Robert Swiecki [Wed, 18 Oct 2017 12:27:34 +0000 (14:27 +0200)]
Move struct nsjail_t definition to nsjail.h and leave only macros in common.h
Robert Swiecki [Wed, 18 Oct 2017 10:33:24 +0000 (12:33 +0200)]
subproc: clear signal handlers in the child process
robertswiecki [Tue, 17 Oct 2017 13:40:48 +0000 (15:40 +0200)]
Merge pull request #54 from VCTLabs/compat-3.x-kernel
Revert "caps: define CAP_AUDIT_READ if not defined"
Robert Swiecki [Tue, 17 Oct 2017 13:22:23 +0000 (15:22 +0200)]
Makefile: add columnt limit to the indent
Robert Swiecki [Tue, 17 Oct 2017 13:16:27 +0000 (15:16 +0200)]
user: use setresuid32 where available first (on some 32bit platforms:
Ron Lockwood-Childs [Mon, 16 Oct 2017 21:01:10 +0000 (14:01 -0700)]
Revert "caps: define CAP_AUDIT_READ if not defined"
Restore compatibility with 3.x kernels by not requiring CAP_AUDIT_READ
if not defined in kernel header file
This reverts commit
7820553cb9296b5f1a3137153948db45309aa6b1.
Conflicts:
caps.c
contain.h
Robert Swiecki [Mon, 16 Oct 2017 13:31:14 +0000 (15:31 +0200)]
nsjail: add missing commans in nested structs and make indent
Robert Swiecki [Mon, 16 Oct 2017 13:19:07 +0000 (15:19 +0200)]
user: remove static from idx vars, it causes crash after many iterations of nsjail
robertswiecki [Thu, 12 Oct 2017 12:11:45 +0000 (14:11 +0200)]
Merge pull request #51 from jvvv/master
manpage: update for recent option changes
John Vogel [Thu, 12 Oct 2017 06:53:10 +0000 (02:53 -0400)]
manpage: update for recent option changes
Add --proc_path and --proc_rw options.
Also clean up --mode|-M option layout.
Robert Swiecki [Wed, 11 Oct 2017 13:43:59 +0000 (15:43 +0200)]
net: prettier logging in bind
Robert Swiecki [Wed, 11 Oct 2017 00:16:14 +0000 (02:16 +0200)]
cmdline: better --rw description
Robert Swiecki [Wed, 11 Oct 2017 00:10:52 +0000 (02:10 +0200)]
cmdline: add --proc_path and --proc_rw options
Robert Swiecki [Sun, 8 Oct 2017 21:06:40 +0000 (23:06 +0200)]
move VALSTR_STRUCT to common.h
Robert Swiecki [Sun, 8 Oct 2017 21:03:02 +0000 (23:03 +0200)]
allow for indentation of more structures (now with clang-format)
Robert Swiecki [Sun, 8 Oct 2017 21:00:45 +0000 (23:00 +0200)]
make indent
Robert Swiecki [Sun, 8 Oct 2017 20:52:52 +0000 (22:52 +0200)]
switch indent to clang-format completely
Robert Swiecki [Sun, 8 Oct 2017 20:50:06 +0000 (22:50 +0200)]
config.proto: reflow numbering of fields
Robert Swiecki [Sun, 8 Oct 2017 13:17:57 +0000 (15:17 +0200)]
mount: make mountIsDir static
Robert Swiecki [Sun, 8 Oct 2017 13:02:41 +0000 (15:02 +0200)]
subproc: print syscall number as decimal
Robert Swiecki [Sun, 8 Oct 2017 11:00:37 +0000 (13:00 +0200)]
cmdline: missing 'soft'/'hard' variants for RLIMIT_STACK in usage()
Robert Swiecki [Sun, 8 Oct 2017 10:57:51 +0000 (12:57 +0200)]
Merge branch 'master' of ssh://github.com/google/nsjail
Robert Swiecki [Sun, 8 Oct 2017 10:57:43 +0000 (12:57 +0200)]
cmdline: missing comparison in cmdlineParseRLimit()
robertswiecki [Sun, 8 Oct 2017 10:56:22 +0000 (12:56 +0200)]
Merge pull request #50 from jvvv/master
manpage: tweak for recent options changes
robertswiecki [Sun, 8 Oct 2017 10:55:56 +0000 (12:55 +0200)]
Merge pull request #49 from disconnect3d/small-refactor-sandbox
sandbox.c: small refactor
Robert Swiecki [Sun, 8 Oct 2017 10:00:19 +0000 (12:00 +0200)]
subproc: print si->si_errno as well as it provides user-supplied value from seccomp-bpf
Robert Swiecki [Sun, 8 Oct 2017 09:55:11 +0000 (11:55 +0200)]
subproc: reorder printing of si->si_syscall #2
Robert Swiecki [Sun, 8 Oct 2017 09:53:24 +0000 (11:53 +0200)]
subproc: reorder printing of si->si_syscall
Robert Swiecki [Sun, 8 Oct 2017 09:51:37 +0000 (11:51 +0200)]
subproc: print si->si_syscall
John Vogel [Sun, 8 Oct 2017 05:28:06 +0000 (01:28 -0400)]
manpage: tweak for recent options changes
Adjust rlimit_* options to match command line --help output.
