minijail/libminijail.c at main · google/minijail

Repository navigation

/* Copyright 2012 The ChromiumOS Authors
 * Use of this source code is governed by a BSD-style license that can be
 * found in the LICENSE file.
#define _BSD_SOURCE
#define _DEFAULT_SOURCE
#define _GNU_SOURCE
#include <asm/unistd.h>
#include <assert.h>
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h>
#include <limits.h>
#include <linux/capability.h>
#include <linux/filter.h>
#include <sched.h>
#include <signal.h>
#include <stddef.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/capability.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/prctl.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/sysmacros.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <syscall.h>
#include <unistd.h>
#include "landlock_util.h"
#include "libminijail-private.h"
#include "libminijail.h"
#include "signal_handler.h"
#include "syscall_filter.h"
#include "syscall_wrapper.h"
#include "system.h"
#include "util.h"
/* Until these are reliably available in linux/prctl.h. */
#ifndef PR_ALT_SYSCALL
#define PR_ALT_SYSCALL 0x43724f53
/* New cgroup namespace might not be in linux-headers yet. */
#ifndef CLONE_NEWCGROUP
#define CLONE_NEWCGROUP 0x02000000
#define MAX_CGROUPS 10 /* 10 different controllers supported by Linux. */
#define MAX_RLIMITS 32 /* Currently there are 15 supported by Linux. */
#define MAX_PRESERVED_FDS 256U
/* Paths to newuidmap/newgidmap helper binaries for unprivileged ID mapping. */
#ifndef NEWUIDMAP_PATH
#define NEWUIDMAP_PATH "/usr/bin/newuidmap"
#ifndef NEWGIDMAP_PATH
#define NEWGIDMAP_PATH "/usr/bin/newgidmap"
/* Keyctl commands. */
#define KEYCTL_JOIN_SESSION_KEYRING 1
 * The userspace equivalent of MNT_USER_SETTABLE_MASK, which is the mask of all
 * flags that can be modified by MS_REMOUNT.
#define MS_USER_SETTABLE_MASK                                                  \
	(MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_NOATIME | MS_NODIRATIME |       \
	 MS_RELATIME | MS_RDONLY)
 * Required for Android host glibc which is permanently stuck on 2.17. Causes
 * no harm for newer glibc versions.
#ifndef MS_NOSYMFOLLOW
/* Added locally in kernels 4.x+. */
#define MS_NOSYMFOLLOW 256
struct minijail_rlimit {
	rlim_t cur;
	rlim_t max;
struct mountpoint {
	char *src;
	char *dest;
	char *type;
	char *data;
	int has_data;
	unsigned long flags;
	struct mountpoint *next;
struct minijail_remount {
	unsigned long remount_mode;
	char *mount_name;
	struct minijail_remount *next;
struct hook {
	minijail_hook_t hook;
	void *payload;
	minijail_hook_event_t event;
	struct hook *next;
struct fs_rule {
	char *path;
	uint64_t landlock_flags;
	struct fs_rule *next;
struct preserved_fd {
	int parent_fd;
	int child_fd;
 * minijail struct: new fields should either be marshaled/unmarshaled or have a
 * comment explaining why that's unnecessary.
struct minijail {
	 * WARNING: new bool flags should always be added to this struct,
	 * unless you’re certain they don’t need to remain after marshaling.
	 * If you add a flag here you need to make sure it's
	 * accounted for in minijail_pre{enter|exec}() below.
