package nsjail;
enum Mode {
- LISTEN = 0; /* Listening on a TCP port */
- ONCE = 1; /* Running the command once only */
- RERUN = 2; /* Re-executing the command (forever) */
- EXECVE = 3; /* Executing command w/o the supervisor */
+ LISTEN = 0; /* Listening on a TCP port */
+ ONCE = 1; /* Running the command once only */
+ RERUN = 2; /* Re-executing the command (forever) */
+ EXECVE = 3; /* Executing command w/o the supervisor */
}
-
-/* Should be self explanatory */
-enum LogLevel {
- DEBUG = 0;
- INFO = 1;
- WARNING = 2;
- ERROR = 3;
- FATAL = 4;
+/* Should be self explanatory */ enum LogLevel {
+ DEBUG = 0;
+ INFO = 1;
+ WARNING = 2;
+ ERROR = 3;
+ FATAL = 4;
}
-
-message IdMap {
- /* Empty string means "current uid/gid" */
- required string inside_id = 1 [default = ""];
- required string outside_id = 2 [default = ""];
- /* 'man user_namespaces' for the meaning of count */
- required uint32 count = 3 [default = 1];
- /* Does this map use /usr/bin/new[u|g]idmap binary? */
- required bool use_newidmap = 4 [default = false];
+message IdMap
+{
+ /* Empty string means "current uid/gid" */
+ required string inside_id = 1 [ default = "" ];
+ required string outside_id = 2 [ default = "" ];
+ /* 'man user_namespaces' for the meaning of count */
+ required uint32 count = 3 [ default = 1 ];
+ /* Does this map use /usr/bin/new[u|g]idmap binary? */
+ required bool use_newidmap = 4 [ default = false ];
}
-
-message MountPt {
- /* Can be empty string for filesystems like 'proc' */
- required string src = 1;
- required string dst = 2;
- /* Can be empty for mount --bind mounts */
- required string fstype = 3;
- /* E.g. size=5000000 for 'tmpfs' */
- required string options = 4 [default = ""];
- /* Is it 'mount --bind src dst' type of mount */
- required bool is_bind = 5 [default = false];
- /* It it RO mount */
- required bool is_ro = 6 [default = false];
- /* Is it directory? If not specified an internal
+message MountPt
+{
+ /* Can be empty string for filesystems like 'proc' */
+ required string src = 1;
+ required string dst = 2;
+ /* Can be empty for mount --bind mounts */
+ required string fstype = 3;
+ /* E.g. size=5000000 for 'tmpfs' */
+ required string options = 4 [ default = "" ];
+ /* Is it 'mount --bind src dst' type of mount */
+ required bool is_bind = 5 [ default = false ];
+ /* It it RO mount */
+ required bool is_ro = 6 [ default = false ];
+ /* Is it directory? If not specified an internal
* heuristics will be used to determine that */
- optional bool is_dir = 7;
+ optional bool is_dir = 7;
}
-
-message Exe {
- /* This will be usef both for path and for argv[0] */
- required string path = 1;
- /* This will be argv[1] and so on.. */
- repeated string arg = 2;
+message Exe
+{
+ /* This will be usef both for path and for argv[0] */
+ required string path = 1;
+ /* This will be argv[1] and so on.. */
+ repeated string arg = 2;
}
-
-message NsJailConfig {
- /* Execution mode: see 'msg Mode' description for more */
- required Mode mode = 1 [default = ONCE];
- /* Equivalent to a mount with dst='/' */
- optional string chroot_dir = 2;
- /* Applies both to the chroot_dir and to /proc mounts */
- required bool is_root_rw = 3 [default = false];
- /* Hostname inside jail */
- required string hostname = 6 [default = "NSJAIL"];
- /* Initial current working directory for the binary */
- required string cwd = 7 [default = "/"];
-
- /* TCP port to listen to. Valid with mode=LISTEN only */
- required uint32 port = 8 [default = 0];
- /* Host to bind to for mode=LISTEN. Must be in IPv6 format */
- required string bindhost = 9 [default = "::"];
- /* For mode=LISTEN, maximum number of connections from a single IP */
- required uint32 max_conns_per_ip = 10 [default = 0];
-
- /* Wall-time time limit for commands */
- required uint32 time_limit = 11 [default = 600];
- /* Should nsjail go into background? */
- required bool daemon = 12 [default = false];
- /* File to save lofs to */
- optional string log_file = 13;
- /* Minimum log level displayed.
