalent to the '-v' cmd-line option */
+ INFO = 1; /* Default level */
WARNING = 2; /* Equivalent to the '-q' cmd-line option */
ERROR = 3;
FATAL = 4;
}
-message IdMap
-{
+message IdMap {
/* Empty string means "current uid/gid" */
- optional string inside_id = 1 [ default = "" ];
- optional string outside_id = 2 [ default = "" ];
+ optional string inside_id = 1 [default = ""];
+ optional string outside_id = 2 [default = ""];
/* See 'man user_namespaces' for the meaning of count */
- optional uint32 count = 3 [ default = 1 ];
+ optional uint32 count = 3 [default = 1];
/* Does this map use /usr/bin/new[u|g]idmap binary? */
- optional bool use_newidmap = 4 [ default = false ];
+ optional bool use_newidmap = 4 [default = false];
}
-message MountPt
-{
+message MountPt {
/* Can be skipped for filesystems like 'proc' */
optional string src = 1;
/* Should 'src' path be prefixed with this envvar? */
/* Should 'dst' path be prefixed with this envvar? */
optional string prefix_dst_env = 5;
/* Can be empty for mount --bind mounts */
- optional string fstype = 6 [ default = "" ];
+ optional string fstype = 6 [default = ""];
/* E.g. size=5000000 for 'tmpfs' */
- optional string options = 7 [ default = "" ];
+ optional string options = 7 [default = ""];
/* Is it 'mount --bind src dst' type of mount */
- optional bool is_bind = 8 [ default = false ];
+ optional bool is_bind = 8 [default = false];
/* It it R/W mount */
- optional bool rw = 9 [ default = false ];
+ optional bool rw = 9 [default = false];
/* Is it directory? If not specified an internal
heuristics will be used to determine that */
optional bool is_dir = 10;
/* Should the sandboxing fail if we cannot mount this resource? */
- optional bool mandatory = 11 [ default = true ];
+ optional bool mandatory = 11 [default = true];
/* Is it a symlink (instead of real mount point)? */
- optional bool is_symlink = 12 [ default = false ];
+ optional bool is_symlink = 12 [default = false];
}
enum RLimit {
VALUE = 0; /* Use the provided value */
- SOFT = 1; /* Use the current soft rlimit */
- HARD = 2; /* Use the current hard rlimit */
- INF = 3; /* Use RLIM64_INFINITY */
+ SOFT = 1; /* Use the current soft rlimit */
+ HARD = 2; /* Use the current hard rlimit */
+ INF = 3; /* Use RLIM64_INFINITY */
}
-message Exe
-{
+message Exe {
/* Will be used both as execv's path and as argv[0] */
required string path = 1;
/* This will be argv[1] and so on.. */
/* Override argv[0] */
optional string arg0 = 3;
/* Should execveat() be used to execute a file-descriptor instead? */
- optional bool exec_fd = 4 [ default = false ];
+ optional bool exec_fd = 4 [default = false];
}
-message NsJailConfig
-{
+message NsJailConfig {
/* Optional name and description for this config */
- optional string name = 1 [ default = "" ];
+ optional string name = 1 [default = ""];
repeated string description = 2;
/* Execution mode: see 'msg Mode' description for more */
- optional Mode mode = 3 [ default = ONCE ];
+ optional Mode mode = 3 [default = ONCE];
/* Equivalent to a bind mount with dst='/' */
optional string chroot_dir = 4;
/* Applies both to the chroot_dir and to /proc mounts */
- optional bool is_root_rw = 5 [ default = false ];
+ optional bool is_root_rw = 5 [default = false];
/* Hostname inside jail */
- optional string hostname = 8 [ default = "NSJAIL" ];
+ optional string hostname = 8 [default = "NSJAIL"];
/* Initial current working directory for the binary */
- optional string cwd = 9 [ default = "/" ];
+ optional string cwd = 9 [default = "/"];
/* TCP port to listen to. Valid with mode=LISTEN only */
- optional uint32 port = 10 [ default = 0 ];
+ optional uint32 port = 10 [default = 0];
/* Host to bind to for mode=LISTEN. Must be in IPv6 format */
- optional string bindhost = 11 [ default = "::" ];
+ optional string bindhost = 11 [default = "::"];
/* For mode=LISTEN, maximum number of connections from a single IP */
- optional uint32 max_conns_per_ip = 12 [ default = 0 ];
+ optional uint32 max_conns_per_ip = 12 [default = 0];
/* Wall-time time limit for commands */
- optional uint32 time_limit = 13 [ default = 600 ];
+ optional uint32 time_limit = 13 [default = 600];
/* Should nsjail go into background? */
- optional bool daemon = 14 [ default = false ];
+ optional bool daemon = 14 [default = false];
/* Maximum number of CPUs to use: 0 - no limit */
- optional uint32 max_cpus = 15 [ default = 0 ];
+ optional uint32 max_cpus = 15 [default = 0];
/* FD to log to. */
optional int32 log_fd = 16;
/* Should the current environment variables be kept
when executing the binary */
- optional bool keep_env = 19 [ default = false ];
+ optional bool keep_env = 19 [default = false];
/* EnvVars to be set before executing binaries */
repeated string envar = 20;
/* Should capabilities be preserved or dropped */
- optional bool keep_caps = 21 [ default = false ];
+ optional bool keep_caps = 21 [default = false];
/* Which capabilities should be preserved if keep_caps == false.