		bool uid : 1;
		bool gid : 1;
		bool inherit_suppl_gids : 1;
		bool set_suppl_gids : 1;
		bool keep_suppl_gids : 1;
		bool use_caps : 1;
		bool capbset_drop : 1;
		bool set_ambient_caps : 1;
		bool vfs : 1;
		bool enter_vfs : 1;
		bool pids : 1;
		bool ipc : 1;
		bool uts : 1;
		bool net : 1;
		bool net_loopback : 1;
		bool enter_net : 1;
		bool ns_cgroups : 1;
		bool userns : 1;
		bool disable_setgroups : 1;
		bool seccomp : 1;
		bool remount_proc_ro : 1;
		bool no_new_privs : 1;
		bool seccomp_filter : 1;
		bool seccomp_filter_tsync : 1;
		bool seccomp_filter_logging : 1;
		bool seccomp_filter_allow_speculation : 1;
		bool chroot : 1;
		bool pivot_root : 1;
		bool mount_dev : 1;
		bool mount_tmp : 1;
		bool do_init : 1;
		bool run_as_init : 1;
		bool pid_file : 1;
		bool cgroups : 1;
		bool alt_syscall : 1;
		bool reset_signal_mask : 1;
		bool reset_signal_handlers : 1;
		bool close_open_fds : 1;
		bool new_session_keyring : 1;
		bool forward_signals : 1;
		bool setsid : 1;
		bool using_minimalistic_mountns : 1;
		bool enable_fs_restrictions : 1;
		bool enable_profile_fs_restrictions : 1;
		bool enable_default_runtime : 1;
		bool enable_new_sessions : 1;
	uid_t uid;
	gid_t gid;
	gid_t usergid;
	char *user;
	size_t suppl_gid_count;
	gid_t *suppl_gid_list;
	uint64_t caps;
	uint64_t cap_bset;
	pid_t initpid;
	int mountns_fd;
	int netns_fd;
	int fs_rules_fd;
	int effective_landlock_abi;
	int target_landlock_abi;
	char *chrootdir;
	char *pid_file_path;
	char *uidmap;
	char *gidmap;
	char *hostname;
	char *preload_path;
	 * Filename that will be executed, unless an ELF fd is used instead.
	 * This field is only used for logs and isn't included in marshaling.
	char *filename;
	size_t filter_len;
	struct sock_fprog *filter_prog;
	char *alt_syscall_table;
	struct mountpoint *mounts_head;
	struct mountpoint *mounts_tail;
	size_t mounts_count;
	unsigned long remount_mode;
	struct minijail_remount *remounts_head;
	struct minijail_remount *remounts_tail;
	size_t tmpfs_size;
	struct fs_rule *fs_rules_head;
	struct fs_rule *fs_rules_tail;
	size_t fs_rules_count;
	char *cgroups[MAX_CGROUPS];
	size_t cgroup_count;
	struct minijail_rlimit rlimits[MAX_RLIMITS];
	size_t rlimit_count;
	uint64_t securebits_skip_mask;
	struct hook *hooks_head;
	struct hook *hooks_tail;
	struct preserved_fd preserved_fds[MAX_PRESERVED_FDS];
	size_t preserved_fd_count;
	char *seccomp_policy_path;
static void run_hooks_or_die(const struct minijail *j,
			     minijail_hook_event_t event);
static bool seccomp_is_logging_allowed(const struct minijail *j)
	return seccomp_default_ret_log() || j->flags.seccomp_filter_logging;
static void free_mounts_list(struct minijail *j)
	while (j->mounts_head) {
		struct mountpoint *m = j->mounts_head;
		j->mounts_head = j->mounts_head->next;
		free(m->data);
		free(m->type);
		free(m->dest);
		free(m->src);
	// No need to clear mounts_head as we know it's NULL after the loop.
	j->mounts_tail = NULL;
static void free_remounts_list(struct minijail *j)
	while (j->remounts_head) {
		struct minijail_remount *m = j->remounts_head;
		j->remounts_head = j->remounts_head->next;
		free(m->mount_name);
	// No need to clear remounts_head as we know it's NULL after the loop.
	j->remounts_tail = NULL;
static void free_fs_rules_list(struct minijail *j)
	while (j->fs_rules_head) {
		struct fs_rule *r = j->fs_rules_head;
		j->fs_rules_head = j->fs_rules_head->next;
		free(r->path);
	j->fs_rules_tail = NULL;
 * Writes exactly n bytes from buf to file descriptor fd.