Add --really_quiet option.
And some clean up:
Remove 'See Also' section that only references a non-existent
info page that is a relic of using help2man for initial manual
page generation.
disconnect3d [Sun, 8 Oct 2017 00:57:49 +0000 (02:57 +0200)]
sandbox.c: small refactor
Robert Swiecki [Sat, 7 Oct 2017 23:28:45 +0000 (01:28 +0200)]
mount: don't R/O remount mounts which were not mounted (not mandatory)
Robert Swiecki [Sat, 7 Oct 2017 22:36:13 +0000 (00:36 +0200)]
common: less const argv
Robert Swiecki [Sat, 7 Oct 2017 22:17:47 +0000 (00:17 +0200)]
make indent
Robert Swiecki [Sat, 7 Oct 2017 22:14:24 +0000 (00:14 +0200)]
cmdline: use mountAddMountPt in the remaining calls
Robert Swiecki [Sat, 7 Oct 2017 21:32:25 +0000 (23:32 +0200)]
cmdline/mount: mount proc at the beginning
Robert Swiecki [Sat, 7 Oct 2017 20:36:21 +0000 (22:36 +0200)]
cmdline: use soft/hard literals instead of def/max for rlimits
Robert Swiecki [Sat, 7 Oct 2017 20:33:46 +0000 (22:33 +0200)]
cmdline: missing flags for --chroot mount point
Robert Swiecki [Sat, 7 Oct 2017 20:30:19 +0000 (22:30 +0200)]
cmdline: use mountAddMountPt instead of adding structs explicitly
Robert Swiecki [Sat, 7 Oct 2017 10:37:26 +0000 (12:37 +0200)]
cmdline: better errors for setting rlimits
Robert Swiecki [Sat, 7 Oct 2017 10:33:19 +0000 (12:33 +0200)]
cmdline: 'inf' for rlimits
Robert Swiecki [Sat, 7 Oct 2017 10:31:54 +0000 (12:31 +0200)]
cmdline: descriptions of flags
Robert Swiecki [Sat, 7 Oct 2017 00:03:51 +0000 (02:03 +0200)]
cmdline: implement --really_quiet option
Robert Swiecki [Fri, 6 Oct 2017 23:54:36 +0000 (01:54 +0200)]
config: make argv static to avoid using heap
Robert Swiecki [Fri, 6 Oct 2017 22:18:21 +0000 (00:18 +0200)]
config: make config static so we can get rid of strdup()
Robert Swiecki [Fri, 6 Oct 2017 20:50:32 +0000 (22:50 +0200)]
config.proto: comments
Robert Swiecki [Fri, 6 Oct 2017 20:44:55 +0000 (22:44 +0200)]
config: indent
Robert Swiecki [Fri, 6 Oct 2017 20:44:27 +0000 (22:44 +0200)]
config: allow to use soft/hard/inf limits for rlimits
Robert Swiecki [Fri, 6 Oct 2017 17:42:58 +0000 (19:42 +0200)]
pid: comment on the ns-init process
Robert Swiecki [Tue, 3 Oct 2017 16:37:34 +0000 (18:37 +0200)]
mount: realpath is not needed as mount will realpath the path
Robert Swiecki [Sun, 1 Oct 2017 17:55:36 +0000 (19:55 +0200)]
.gitignore: ignore config.pb.*
Robert Swiecki [Sun, 1 Oct 2017 17:08:31 +0000 (19:08 +0200)]
contain: remove unnecessary includes
Robert Swiecki [Sun, 1 Oct 2017 17:01:36 +0000 (19:01 +0200)]
user: comments
Robert Swiecki [Sun, 1 Oct 2017 14:13:17 +0000 (16:13 +0200)]
user: log message
Robert Swiecki [Sun, 1 Oct 2017 14:11:46 +0000 (16:11 +0200)]
user: simplify login when running with --disable_clonew_newuser by using prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS | SECBIT_NO_SETUID_FIXUP)