+message NsJailConfig
+{
+ /* Execution mode: see 'msg Mode' description for more */
+ required Mode mode = 1 [ default = ONCE ];
+ /* Equivalent to a mount with dst='/' */
+ optional string chroot_dir = 2;
+ /* Applies both to the chroot_dir and to /proc mounts */
+ required bool is_root_rw = 3 [ default = false ];
+ /* Hostname inside jail */
+ required string hostname = 6 [ default = "NSJAIL" ];
+ /* Initial current working directory for the binary */
+ required string cwd = 7 [ default = "/" ];
+
+ /* TCP port to listen to. Valid with mode=LISTEN only */
+ required uint32 port = 8 [ default = 0 ];
+ /* Host to bind to for mode=LISTEN. Must be in IPv6 format */
+ required string bindhost = 9 [ default = "::" ];
+ /* For mode=LISTEN, maximum number of connections from a single IP */
+ required uint32 max_conns_per_ip = 10 [ default = 0 ];
+
+ /* Wall-time time limit for commands */
+ required uint32 time_limit = 11 [ default = 600 ];
+ /* Should nsjail go into background? */
+ required bool daemon = 12 [ default = false ];
+ /* File to save lofs to */
+ optional string log_file = 13;
+ /* Minimum log level displayed.
See 'msg LogLevel' description for more */
- optional LogLevel log_level = 14;
- /* Should the current environment variables be kept
+ optional LogLevel log_level = 14;
+ /* Should the current environment variables be kept
when executing the binary */
- required bool keep_env = 15 [default = false];
- /* Should nsjail close FD=0,1,2 before executing the process */
- required bool silent = 16 [default = false];
- /* Should the child process have control over terminal?
- Can be useful to allow /bin/sh to provide
- job control / signals */
- required bool skip_setsid = 17 [default = false];
- /* Which FDs should be passed to the newly executed process
+ required bool keep_env = 15 [ default = false ];
+ /* Should nsjail close FD=0,1,2 before executing the process */
+ required bool silent = 16 [ default = false ];
+ /* Should the child process have control over terminal?
+ Can be useful to allow /bin/sh to provide
+ job control / signals */
+ required bool skip_setsid = 17 [ default = false ];
+ /* Which FDs should be passed to the newly executed process
By default only FD=0,1,2 are passed */
- repeated int32 pass_fd = 18;
- /* Should pivot_root be used instead of chroot?
+ repeated int32 pass_fd = 18;
+ /* Should pivot_root be used instead of chroot?
Using pivot_root allows to have subnamespaces */
- required bool pivot_root_only = 19 [ default = false];
- /* Setting it to true will allow to have set-uid binaries
- inside the jail */
- required bool disable_no_new_privs = 20 [default = false];
-
- required uint64 rlimit_as = 21 [default = 512]; /* In MiB */
- required uint64 rlimit_core = 22 [default = 0]; /* In MiB */
- required uint64 rlimit_cpu = 23 [default = 600]; /* In seconds */
- required uint64 rlimit_fsize = 24 [default = 1]; /* In MiB */
- required uint64 rlimit_nofile = 25 [default = 32];
- optional uint64 rlimit_nproc = 26;
- optional uint64 rlimit_stack = 27; /* In MiB */
-
- /* See 'man personality' for more */
- required bool persona_addr_compat_layout = 28 [default = false];
- required bool persona_mmap_page_zero = 29 [default = false];
- required bool persona_read_implies_exec = 30 [default = false];
- required bool persona_addr_limit_3gb = 31 [default = false];
- required bool persona_addr_no_randomize = 32 [default = false];
-
- /* Which name-spaces should be used? */
- required bool clone_newnet = 33 [default = true];
- required bool clone_newuser = 34 [default = true];
- required bool clone_newns = 35 [default = true];
- required bool clone_newpid = 36 [default = true];
- required bool clone_newipc = 37 [default = true];
- required bool clone_newuts = 38 [default = true];
- /* It's only supported in newer kernels, hence disabled by default */
- required bool clone_newcgroup = 39 [default = false];
-
- /* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
+ required bool pivot_root_only = 19 [ default = false ];
+ /* Setting it to true will allow to have set-uid binaries
+ inside the jail */
+ required bool disable_no_new_privs = 20 [ default = false ];
+
+ required uint64 rlimit_as = 21 [ default = 512 ]; /* In MiB */
+ required uint64 rlimit_core = 22 [ default = 0 ]; /* In MiB */
+ required uint64 rlimit_cpu = 23 [ default = 600 ]; /* In seconds */
+ required uint64 rlimit_fsize = 24 [ default = 1 ]; /* In MiB */
+ required uint64 rlimit_nofile = 25 [ default = 32 ];
+ optional uint64 rlimit_nproc = 26;
+ optional uint64 rlimit_stack = 27; /* In MiB */
+
+ /* See 'man personality' for more */
+ required bool persona_addr_compat_layout = 28 [ default = false ];
+ required bool persona_mmap_page_zero = 29 [ default = false ];
+ required bool persona_read_implies_exec = 30 [ default = false ];
+ required bool persona_addr_limit_3gb = 31 [ default = false ];
+ required bool persona_addr_no_randomize = 32 [ default = false ];
+
+ /* Which name-spaces should be used? */
+ required bool clone_newnet = 33 [ default = true ];
+ required bool clone_newuser = 34 [ default = true ];
+ required bool clone_newns = 35 [ default = true ];
+ required bool clone_newpid = 36 [ default = true ];
+ required bool clone_newipc = 37 [ default = true ];
+ required bool clone_newuts = 38 [ default = true ];
+ /* It's only supported in newer kernels, hence disabled by default */
+ required bool clone_newcgroup = 39 [ default = false ];
+
+ /* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
for more */
- repeated IdMap uidmap = 40;
- repeated IdMap gidmap = 41;
+ repeated IdMap uidmap = 40;
+ repeated IdMap gidmap = 41;
- /* Mount points inside the jail. See the description for 'msg MountPt'
+ /* Mount points inside the jail. See the description for 'msg MountPt'
for more */
- repeated MountPt mount = 42;
- /* Should /proc be mounted? One can also force this in the 'mount' */
- required bool mount_proc = 43 [default = true];
+ repeated MountPt mount = 42;
+ /* Should /proc be mounted? One can also force this in the 'mount' */
+ required bool mount_proc = 43 [ default = true ];
- /* Kafel seccomp policy file or string.