 * Returns 0 on success or a negative error code on error.
static int write_exactly(int fd, const void *buf, size_t n)
	const char *p = buf;
	while (n > 0) {
		const ssize_t written = write(fd, p, n);
		if (written < 0) {
			if (errno == EINTR)
				continue;
			return -errno;
		p += written;
		n -= written;
 * Reads exactly n bytes from file descriptor fd into buf.
 * Returns 0 on success or a negative error code on error.
static int read_exactly(int fd, void *buf, size_t n)
	char *p = buf;
	while (n > 0) {
		const ssize_t bytes = read(fd, p, n);
		if (bytes < 0) {
			if (errno == EINTR)
				continue;
			return -errno;
		if (bytes == 0) {
			errno = EPIPE;
			return -EPIPE;
		p += bytes;
		n -= bytes;
/* Closes *pfd and sets it to -1. */
static void close_and_reset(int *pfd)
	if (*pfd != -1)
		close(*pfd);
	*pfd = -1;
 * Strip out flags meant for the parent.
 * We keep things that are not inherited across execve(2) (e.g. capabilities),
 * or are easier to set after execve(2) (e.g. seccomp filters).
void minijail_preenter(struct minijail *j)
	j->flags.vfs = 0;
	j->flags.enter_vfs = 0;
	j->flags.ns_cgroups = 0;
	j->flags.net = 0;
	j->flags.net_loopback = 0;
	j->flags.uts = 0;
	j->flags.remount_proc_ro = 0;
	j->flags.pids = 0;
	j->flags.do_init = 0;
	j->flags.run_as_init = 0;
	j->flags.pid_file = 0;
	j->flags.cgroups = 0;
	j->flags.forward_signals = 0;
	j->flags.setsid = 0;
	j->remount_mode = 0;
	j->flags.using_minimalistic_mountns = 0;
	j->flags.enable_profile_fs_restrictions = 0;
	j->flags.enable_default_runtime = 0;
	j->flags.enable_new_sessions = 0;
	free_remounts_list(j);
static int get_effective_landlock_abi(struct minijail *j)
	if (j->effective_landlock_abi < 0) {
		const int abi = landlock_create_ruleset(
		    NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
		 * If we have a valid ABI, save the result. Otherwise, use 0.
		int system_abi = abi > 0 ? abi : 0;
		int target = j->target_landlock_abi;
		if (target < 0) {
			target = LANDLOCK_ABI_DEFAULT;
		j->effective_landlock_abi = MIN(system_abi, target);
	return j->effective_landlock_abi;
/* Sets fs_rules_fd to an empty ruleset, if Landlock is available. */
static int setup_fs_rules_fd(struct minijail *j)
	int effective_abi = get_effective_landlock_abi(j);
	struct minijail_landlock_ruleset_attr ruleset_attr = {
	    .handled_access_fs = landlock_get_handled_fs_mask(effective_abi),
	j->fs_rules_fd =
	    landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);
	if (j->fs_rules_fd < 0) {
		 * As of Landlock ABI=3, the useful errors we expect here are
		 * ENOSYS or EOPNOTSUPP. In both cases, Landlock is not
		 * supported by the kernel and Minijail can silently ignore it.
		 * TODO(b/300142205): log when we no longer have 5.4 kernels in
		 * ChromeOS (~EoY 2024).
		return errno;
/* Adds a rule for a given path to apply once minijail is entered. */
static int add_fs_restriction_path(struct minijail *j, const char *path,
				   uint64_t landlock_flags)
	struct fs_rule *r = calloc(1, sizeof(*r));
		return -ENOMEM;
	r->path = strdup(path);
	if (!r->path) {
		return -ENOMEM;
	r->landlock_flags = landlock_flags;
	if (j->fs_rules_tail) {
		j->fs_rules_tail->next = r;
		j->fs_rules_tail = r;
		j->fs_rules_head = r;
		j->fs_rules_tail = r;
	 * If this is our first rule, set up the rules FD early for API users.
	 * This is important for users calling minijail_enter() directly.
	 * Otherise, this is handled later inside minijail_run_internal().