Format: "CAP_SYS_PTRACE" */
repeated string cap = 22;
/* Should nsjail close FD=0,1,2 before executing the process */
- optional bool silent = 23 [ default = false ];
+ optional bool silent = 23 [default = false];
/* Should the child process have control over terminal?
Can be useful to allow /bin/sh to provide
job control / signals */
- optional bool skip_setsid = 24 [ default = false ];
+ optional bool skip_setsid = 24 [default = false];
/* Which FDs should be passed to the newly executed process
By default only FD=0,1,2 are passed */
repeated int32 pass_fd = 25;
/* Setting it to true will allow to have set-uid binaries
inside the jail */
- optional bool disable_no_new_privs = 26 [ default = false ];
+ optional bool disable_no_new_privs = 26 [default = false];
/* Various rlimits, the rlimit_as/rlimit_core/... are used only if
rlimit_as_type/rlimit_core_type/... are set to RLimit::VALUE */
- optional uint64 rlimit_as = 27 [ default = 512 ]; /* In MiB */
- optional RLimit rlimit_as_type = 28 [ default = VALUE ];
- optional uint64 rlimit_core = 29 [ default = 0 ]; /* In MiB */
- optional RLimit rlimit_core_type = 30 [ default = VALUE ];
- optional uint64 rlimit_cpu = 31 [ default = 600 ]; /* In seconds */
- optional RLimit rlimit_cpu_type = 32 [ default = VALUE ];
- optional uint64 rlimit_fsize = 33 [ default = 1 ]; /* In MiB */
- optional RLimit rlimit_fsize_type = 34 [ default = VALUE ];
- optional uint64 rlimit_nofile = 35 [ default = 32 ];
- optional RLimit rlimit_nofile_type = 36 [ default = VALUE ];
- /* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by default here */
- optional uint64 rlimit_nproc = 37 [ default = 1024 ];
- optional RLimit rlimit_nproc_type = 38 [ default = SOFT ];
+ optional uint64 rlimit_as = 27 [default = 512]; /* In MiB */
+ optional RLimit rlimit_as_type = 28 [default = VALUE];
+ optional uint64 rlimit_core = 29 [default = 0]; /* In MiB */
+ optional RLimit rlimit_core_type = 30 [default = VALUE];
+ optional uint64 rlimit_cpu = 31 [default = 600]; /* In seconds */
+ optional RLimit rlimit_cpu_type = 32 [default = VALUE];
+ optional uint64 rlimit_fsize = 33 [default = 1]; /* In MiB */
+ optional RLimit rlimit_fsize_type = 34 [default = VALUE];
+ optional uint64 rlimit_nofile = 35 [default = 32];
+ optional RLimit rlimit_nofile_type = 36 [default = VALUE];
+ /* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by
+ * default here */
+ optional uint64 rlimit_nproc = 37 [default = 1024];
+ optional RLimit rlimit_nproc_type = 38 [default = SOFT];
/* In MiB, use the soft limit value by default */
- optional uint64 rlimit_stack = 39 [ default = 1048576 ];
- optional RLimit rlimit_stack_type = 40 [ default = SOFT ];
+ optional uint64 rlimit_stack = 39 [default = 1048576];
+ optional RLimit rlimit_stack_type = 40 [default = SOFT];
/* See 'man personality' for more */
- optional bool persona_addr_compat_layout = 41 [ default = false ];
- optional bool persona_mmap_page_zero = 42 [ default = false ];
- optional bool persona_read_implies_exec = 43 [ default = false ];
- optional bool persona_addr_limit_3gb = 44 [ default = false ];
- optional bool persona_addr_no_randomize = 45 [ default = false ];
+ optional bool persona_addr_compat_layout = 41 [default = false];
+ optional bool persona_mmap_page_zero = 42 [default = false];
+ optional bool persona_read_implies_exec = 43 [default = false];
+ optional bool persona_addr_limit_3gb = 44 [default = false];
+ optional bool persona_addr_no_randomize = 45 [default = false];
/* Which name-spaces should be used? */
- optional bool clone_newnet = 46 [ default = true ];
- optional bool clone_newuser = 47 [ default = true ];
- optional bool clone_newns = 48 [ default = true ];
