Repository navigation
Tags
Tags
Minijail v17. Tons of stuff in this release, we haven't tagged a release in a while. A list of non-merge commits follows: cdc8af3 minijail: Make denylist compiler return Errno bb2efc5 minijail: Add swapon and swapoff to seccomp linter c838e36 minijail: Add 8000 duplicate syscall checking to seccomp linter 8cc919a Add Allen to OWNERS. 74296b3 rust/minijail: Add support for fexecve. 2e46c51 rust: Add bindgen logic to build.rs. de0f0e7 rust/minijail: Remove fork from tests. 05af776 Add minijail_run_fd_env_pid_pipes with support for fexecve. e901bdd minijail: add to uprev docs 94cff17 util: add helpers for automatic cleanup of fd's on scope exit 21764b8 Add upgrade instructions for Chrome OS. c150d6d util: expose cleanup APIs for C code only 9c3abf5 rust/OWNERS: Replace xooglers. 543e374 seccomp: Add seccomp policy linter in minijail/tools 66417bd Relocate pipe_fds if they would be clobbered by a redirected fd. 1e925f7 Clear FD_CLOEXEC for preserved file descriptors. debdf5d util: add helpers for automatic cleanup on scope exit 99f8416 Remove libc_headers from cc_object 8ef6125 minijail: add default ret log build-time option 4820a38 seccomp: Define and parse new denylist policy language 005c903 Fix a few fd leaks. ceb8000 minijail: Modify compile_seccomp_policy to compile denylist policies 2453b1f rust/minijail: Make path to sleep in test an absolute path. 21eaf62 rust: Bump patch version numbers since new APIs were added. b06ce9b Increase MAX_PRESERVED_FDS to 128 14ad2ce Make available to com.android.compos apex 6dc224f Add minijail_copy_jail 1403606 Don't log the warning for an expected kill 11395a6 rust/minijail: Fix cast to c_char. f16b78b Make run/run_remap more generic c718268 Add overlap handling to redirect_fds(). 2a227b7 Move OWNERS.rust to rust/OWNERS. 96cd7cc rust/minijail: Allow more flexible args than `&Path` 32a3b69 Android: update C std to gnu11 bd99fbb Fix usage of OWNERS.rust. ab5fdce Add kill function 3f5a830 rust/minijail: Add fork_remap test. 81cefe2 Fix clippy warnings. 911c99d Ignore IntelliJ projects. 4f830bd test: Use googletest 1.10 54277f1 minijail: Add historical memo. b5546ad ANDROID: Add io_uring_* syscall definitions 53491dc Improve instructions to generate seccomp policies afa54be Revert "minijail: Add mount propagation granularity to minijail0" 0026947 generate_seccomp_policy: Workaround for private ARM syscalls 39bb48d Regenerate linux-x86/libconstants.gen.c 28fd840 Fix syscall_filter_unittest_gtest locally 5f579b8 [LSC] Add LOCAL_LICENSE_KINDS to external/minijail 3a6e925 tools/compile_seccomp_policy: Avoid shadowing the `parser` module e119bbb minijail: Don't allow stricter remounting of specific dir 079c40a minijail: Add mount propagation granularity to minijail0 835f717 minijail: Add mount propagation granularity to libminijail 01f28ac generate_seccomp_policy: Ignore extraneous SYSCALL records b790c60 generate_seccomp_policy: Frontend for audit logs b492911 Add instructions for using the seccomp compiler successfully. 2521491 libminijail_unittest: Deflake the namespace tests 604cc7b mount-dev: set up empty /dev/shm for glibc APIs a63407a libminijail: Avoid unnecessary dup2(2) calls 031568c Fix newline. 4baeafa test: Fix the ASan tests 59a6449 tools/compile_seccomp_policy: Support the seccomp user notification mechanism 01b628c libminijail: Refactor `seccomp_filter_flags_available()` a8b6fa4 OWNERS: Remove lhchavez@google.com 1081a94 add crosvm to com.android.virt 320c4fc Stop attempting to unmount /proc in the user namespace case. 31adc6c minijail0: Add flag to allow speculative execution on seccomp enabled processes a5fbd02 rust: Use respectful terms. 42c9997 gitignore: Ignore VSCode workspace file. aba3946 minijail: Add tests to check for duplicate syscall definitions ed25bf3 Add product_available to product available modules 461d8fb minijail: Get number of syscalls at compile-time bcc8cfd minijail: Check for repeat syscall definitions d23ad79 Implement SECCOMP_RET_KILL_PROCESS. 74024f6 minijail: Update hacking documentation e712dee README: use the github page as the homepage df7a49b Fix test-only memory leak. 046412d gen_constants.sh: use POSIX character classes. c942ed0 removes extraneous semicolon 5f9e300 libminijail: add a string marshal helper 0a27ab0 libminijail: localize internal APIs 9e1ac37 minijail0: Remount mounts as MS_SLAVE by default. 34e327e util: add unittests for constant bases 70b15b8 util: move unittests to the right module c9b0799 minijail0: add hint to -b for optional destination 1036cd8 add missing error checking for various allocations 3b58ccb Workarounds for Android host glibc toolchain 0a032ae minijail0.sh: add helper for local testing 54fa732 rust: Link libminijail.so dynamically 35b9596 libminijailpreload: clear __MINIJAIL_FD before running main() 75b0c11 README: Fix slides link. 81df066 Disable darwin build of rust libminijail 7f5b63b Updated for changes to cargo2android.py 85d797e rust/minijail: Add change_user, change_group, and wait. 9072fad Add Android.bp for minijail rust library (host) f95f8cb rust/minijail: Use minijail_sys::rlim_t instead of libc::rlim64_t. 69e3fc6 rust/minijail: Add support for mapping fds to a different fd number. dd66b18 Set min_sdk_version to be part of mainline modules a1fe6b8 Set apex_available property
Minijail v15. New in this release: * Allow more than one @include per syscall filter (zachr@google.com). * Close redirected fds after dup2()-ing them (mnissler@google.com). * Return MINIJAIL_ERR_MOUNT instead of crashing if mount_one fails (fdegros@chromium.org).
PreviousNext