	 * The reason for this is because setup_fs_rules_fd() needs to be
	 * called from inside the process that applies Landlock rules. For
	 * minijail_enter(), that's this process. For minijail_run_internal(),
	 * that's the child process.
	if (j->fs_rules_count == 0)
		setup_fs_rules_fd(j);
	j->fs_rules_count++;
bool mount_has_bind_flag(struct mountpoint *m)
	return !!(m->flags & MS_BIND);
bool mount_has_readonly_flag(struct mountpoint *m)
	return !!(m->flags & MS_RDONLY);
bool mount_events_allowed(struct mountpoint *m)
	return !!(m->flags & MS_SHARED) || !!(m->flags & MS_SLAVE);
 * Strip out flags meant for the child.
 * We keep things that are inherited across execve(2).
void minijail_preexec(struct minijail *j)
	int vfs = j->flags.vfs;
	int enter_vfs = j->flags.enter_vfs;
	int ns_cgroups = j->flags.ns_cgroups;
	int net = j->flags.net;
	int net_loopback = j->flags.net_loopback;
	int uts = j->flags.uts;
	int remount_proc_ro = j->flags.remount_proc_ro;
	int userns = j->flags.userns;
	int using_minimalistic_mountns = j->flags.using_minimalistic_mountns;
	int enable_fs_restrictions = j->flags.enable_fs_restrictions;
	int enable_profile_fs_restrictions =
	    j->flags.enable_profile_fs_restrictions;
	int enable_default_runtime = j->flags.enable_default_runtime;
	int enable_new_sessions = j->flags.enable_new_sessions;
	if (j->user)
		free(j->user);
	j->user = NULL;
	if (j->suppl_gid_list)
		free(j->suppl_gid_list);
	j->suppl_gid_list = NULL;
	if (j->preload_path)
		free(j->preload_path);
	j->preload_path = NULL;
	free_mounts_list(j);
	free_fs_rules_list(j);
	memset(&j->flags, 0, sizeof(j->flags));
	/* Now restore anything we meant to keep. */
	j->flags.vfs = vfs;
	j->flags.enter_vfs = enter_vfs;
	j->flags.ns_cgroups = ns_cgroups;
	j->flags.net = net;
	j->flags.net_loopback = net_loopback;
	j->flags.uts = uts;
	j->flags.remount_proc_ro = remount_proc_ro;
	j->flags.userns = userns;
	j->flags.using_minimalistic_mountns = using_minimalistic_mountns;
	j->flags.enable_fs_restrictions = enable_fs_restrictions;
	j->flags.enable_profile_fs_restrictions =
	    enable_profile_fs_restrictions;
	j->flags.enable_default_runtime = enable_default_runtime;
	j->flags.enable_new_sessions = enable_new_sessions;
	/* Note, |pids| will already have been used before this call. */
/* Minijail API. */
struct minijail API *minijail_new(void)
	struct minijail *j = calloc(1, sizeof(struct minijail));
		j->remount_mode = MS_PRIVATE;
		j->fs_rules_fd = -1;
		j->effective_landlock_abi = -1;
		j->target_landlock_abi = LANDLOCK_ABI_DEFAULT;
		j->flags.using_minimalistic_mountns = false;
		j->flags.enable_fs_restrictions = true;
		j->flags.enable_profile_fs_restrictions = true;
		j->flags.enable_default_runtime = true;
		j->flags.enable_new_sessions = true;
void API minijail_set_landlock_abi(struct minijail *j, int abi)
	j->target_landlock_abi = abi;
	j->effective_landlock_abi = -1;
void API minijail_change_uid(struct minijail *j, uid_t uid)
	if (uid == 0)
		die("useless change to uid 0");
	j->uid = uid;
	j->flags.uid = 1;
void API minijail_change_gid(struct minijail *j, gid_t gid)
	if (gid == 0)
		die("useless change to gid 0");
	j->gid = gid;
	j->flags.gid = 1;
void API minijail_set_supplementary_gids(struct minijail *j, size_t size,
					 const gid_t *list)
	if (j->flags.inherit_suppl_gids)
		die("cannot inherit *and* set supplementary groups");
	if (j->flags.keep_suppl_gids)
		die("cannot keep *and* set supplementary groups");
	if (size == 0) {
		/* Clear supplementary groups. */