Robert Swiecki [Sun, 1 Oct 2017 13:54:04 +0000 (15:54 +0200)]
user: more comments
Robert Swiecki [Sun, 1 Oct 2017 03:49:13 +0000 (05:49 +0200)]
caps: more comments
Robert Swiecki [Sun, 1 Oct 2017 03:47:10 +0000 (05:47 +0200)]
mount: print error when --disable_clone_newns is used but no --chroot was specified
Robert Swiecki [Sun, 1 Oct 2017 03:38:26 +0000 (05:38 +0200)]
caps: call prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL) early
Robert Swiecki [Sun, 1 Oct 2017 03:32:07 +0000 (05:32 +0200)]
Allow for running with --disable_newuser started as root
Robert Swiecki [Sun, 1 Oct 2017 03:16:01 +0000 (05:16 +0200)]
mount: allow to use --disable_newuser for root users
Robert Swiecki [Sun, 1 Oct 2017 02:51:56 +0000 (04:51 +0200)]
mount: remount / as private before doing any new mounts
Robert Swiecki [Sat, 30 Sep 2017 22:06:36 +0000 (00:06 +0200)]
Makefile: correct proto dep, plus some comments in caps.c
Robert Swiecki [Fri, 29 Sep 2017 23:04:35 +0000 (01:04 +0200)]
caps: define CAP_AUDIT_READ if not defined
Robert Swiecki [Fri, 29 Sep 2017 22:37:06 +0000 (00:37 +0200)]
caps: missing static function declarator
Robert Swiecki [Fri, 29 Sep 2017 22:36:11 +0000 (00:36 +0200)]
caps: refactor the code to make it readable for the --keep_caps case
Robert Swiecki [Fri, 29 Sep 2017 22:05:41 +0000 (00:05 +0200)]
cap: Don't use -libcap anymore, as it had problems with newer capabilities
Robert Swiecki [Fri, 29 Sep 2017 20:18:16 +0000 (22:18 +0200)]
cmdline: various fixes of descriptions
Robert Swiecki [Fri, 29 Sep 2017 19:31:22 +0000 (21:31 +0200)]
caps: dont' throw warning if CAP_AUDIT_READ is not understood by libcap during reading
Robert Swiecki [Fri, 29 Sep 2017 12:46:03 +0000 (14:46 +0200)]
cmdline: correct description for rlimit_ values
Robert Swiecki [Fri, 29 Sep 2017 12:32:39 +0000 (14:32 +0200)]
contain: use setrlimit64 instead of syscall(__NR_prlimit64)
robertswiecki [Fri, 29 Sep 2017 12:29:24 +0000 (14:29 +0200)]
Merge pull request #46 from ebadi/master
rlimit64 to getrlimit64
Hamid Ebadi [Fri, 29 Sep 2017 12:11:48 +0000 (14:11 +0200)]
rlimit64 to getrlimit64
Robert Swiecki [Fri, 29 Sep 2017 11:07:42 +0000 (13:07 +0200)]
Make it compile (maybe) under uClibc
Robert Swiecki [Wed, 27 Sep 2017 13:49:12 +0000 (15:49 +0200)]
configs: format seccomp policies
Robert Swiecki [Wed, 27 Sep 2017 13:36:05 +0000 (15:36 +0200)]
config: make defaults work correctly
Robert Swiecki [Wed, 27 Sep 2017 13:20:36 +0000 (15:20 +0200)]
readme: better cmd-line for docker
Robert Swiecki [Wed, 27 Sep 2017 13:18:30 +0000 (15:18 +0200)]
Dockerfile: make it compile with new c++ libprotobuf
Robert Swiecki [Tue, 26 Sep 2017 22:47:57 +0000 (00:47 +0200)]
