characters into the controlling terminal back */
optional bool skip_setsid = 24 [default = false];
/* Redirect sdterr of the process to /dev/null instead of the socket or original TTY */
- optional bool stderr_to_null = 79 [default = false];
+ optional bool stderr_to_null = 25 [default = false];
/* Which FDs should be passed to the newly executed process
By default only FD=0,1,2 are passed */
- repeated int32 pass_fd = 25;
+ repeated int32 pass_fd = 26;
/* Setting it to true will allow to have set-uid binaries
inside the jail */
- optional bool disable_no_new_privs = 26 [default = false];
+ optional bool disable_no_new_privs = 27 [default = false];
/* Various rlimits, the rlimit_as/rlimit_core/... are used only if
rlimit_as_type/rlimit_core_type/... are set to RLimit::VALUE */
- optional uint64 rlimit_as = 27 [default = 512]; /* In MiB */
- optional RLimit rlimit_as_type = 28 [default = VALUE];
- optional uint64 rlimit_core = 29 [default = 0]; /* In MiB */
- optional RLimit rlimit_core_type = 30 [default = VALUE];
- optional uint64 rlimit_cpu = 31 [default = 600]; /* In seconds */
- optional RLimit rlimit_cpu_type = 32 [default = VALUE];
- optional uint64 rlimit_fsize = 33 [default = 1]; /* In MiB */
- optional RLimit rlimit_fsize_type = 34 [default = VALUE];
- optional uint64 rlimit_nofile = 35 [default = 32];
- optional RLimit rlimit_nofile_type = 36 [default = VALUE];
+ optional uint64 rlimit_as = 28 [default = 512]; /* In MiB */
+ optional RLimit rlimit_as_type = 29 [default = VALUE];
+ optional uint64 rlimit_core = 30 [default = 0]; /* In MiB */
+ optional RLimit rlimit_core_type = 31 [default = VALUE];
+ optional uint64 rlimit_cpu = 32 [default = 600]; /* In seconds */
+ optional RLimit rlimit_cpu_type = 33 [default = VALUE];
+ optional uint64 rlimit_fsize = 34 [default = 1]; /* In MiB */
+ optional RLimit rlimit_fsize_type = 35 [default = VALUE];
+ optional uint64 rlimit_nofile = 36 [default = 32];
+ optional RLimit rlimit_nofile_type = 37 [default = VALUE];
/* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by
* default here */
- optional uint64 rlimit_nproc = 37 [default = 1024];
- optional RLimit rlimit_nproc_type = 38 [default = SOFT];
+ optional uint64 rlimit_nproc = 38 [default = 1024];
+ optional RLimit rlimit_nproc_type = 39 [default = SOFT];
/* In MiB, use the soft limit value by default */
- optional uint64 rlimit_stack = 39 [default = 1048576];
- optional RLimit rlimit_stack_type = 40 [default = SOFT];
+ optional uint64 rlimit_stack = 40 [default = 1048576];
+ optional RLimit rlimit_stack_type = 41 [default = SOFT];
/* See 'man personality' for more */
- optional bool persona_addr_compat_layout = 41 [default = false];
- optional bool persona_mmap_page_zero = 42 [default = false];
- optional bool persona_read_implies_exec = 43 [default = false];
- optional bool persona_addr_limit_3gb = 44 [default = false];
- optional bool persona_addr_no_randomize = 45 [default = false];
+ optional bool persona_addr_compat_layout = 42 [default = false];
+ optional bool persona_mmap_page_zero = 43 [default = false];
+ optional bool persona_read_implies_exec = 44 [default = false];
+ optional bool persona_addr_limit_3gb = 45 [default = false];
+ optional bool persona_addr_no_randomize = 46 [default = false];
/* Which name-spaces should be used? */
- optional bool clone_newnet = 46 [default = true];
- optional bool clone_newuser = 47 [default = true];
- optional bool clone_newns = 48 [default = true];
- optional bool clone_newpid = 49 [default = true];
- optional bool clone_newipc = 50 [default = true];
- optional bool clone_newuts = 51 [default = true];
+ optional bool clone_newnet = 47 [default = true];
+ optional bool clone_newuser = 48 [default = true];
+ optional bool clone_newns = 49 [default = true];
+ optional bool clone_newpid = 50 [default = true];
+ optional bool clone_newipc = 51 [default = true];
+ optional bool clone_newuts = 52 [default = true];
/* Disable for kernel versions < 4.6 as it's not supported there */
- optional bool clone_newcgroup = 52 [default = true];
+ optional bool clone_newcgroup = 53 [default = true];
/* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
for more */
- repeated IdMap uidmap = 53;
- repeated IdMap gidmap = 54;
+ repeated IdMap uidmap = 54;
+ repeated IdMap gidmap = 55;