		j->suppl_gid_list = NULL;
		j->suppl_gid_count = 0;
		j->flags.set_suppl_gids = 1;
	/* Copy the gid_t array. */
	j->suppl_gid_list = calloc(size, sizeof(gid_t));
	if (!j->suppl_gid_list) {
		die("failed to allocate internal supplementary group array");
	for (i = 0; i < size; i++) {
		j->suppl_gid_list[i] = list[i];
	j->suppl_gid_count = size;
	j->flags.set_suppl_gids = 1;
void API minijail_keep_supplementary_gids(struct minijail *j)
	j->flags.keep_suppl_gids = 1;
int API minijail_change_user(struct minijail *j, const char *user)
	uid_t uid;
	gid_t gid;
	int rc = lookup_user(user, &uid, &gid);
		return rc;
	minijail_change_uid(j, uid);
	j->user = strdup(user);
	if (!j->user)
		return -ENOMEM;
	j->usergid = gid;
int API minijail_change_group(struct minijail *j, const char *group)
	gid_t gid;
	int rc = lookup_group(group, &gid);
		return rc;
	minijail_change_gid(j, gid);
void API minijail_use_seccomp(struct minijail *j)
	j->flags.seccomp = 1;
void API minijail_no_new_privs(struct minijail *j)
	j->flags.no_new_privs = 1;
void API minijail_use_seccomp_filter(struct minijail *j)
	j->flags.seccomp_filter = 1;
void API minijail_set_seccomp_filter_tsync(struct minijail *j)
	if (j->filter_len > 0 && j->filter_prog != NULL) {
		die("minijail_set_seccomp_filter_tsync() must be called "
		    "before minijail_parse_seccomp_filters()");
	if (seccomp_is_logging_allowed(j) && !seccomp_ret_log_available()) {
		 * If SECCOMP_RET_LOG is not available, we don't want to use
		 * SECCOMP_RET_TRAP to both kill the entire process and report
		 * failing syscalls, since it will be brittle. Just bail.
		die("SECCOMP_RET_LOG not available, cannot use logging with "
		    "thread sync at the same time");
	j->flags.seccomp_filter_tsync = 1;
void API minijail_set_seccomp_filter_allow_speculation(struct minijail *j)
	if (j->filter_len > 0 && j->filter_prog != NULL) {
		die("minijail_set_seccomp_filter_allow_speculation() must be "
		    "called before minijail_parse_seccomp_filters()");
	j->flags.seccomp_filter_allow_speculation = 1;
void API minijail_log_seccomp_filter_failures(struct minijail *j)
	if (j->filter_len > 0 && j->filter_prog != NULL) {
		die("minijail_log_seccomp_filter_failures() must be called "
		    "before minijail_parse_seccomp_filters()");
	if (j->flags.seccomp_filter_tsync && !seccomp_ret_log_available()) {
		 * If SECCOMP_RET_LOG is not available, we don't want to use
		 * SECCOMP_RET_TRAP to both kill the entire process and report
		 * failing syscalls, since it will be brittle. Just bail.
		die("SECCOMP_RET_LOG not available, cannot use thread sync "
		    "with logging at the same time");
	if (debug_logging_allowed()) {
		j->flags.seccomp_filter_logging = 1;
		warn("non-debug build: ignoring request to enable seccomp "
		     "logging");
void API minijail_set_using_minimalistic_mountns(struct minijail *j)
	j->flags.using_minimalistic_mountns = true;
void API minijail_set_enable_new_sessions(struct minijail *j,
					  bool enable_new_sessions)
	j->flags.enable_new_sessions = enable_new_sessions;
void API minijail_set_enable_default_runtime(struct minijail *j,
					     bool enable_default_runtime)
	j->flags.enable_default_runtime = enable_default_runtime;
bool API minijail_get_enable_default_runtime(struct minijail *j)
	return j->flags.enable_default_runtime;
bool API minijail_is_fs_restriction_available(void)
	const int abi =
	    landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
	// ABI > 0 is considered supported.
