2021-05-05 19:50:51 +08:00
|
|
|
# Example config for nsjail
|
|
|
|
|
2019-10-01 14:27:17 +08:00
|
|
|
name: "znc-with-net"
|
|
|
|
|
|
|
|
description: "This policy allows to run znc a jail. "
|
2019-10-04 06:35:36 +08:00
|
|
|
description: "Networking is permitted with this setup (clone_newnet: false). "
|
2019-10-01 14:27:17 +08:00
|
|
|
description: ""
|
|
|
|
description: "The only permitted home directory is $HOME/.znc."
|
|
|
|
description: ""
|
|
|
|
description: "Run as: nsjail --config configs/znc-with-net.cfg"
|
|
|
|
|
|
|
|
mode: ONCE
|
|
|
|
hostname: "ZNC"
|
|
|
|
cwd: "/home/znc"
|
|
|
|
daemon: true
|
|
|
|
|
|
|
|
time_limit: 0
|
|
|
|
|
|
|
|
envar: "HOME=/home/znc"
|
|
|
|
envar: "TMP=/tmp"
|
|
|
|
|
2019-10-03 01:43:58 +08:00
|
|
|
log_fd: 2
|
|
|
|
|
2019-10-01 14:27:17 +08:00
|
|
|
rlimit_as: 4096
|
|
|
|
rlimit_cpu_type: INF
|
|
|
|
rlimit_fsize: 4096
|
|
|
|
rlimit_nofile: 128
|
|
|
|
|
|
|
|
clone_newnet: false
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/proc"
|
|
|
|
fstype: "proc"
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib"
|
|
|
|
dst: "/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/usr/lib"
|
|
|
|
dst: "/usr/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib64"
|
|
|
|
dst: "/lib64"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib32"
|
|
|
|
dst: "/lib32"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/usr/share"
|
|
|
|
dst: "/usr/share"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/dev/urandom"
|
|
|
|
dst: "/dev/urandom"
|
|
|
|
is_bind: true
|
|
|
|
rw: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/dev/null"
|
|
|
|
dst: "/dev/null"
|
|
|
|
is_bind: true
|
|
|
|
rw: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/etc/resolv.conf"
|
|
|
|
dst: "/etc/resolv.conf"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/etc/ssl"
|
|
|
|
dst: "/etc/ssl"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/tmp"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
is_bind: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/dev/shm"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
is_bind: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/home/znc"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
is_bind: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
prefix_src_env: "HOME"
|
|
|
|
src: "/.znc"
|
|
|
|
dst: "/home/znc/.znc"
|
|
|
|
rw: true
|
|
|
|
is_bind: true
|
|
|
|
mandatory: true
|
|
|
|
}
|
|
|
|
|
|
|
|
seccomp_string: "KILL {"
|
|
|
|
seccomp_string: " ptrace,"
|
|
|
|
seccomp_string: " process_vm_readv,"
|
|
|
|
seccomp_string: " process_vm_writev"
|
|
|
|
seccomp_string: "}"
|
|
|
|
seccomp_string: "DEFAULT ALLOW"
|
|
|
|
|
|
|
|
exec_bin {
|
|
|
|
path: "/usr/bin/znc"
|
|
|
|
arg: "-f"
|
|
|
|
exec_fd: true
|
|
|
|
}
|