+ /* Kafel seccomp policy file or string.
Homepage of the project: https://github.com/google/kafel */
- optional string seccomp_policy_file = 44;
- optional string seccomp_string = 45;
-
- /* If > 0, maximum cumulative size of RAM used inside jail */
- required uint64 cgroup_mem_max = 46 [default = 0]; /* In MiB */
- /* Mount point for cgroups-memory */
- required string cgroup_mem_mount = 47 [default = "/sys/fs/cgroup/memory"];
- /* Writeable directory (for the nsjail user) under cgroup_mem_mount */
- required string cgroup_mem_parent = 48 [default = "NSJAIL"];
-
- /* If > 0, maximum number of PIDs (threads/processes) inside jail */
- required uint64 cgroup_pids_max = 49 [default = 0];
- /* Mount point for cgroups-memory */
- required string cgroup_pids_mount = 50 [default = "/sys/fs/cgroup/pids"];
- /* Writeable directory (for the nsjail user) under cgroup_pids_mount */
- required string cgroup_pids_parent = 51 [default = "NSJAIL"];
-
- /* Should the 'lo' interface be brought up inside jail? */
- required bool iface_no_lo = 52 [default = false];
-
- /* Parameters for the cloned MACVLAN interface inside jail */
- optional string macvlan_iface = 53; /* Interface to be cloned, eg 'eth0' */
- required string macvlan_vs_ip = 54 [default = "192.168.0.2"];
- required string macvlan_vs_nm = 55 [default = "255.255.255.0"];
- required string macvlan_vs_gw = 56 [default = "192.168.0.1"];
-
- /* Binary with arguments to be executed. If not specified here, it can be
+ optional string seccomp_policy_file = 44;
+ optional string seccomp_string = 45;
+
+ /* If > 0, maximum cumulative size of RAM used inside jail */
+ required uint64 cgroup_mem_max = 46 [ default = 0 ]; /* In MiB */
+ /* Mount point for cgroups-memory */
+ required string cgroup_mem_mount = 47 [ default = "/sys/fs/cgroup/memory" ];
+ /* Writeable directory (for the nsjail user) under cgroup_mem_mount */
+ required string cgroup_mem_parent = 48 [ default = "NSJAIL" ];
+
+ /* If > 0, maximum number of PIDs (threads/processes) inside jail */
+ required uint64 cgroup_pids_max = 49 [ default = 0 ];
+ /* Mount point for cgroups-memory */
+ required string cgroup_pids_mount = 50 [ default = "/sys/fs/cgroup/pids" ];
+ /* Writeable directory (for the nsjail user) under cgroup_pids_mount */
+ required string cgroup_pids_parent = 51 [ default = "NSJAIL" ];
+
+ /* Should the 'lo' interface be brought up inside jail? */
+ required bool iface_no_lo = 52 [ default = false ];
+
+ /* Parameters for the cloned MACVLAN interface inside jail */
+ optional string macvlan_iface = 53; /* Interface to be cloned, eg 'eth0' */
+ required string macvlan_vs_ip = 54 [ default = "192.168.0.2" ];
+ required string macvlan_vs_nm = 55 [ default = "255.255.255.0" ];
+ required string macvlan_vs_gw = 56 [ default = "192.168.0.1" ];
+
+ /* Binary with arguments to be executed. If not specified here, it can be
specified with the command-line as "-- /path/to/command arg1 arg2" */
- optional Exe exec_bin = 57;
+ optional Exe exec_bin = 57;
}
projects / platform / upstream / nsjail.git / commitdiff