	return abi > 0;
void API minijail_disable_fs_restrictions(struct minijail *j)
	j->flags.enable_fs_restrictions = false;
void API minijail_set_enable_profile_fs_restrictions(struct minijail *j)
	j->flags.enable_profile_fs_restrictions = true;
void API minijail_add_minimalistic_mountns_fs_rules(struct minijail *j)
	struct mountpoint *m = j->mounts_head;
	bool landlock_enabled_by_profile = false;
	if (!j->flags.using_minimalistic_mountns ||
	    !j->flags.enable_profile_fs_restrictions)
	/* Apply Landlock rules. */
	while (m) {
		landlock_enabled_by_profile = true;
		minijail_add_fs_restriction_rx(j, m->dest);
		 * Allow rw if mounted as writable, or mount flags allow mount
		 * events.
		if (!mount_has_readonly_flag(m) || mount_events_allowed(m))
			minijail_add_fs_restriction_advanced_rw(j, m->dest);
		m = m->next;
	if (landlock_enabled_by_profile) {
		minijail_enable_default_fs_restrictions(j);
		minijail_add_fs_restriction_edit(j, "/dev");
		minijail_add_fs_restriction_ro(j, "/proc");
		if (j->flags.vfs)
			minijail_add_fs_restriction_rw(j, "/tmp");
void API minijail_enable_default_fs_restrictions(struct minijail *j)
	// Common library locations.
	minijail_add_fs_restriction_rx(j, "/lib");
	minijail_add_fs_restriction_rx(j, "/lib64");
	minijail_add_fs_restriction_rx(j, "/usr/lib");
	minijail_add_fs_restriction_rx(j, "/usr/lib64");
	// Common locations for services invoking Minijail.
	minijail_add_fs_restriction_rx(j, "/bin");
	minijail_add_fs_restriction_rx(j, "/sbin");
	minijail_add_fs_restriction_rx(j, "/usr/sbin");
	minijail_add_fs_restriction_rx(j, "/usr/bin");
	// Common /etc locations.
	minijail_add_fs_restriction_ro(j, "/etc/group");
	minijail_add_fs_restriction_ro(j, "/etc/passwd");
void API minijail_use_caps(struct minijail *j, uint64_t capmask)
	 * 'minijail_use_caps' configures a runtime-capabilities-only
	 * environment, including a bounding set matching the thread's runtime
	 * (permitted|inheritable|effective) sets.
	 * Therefore, it will override any existing bounding set configurations
	 * since the latter would allow gaining extra runtime capabilities from
	 * file capabilities.
	if (j->flags.capbset_drop) {
		warn("overriding bounding set configuration");
		j->cap_bset = 0;
		j->flags.capbset_drop = 0;
	j->caps = capmask;
	j->flags.use_caps = 1;
void API minijail_capbset_drop(struct minijail *j, uint64_t capmask)
	if (j->flags.use_caps) {
		 * 'minijail_use_caps' will have already configured a capability
		 * bounding set matching the (permitted|inheritable|effective)
		 * sets. Abort if the user tries to configure a separate
		 * bounding set. 'minijail_capbset_drop' and 'minijail_use_caps'
		 * are mutually exclusive.