/* Should /proc be mounted (R/O)? This can also be added in the 'mount'
section below */
- optional bool mount_proc = 55 [default = false];
+ optional bool mount_proc = 56 [default = false];
/* Mount points inside the jail. See the description for 'msg MountPt'
for more */
- repeated MountPt mount = 56;
+ repeated MountPt mount = 57;
/* Kafel seccomp-bpf policy file or a string:
Homepage of the project: https://github.com/google/kafel */
- optional string seccomp_policy_file = 57;
- repeated string seccomp_string = 58;
+ optional string seccomp_policy_file = 58;
+ repeated string seccomp_string = 59;
/* Setting it to true makes audit write seccomp logs to dmesg */
- optional bool seccomp_log = 77 [default = false];
+ optional bool seccomp_log = 60 [default = false];
/* If > 0, maximum cumulative size of RAM used inside any jail */
- optional uint64 cgroup_mem_max = 59 [default = 0]; /* In MiB */
+ optional uint64 cgroup_mem_max = 61 [default = 0]; /* In MiB */
/* Mount point for cgroups-memory in your system */
- optional string cgroup_mem_mount = 60 [default = "/sys/fs/cgroup/memory"];
+ optional string cgroup_mem_mount = 62 [default = "/sys/fs/cgroup/memory"];
/* Writeable directory (for the nsjail user) under cgroup_mem_mount */
- optional string cgroup_mem_parent = 61 [default = "NSJAIL"];
+ optional string cgroup_mem_parent = 63 [default = "NSJAIL"];
/* If > 0, maximum number of PIDs (threads/processes) inside jail */
- optional uint64 cgroup_pids_max = 62 [default = 0];
+ optional uint64 cgroup_pids_max = 64 [default = 0];
/* Mount point for cgroups-pids in your system */
- optional string cgroup_pids_mount = 63 [default = "/sys/fs/cgroup/pids"];
+ optional string cgroup_pids_mount = 65 [default = "/sys/fs/cgroup/pids"];
/* Writeable directory (for the nsjail user) under cgroup_pids_mount */
- optional string cgroup_pids_parent = 64 [default = "NSJAIL"];
+ optional string cgroup_pids_parent = 66 [default = "NSJAIL"];
/* If > 0, Class identifier of network packets inside jail */
- optional uint32 cgroup_net_cls_classid = 65 [default = 0];
+ optional uint32 cgroup_net_cls_classid = 67 [default = 0];
/* Mount point for cgroups-net-cls in your system */
- optional string cgroup_net_cls_mount = 66 [default = "/sys/fs/cgroup/net_cls"];
+ optional string cgroup_net_cls_mount = 68 [default = "/sys/fs/cgroup/net_cls"];
/* Writeable directory (for the nsjail user) under cgroup_net_mount */
- optional string cgroup_net_cls_parent = 67 [default = "NSJAIL"];
+ optional string cgroup_net_cls_parent = 69 [default = "NSJAIL"];
/* If > 0 number of milliseconds of CPU that jail processes can use per each second */
- optional uint32 cgroup_cpu_ms_per_sec = 68 [default = 0];
+ optional uint32 cgroup_cpu_ms_per_sec = 70 [default = 0];
/* Mount point for cgroups-cpu in your system */
- optional string cgroup_cpu_mount = 69 [default = "/sys/fs/cgroup/cpu"];
+ optional string cgroup_cpu_mount = 71 [default = "/sys/fs/cgroup/cpu"];
/* Writeable directory (for the nsjail user) under cgroup_cpu_mount */
- optional string cgroup_cpu_parent = 70 [default = "NSJAIL"];
+ optional string cgroup_cpu_parent = 72 [default = "NSJAIL"];
/* Should the 'lo' interface be brought up (active) inside this jail? */
- optional bool iface_no_lo = 71 [default = false];
+ optional bool iface_no_lo = 73 [default = false];
/* Put this interface inside the jail */
- repeated string iface_own = 78;
+ repeated string iface_own = 74;
/* Parameters for the cloned MACVLAN interface inside jail */
- optional string macvlan_iface = 72; /* Interface to be cloned, eg 'eth0' */
- optional string macvlan_vs_ip = 73 [default = "192.168.0.2"];
- optional string macvlan_vs_nm = 74 [default = "255.255.255.0"];
- optional string macvlan_vs_gw = 75 [default = "192.168.0.1"];
- optional string macvlan_vs_ma = 80 [default = ""];
+ optional string macvlan_iface = 75; /* Interface to be cloned, eg 'eth0' */
+ optional string macvlan_vs_ip = 76 [default = "192.168.0.2"];
+ optional string macvlan_vs_nm = 77 [default = "255.255.255.0"];
+ optional string macvlan_vs_gw = 78 [default = "192.168.0.1"];
+ optional string macvlan_vs_ma = 79 [default = ""];
/* Binary path (with arguments) to be executed. If not specified here, it
can be specified with cmd-line as "-- /path/to/command arg1 arg2" */
- optional Exe exec_bin = 76;
+ optional Exe exec_bin = 80;
}