nsjail/config.proto

syntax = "proto2";

package nsjail;

enum Mode {
	LISTEN = 0;  /* Listening on a TCP port              */
	ONCE = 1;    /* Running the command once only        */
	RERUN = 2;   /* Re-executing the command (forever)   */
	EXECVE = 3;  /* Executing command w/o the supervisor */
}

/* Should be self explanatory */
enum LogLevel {
	DEBUG = 0;
	INFO = 1;
	WARNING = 2;
	ERROR = 3;
	FATAL = 4;
}

message IdMap {
	/* Empty string means "current uid/gid" */
	required string inside_id = 1 [default = ""];
	required string outside_id = 2 [default = ""];
	/* 'man user_namespaces' for the meaning of count */
	required uint32 count = 3 [default = 1];
	/* Does this map use /usr/bin/new[u|g]idmap binary? */
	required bool use_newidmap = 4 [default = false];
}

message MountPt {
	/* Can be empty string for filesystems like 'proc' */
	required string src = 1;
	required string dst = 2;
	/* Can be empty for mount --bind mounts */
	required string fstype = 3;
	/* E.g. size=5000000 for 'tmpfs' */
	required string options = 4 [default = ""];
	/* Is it 'mount --bind src dst' type of mount */
	required bool is_bind = 5 [default = false];
	/* It it RO mount */
	required bool is_ro = 6 [default = false];
	/* Is it directory? If not specified an internal
	 * heuristics will be used to determine that */
	optional bool is_dir = 7;
}

message Exe {
	/* This will be usef both for path and for argv[0] */
	required string path = 1;
	/* This will be argv[1] and so on.. */
	repeated string arg = 2;
}

message NsJailConfig {
	/* Execution mode: see 'msg Mode' description for more */
	required Mode mode = 1 [default = ONCE];
	/* Equivalent to a mount with dst='/' */
	optional string chroot_dir = 2;
	/* Applies both to the chroot_dir and to /proc mounts */
	required bool is_root_rw = 3 [default = false];
	/* Hostname inside jail */
	required string hostname = 6 [default = "NSJAIL"];
	/* Initial current working directory for the binary */
	required string cwd = 7 [default = "/"];

	/* TCP port to listen to. Valid with mode=LISTEN only */
	required uint32 port = 8 [default = 0];
	/* Host to bind to for mode=LISTEN. Must be in IPv6 format */
	required string bindhost = 9 [default = "::"];
	/* For mode=LISTEN, maximum number of connections from a single IP */
	required uint32 max_conns_per_ip = 10 [default = 0];

	/* Wall-time time limit for commands */
	required uint32 time_limit = 11 [default = 600];
	/* Should nsjail go into background? */
	required bool daemon = 12 [default = false];
	/* File to save lofs to */
	optional string log_file = 13;
	/* Minimum log level displayed.
	   See 'msg LogLevel' description for more */
	optional LogLevel log_level = 14;
	/* Should the current environment variables be kept
	   when executing the binary */
	required bool keep_env = 15 [default = false];
	/* Should nsjail close FD=0,1,2 before executing the process */
	required bool silent = 16 [default = false];
	/* Should the child process have control over terminal?
       Can be useful to allow /bin/sh to provide
       job control / signals */
	required bool skip_setsid = 17 [default = false];
	/* Which FDs should be passed to the newly executed process
	   By default only FD=0,1,2 are passed */
	repeated int32 pass_fd = 18;
	/* Should pivot_root be used instead of chroot?
	   Using pivot_root allows to have subnamespaces */
	required bool pivot_root_only = 19 [ default = false];
	/* Setting it to true will allow to have set-uid binaries
       inside the jail */
	required bool disable_no_new_privs = 20 [default = false];

	required uint64 rlimit_as = 21 [default = 512];    /* In MiB     */
	required uint64 rlimit_core = 22 [default = 0];    /* In MiB     */
	required uint64 rlimit_cpu = 23 [default = 600];   /* In seconds */
	required uint64 rlimit_fsize = 24 [default = 1];   /* In MiB     */
	required uint64 rlimit_nofile = 25 [default = 32];
	optional uint64 rlimit_nproc = 26;
	optional uint64 rlimit_stack = 27;                 /* In MiB     */

	/* See 'man personality' for more */
	required bool persona_addr_compat_layout = 28 [default = false];
	required bool persona_mmap_page_zero = 29 [default = false];
	required bool persona_read_implies_exec = 30 [default = false];
	required bool persona_addr_limit_3gb = 31 [default = false];
	required bool persona_addr_no_randomize = 32 [default = false];

	/* Which name-spaces should be used? */
	required bool clone_newnet = 33 [default = true];
	required bool clone_newuser = 34 [default = true];
	required bool clone_newns = 35 [default = true];
	required bool clone_newpid = 36 [default = true];
	required bool clone_newipc = 37 [default = true];
	required bool clone_newuts = 38 [default = true];
	/* It's only supported in newer kernels, hence disabled by default */
	required bool clone_newcgroup = 39 [default = false];

	/* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
	   for more */
	repeated IdMap uidmap = 40;
	repeated IdMap gidmap = 41;

	/* Mount points inside the jail. See the description for 'msg MountPt'
	   for more */
	repeated MountPt mount = 42;
	/* Should /proc be mounted? One can also force this in the 'mount' */
	required bool mount_proc = 43 [default = true];

	/* Kafel seccomp policy file or string.
	   Homepage of the project: https://github.com/google/kafel */
	optional string seccomp_policy_file = 44;
	optional string seccomp_string = 45;

	/* If > 0, maximum cumulative size of RAM used inside jail */
	required uint64 cgroup_mem_max = 46 [default = 0];  /* In MiB */
	/* Mount point for cgroups-memory */
	required string cgroup_mem_mount = 47 [default = "/sys/fs/cgroup/memory"];
	/* Writeable directory (for the nsjail user) under cgroup_mem_mount */
	required string cgroup_mem_parent = 48 [default = "NSJAIL"];

	/* If > 0, maximum number of PIDs (threads/processes) inside jail */
	required uint64 cgroup_pids_max = 49 [default = 0];
	/* Mount point for cgroups-memory */
	required string cgroup_pids_mount = 50 [default = "/sys/fs/cgroup/pids"];
	/* Writeable directory (for the nsjail user) under cgroup_pids_mount */
	required string cgroup_pids_parent = 51 [default = "NSJAIL"];

	/* Should the 'lo' interface be brought up inside jail? */
	required bool iface_no_lo = 52 [default = false];

	/* Parameters for the cloned MACVLAN interface inside jail */
	optional string macvlan_iface = 53;  /* Interface to be cloned, eg 'eth0' */
	required string macvlan_vs_ip = 54 [default = "192.168.0.2"];
	required string macvlan_vs_nm = 55 [default = "255.255.255.0"];
	required string macvlan_vs_gw = 56 [default = "192.168.0.1"];

	/* Binary with arguments to be executed. If not specified here, it can be
	   specified with the command-line as "-- /path/to/command arg1 arg2" */
	optional Exe exec_bin = 57;
}