		die("runtime capabilities already configured, can't drop "
		    "bounding set separately");
	j->cap_bset = capmask;
	j->flags.capbset_drop = 1;
void API minijail_set_ambient_caps(struct minijail *j)
	j->flags.set_ambient_caps = 1;
void API minijail_reset_signal_mask(struct minijail *j)
	j->flags.reset_signal_mask = 1;
void API minijail_reset_signal_handlers(struct minijail *j)
	j->flags.reset_signal_handlers = 1;
void API minijail_namespace_vfs(struct minijail *j)
	j->flags.vfs = 1;
void API minijail_namespace_enter_vfs(struct minijail *j, const char *ns_path)
	/* Note: Do not use O_CLOEXEC here.  We'll close it after we use it. */
	int ns_fd = open(ns_path, O_RDONLY);
	if (ns_fd < 0) {
		pdie("failed to open namespace '%s'", ns_path);
	j->mountns_fd = ns_fd;
	j->flags.enter_vfs = 1;
void API minijail_new_session_keyring(struct minijail *j)
	j->flags.new_session_keyring = 1;
void API minijail_skip_setting_securebits(struct minijail *j,
					  uint64_t securebits_skip_mask)
	j->securebits_skip_mask = securebits_skip_mask;
void API minijail_remount_mode(struct minijail *j, unsigned long mode)
	j->remount_mode = mode;
void API minijail_skip_remount_private(struct minijail *j)
	j->remount_mode = 0;
void API minijail_namespace_pids(struct minijail *j)
	j->flags.vfs = 1;
	j->flags.remount_proc_ro = 1;
	j->flags.pids = 1;
	j->flags.do_init = 1;
void API minijail_namespace_pids_rw_proc(struct minijail *j)
	j->flags.vfs = 1;
	j->flags.pids = 1;
	j->flags.do_init = 1;
void API minijail_namespace_ipc(struct minijail *j)
	j->flags.ipc = 1;
void API minijail_namespace_uts(struct minijail *j)
	j->flags.uts = 1;
int API minijail_namespace_set_hostname(struct minijail *j, const char *name)
	if (j->hostname)
		return -EINVAL;
	minijail_namespace_uts(j);
	j->hostname = strdup(name);
	if (!j->hostname)
		return -ENOMEM;
void API minijail_namespace_net_loopback(struct minijail *j,
					 bool enable_loopback)
	j->flags.net = 1;
	j->flags.net_loopback = enable_loopback;
void API minijail_namespace_net(struct minijail *j)
	minijail_namespace_net_loopback(j, true);
void API minijail_namespace_enter_net(struct minijail *j, const char *ns_path)
	/* Note: Do not use O_CLOEXEC here.  We'll close it after we use it. */
	int ns_fd = open(ns_path, O_RDONLY);
	if (ns_fd < 0) {
		pdie("failed to open namespace '%s'", ns_path);
	j->netns_fd = ns_fd;
	j->flags.enter_net = 1;
void API minijail_namespace_cgroups(struct minijail *j)
	j->flags.ns_cgroups = 1;
void API minijail_close_open_fds(struct minijail *j)
	j->flags.close_open_fds = 1;
void API minijail_remount_proc_readonly(struct minijail *j)
	j->flags.vfs = 1;
	j->flags.remount_proc_ro = 1;
void API minijail_namespace_user(struct minijail *j)
	j->flags.userns = 1;
void API minijail_namespace_user_disable_setgroups(struct minijail *j)
	j->flags.disable_setgroups = 1;
int API minijail_uidmap(struct minijail *j, const char *uidmap)
	j->uidmap = strdup(uidmap);
	if (!j->uidmap)
		return -ENOMEM;
	for (ch = j->uidmap; *ch; ch++) {
		if (*ch == ',')
			*ch = '\n';
int API minijail_gidmap(struct minijail *j, const char *gidmap)
	j->gidmap = strdup(gidmap);
	if (!j->gidmap)
		return -ENOMEM;
	for (ch = j->gidmap; *ch; ch++) {
		if (*ch == ',')
			*ch = '\n';
void API minijail_inherit_usergroups(struct minijail *j)
	j->flags.inherit_suppl_gids = 1;
void API minijail_run_as_init(struct minijail *j)
	 * Since the jailed program will become 'init' in the new PID namespace,
	 * Minijail does not need to fork an 'init' process.
	j->flags.run_as_init = 1;
int API minijail_enter_chroot(struct minijail *j, const char *dir)
	if (j->chrootdir)
		return -EINVAL;
	j->chrootdir = strdup(dir);
	if (!j->chrootdir)
		return -ENOMEM;
	j->flags.chroot = 1;
View remainder of file in raw view
FilesExpand file tree

libminijail.c

Latest commit

History

libminijail.c

File metadata and controls