cmdline: print error after usage and before fatal
Robert Swiecki [Tue, 26 Sep 2017 07:30:03 +0000 (09:30 +0200)]
cmdline: configs/ for --config
Robert Swiecki [Mon, 25 Sep 2017 18:06:09 +0000 (20:06 +0200)]
makefile: missing depend on pb.o
Robert Swiecki [Mon, 25 Sep 2017 18:02:07 +0000 (20:02 +0200)]
makefile: missing depend on pb.o
Robert Swiecki [Mon, 25 Sep 2017 17:54:06 +0000 (19:54 +0200)]
indent
Robert Swiecki [Mon, 25 Sep 2017 10:01:44 +0000 (12:01 +0200)]
nsjail.c: LOG_F -> LOG_W for disable_clone_newuser
Robert Swiecki [Mon, 25 Sep 2017 10:00:57 +0000 (12:00 +0200)]
nsjail.c: exit() -> LOG_F(
robertswiecki [Mon, 25 Sep 2017 09:59:39 +0000 (11:59 +0200)]
Merge pull request #43 from yoshisatoyanagisawa/master
Use 0xff as nsjail error exit status code.
Yoshisato Yanagisawa [Mon, 25 Sep 2017 05:08:22 +0000 (14:08 +0900)]
Use 0xff as nsjail error code.
For ease of distinguishing errors coming from a program executed by
nsjail and errors from nsjail, let me change nsjail error exit
status code to 0xff instead of 1.
I think most of programs use EXIT_FAILURE (i.e. 1) as a default
error exit status code.
robertswiecki [Mon, 18 Sep 2017 14:57:11 +0000 (16:57 +0200)]
Merge pull request #42 from ebadi/master
Adding the mistakenly removed line to the makefile
hamid [Mon, 18 Sep 2017 14:28:13 +0000 (16:28 +0200)]
Adding the mistakenly removed line to the makefile
Robert Swiecki [Mon, 18 Sep 2017 10:53:42 +0000 (12:53 +0200)]
Makefile: -Wno-unused-parameter for older g++
Robert Swiecki [Sat, 16 Sep 2017 16:10:28 +0000 (18:10 +0200)]
Makefile: clear -> clean
Robert Swiecki [Sat, 16 Sep 2017 14:43:01 +0000 (16:43 +0200)]
makefile: proper deps for protos #2
Robert Swiecki [Sat, 16 Sep 2017 14:39:55 +0000 (16:39 +0200)]
makefile: proper deps for protos
Robert Swiecki [Fri, 15 Sep 2017 22:31:53 +0000 (00:31 +0200)]
makefile: deal with .proto better
Robert Swiecki [Fri, 15 Sep 2017 16:12:18 +0000 (18:12 +0200)]
Makefile: remove space
Robert Swiecki [Fri, 15 Sep 2017 14:55:49 +0000 (16:55 +0200)]
config.cc: macroize utilStrDup
Robert Swiecki [Fri, 15 Sep 2017 10:50:14 +0000 (12:50 +0200)]
Updated kafel
Robert Swiecki [Thu, 14 Sep 2017 19:17:57 +0000 (21:17 +0200)]
Merge branch 'master' of ssh://github.com/google/nsjail
Robert Swiecki [Wed, 13 Sep 2017 20:03:21 +0000 (22:03 +0200)]
config: Initial work on converting config.c to c++ protobuf lib
config: Initial work on converting config.c to c++ protobuf lib #2
config: Initial work on converting config.c to c++ protobuf lib #3
config: Initial work on converting config.c to c++ protobuf lib #4
config: Initial work on converting config.c to c++ protobuf lib #5
config: Initial work on converting config.c to c++ protobuf lib #6
John Vogel [Sun, 20 Aug 2017 00:10:56 +0000 (20:10 -0400)]
Add manual page.