- optional bool clone_newpid = 49 [ default = true ];
- optional bool clone_newipc = 50 [ default = true ];
- optional bool clone_newuts = 51 [ default = true ];
+ optional bool clone_newnet = 46 [default = true];
+ optional bool clone_newuser = 47 [default = true];
+ optional bool clone_newns = 48 [default = true];
+ optional bool clone_newpid = 49 [default = true];
+ optional bool clone_newipc = 50 [default = true];
+ optional bool clone_newuts = 51 [default = true];
/* It's only supported in newer kernels, hence disabled by default */
- optional bool clone_newcgroup = 52 [ default = false ];
+ optional bool clone_newcgroup = 52 [default = false];
/* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
for more */
/* Should /proc be mounted (R/O)? This can also be added in the 'mount'
section below */
- optional bool mount_proc = 55 [ default = false ];
+ optional bool mount_proc = 55 [default = false];
/* Mount points inside the jail. See the description for 'msg MountPt'
for more */
repeated MountPt mount = 56;
repeated string seccomp_string = 58;
/* If > 0, maximum cumulative size of RAM used inside any jail */
- optional uint64 cgroup_mem_max = 59 [ default = 0 ]; /* In MiB */
+ optional uint64 cgroup_mem_max = 59 [default = 0]; /* In MiB */
/* Mount point for cgroups-memory in your system */
- optional string cgroup_mem_mount = 60 [ default = "/sys/fs/cgroup/memory" ];
+ optional string cgroup_mem_mount = 60 [default = "/sys/fs/cgroup/memory"];
/* Writeable directory (for the nsjail user) under cgroup_mem_mount */
- optional string cgroup_mem_parent = 61 [ default = "NSJAIL" ];
+ optional string cgroup_mem_parent = 61 [default = "NSJAIL"];
/* If > 0, maximum number of PIDs (threads/processes) inside jail */
- optional uint64 cgroup_pids_max = 62 [ default = 0 ];
+ optional uint64 cgroup_pids_max = 62 [default = 0];
/* Mount point for cgroups-pids in your system */
- optional string cgroup_pids_mount = 63 [ default = "/sys/fs/cgroup/pids" ];
+ optional string cgroup_pids_mount = 63 [default = "/sys/fs/cgroup/pids"];
/* Writeable directory (for the nsjail user) under cgroup_pids_mount */
- optional string cgroup_pids_parent = 64 [ default = "NSJAIL" ];
+ optional string cgroup_pids_parent = 64 [default = "NSJAIL"];
/* Should the 'lo' interface be brought up (active) inside this jail? */
- optional bool iface_no_lo = 65 [ default = false ];
+ optional bool iface_no_lo = 65 [default = false];
/* Parameters for the cloned MACVLAN interface inside jail */
optional string macvlan_iface = 66; /* Interface to be cloned, eg 'eth0' */
- optional string macvlan_vs_ip = 67 [ default = "192.168.0.2" ];
- optional string macvlan_vs_nm = 68 [ default = "255.255.255.0" ];
- optional string macvlan_vs_gw = 69 [ default = "192.168.0.1" ];
+ optional string macvlan_vs_ip = 67 [default = "192.168.0.2"];
+ optional string macvlan_vs_nm = 68 [default = "255.255.255.0"];
+ optional string macvlan_vs_gw = 69 [default = "192.168.0.1"];
/* Binary path (with arguments) to be executed. If not specified here, it
can be specified with cmd-line as "-- /path/to/command arg1 arg2" */
optional Exe exec_bin = 70;
/* If > 0, Class identifier of network packets inside jail */
- optional uint32 cgroup_net_cls_classid = 71 [ default = 0 ];
+ optional uint32 cgroup_net_cls_classid = 71 [default = 0];
/* Mount point for cgroups-net-cls in your system */
- optional string cgroup_net_cls_mount = 72 [ default = "/sys/fs/cgroup/net_cls" ];
+ optional string cgroup_net_cls_mount = 72 [default = "/sys/fs/cgroup/net_cls"];
/* Writeable directory (for the nsjail user) under cgroup_net_mount */
- optional string cgroup_net_cls_parent = 73 [ default = "NSJAIL" ];
+ optional string cgroup_net_cls_parent = 73 [default = "NSJAIL"];
}