2017-05-28 02:47:42 +08:00
|
|
|
name: "documents-with-xorg"
|
|
|
|
description: "
|
2017-05-28 06:15:53 +08:00
|
|
|
This policy allows to run many X-org based tool, which are allowed
|
|
|
|
to access $HOME/Documents directory only. An example of use is:
|
2017-05-28 02:47:42 +08:00
|
|
|
|
|
|
|
./nsjail --config configs/documents-with-xorg.cfg -- \\
|
2017-05-28 06:15:53 +08:00
|
|
|
/usr/bin/geeqie /user/Documents/
|
2017-05-28 02:47:42 +08:00
|
|
|
|
2017-05-28 06:15:53 +08:00
|
|
|
What is more, this policy doesn't allow to access networking.
|
|
|
|
"
|
2017-05-28 02:47:42 +08:00
|
|
|
|
|
|
|
mode: ONCE
|
|
|
|
hostname: "NSJAIL"
|
2017-05-28 21:15:48 +08:00
|
|
|
cwd: "/user"
|
2017-05-28 02:47:42 +08:00
|
|
|
|
|
|
|
time_limit: 1000
|
|
|
|
|
|
|
|
envar: "DISPLAY=:0"
|
2017-05-28 06:15:53 +08:00
|
|
|
envar: "HOME=/user"
|
2017-05-28 07:30:26 +08:00
|
|
|
envar: "TMP=/tmp"
|
2017-05-28 02:47:42 +08:00
|
|
|
|
2017-05-28 23:32:14 +08:00
|
|
|
rlimit_as: 2048
|
2017-05-28 02:47:42 +08:00
|
|
|
rlimit_cpu: 1000
|
2017-05-28 03:54:01 +08:00
|
|
|
rlimit_fsize: 1024
|
2017-05-28 02:47:42 +08:00
|
|
|
rlimit_nofile: 16
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib"
|
|
|
|
dst: "/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
2017-05-28 21:27:13 +08:00
|
|
|
mount {
|
|
|
|
src: "/lib64"
|
|
|
|
dst: "/lib64"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib32"
|
|
|
|
dst: "/lib32"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
2017-05-28 02:47:42 +08:00
|
|
|
mount {
|
|
|
|
src: "/bin"
|
|
|
|
dst: "/bin"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2017-05-28 21:27:13 +08:00
|
|
|
src: "/usr/bin"
|
|
|
|
dst: "/usr/bin"
|
2017-05-28 02:47:42 +08:00
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2017-05-28 21:27:13 +08:00
|
|
|
src: "/usr/share"
|
|
|
|
dst: "/usr/share"
|
2017-05-28 02:47:42 +08:00
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2017-05-28 21:27:13 +08:00
|
|
|
src: "/usr/lib"
|
|
|
|
dst: "/usr/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/usr/lib64"
|
|
|
|
dst: "/usr/lib64"
|
2017-05-28 02:47:42 +08:00
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2017-05-28 21:27:13 +08:00
|
|
|
src: "/usr/lib32"
|
|
|
|
dst: "/usr/lib32"
|
2017-05-28 02:47:42 +08:00
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/tmp"
|
|
|
|
fstype: "tmpfs"
|
2017-05-28 07:24:55 +08:00
|
|
|
rw: true
|
2017-05-28 02:47:42 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2017-05-28 06:15:53 +08:00
|
|
|
dst: "/user"
|
|
|
|
fstype: "tmpfs"
|
2017-05-28 07:24:55 +08:00
|
|
|
rw: true
|
2017-05-28 02:47:42 +08:00
|
|
|
}
|
|
|
|
|
2017-05-28 03:54:01 +08:00
|
|
|
mount {
|
2017-05-28 06:15:53 +08:00
|
|
|
prefix_src_env: "HOME"
|
|
|
|
src: "/Documents"
|
|
|
|
dst: "/user/Documents"
|
|
|
|
is_bind: true
|
2017-05-28 03:54:01 +08:00
|
|
|
}
|
|
|
|
|
2017-05-28 02:47:42 +08:00
|
|
|
mount {
|
2017-05-30 01:03:37 +08:00
|
|
|
src: "/tmp/.X11-unix"
|
|
|
|
dst: "/tmp/.X11-unix"
|
2017-05-28 02:47:42 +08:00
|
|
|
is_bind: true
|
2017-05-30 01:03:37 +08:00
|
|
|
rw: true
|
2017-05-28 02:47:42 +08:00
|
|
|
}
|
|
|
|
|
2017-05-30 01:24:14 +08:00
|
|
|
mount {
|
|
|
|
src: "/dev/null"
|
|
|
|
dst: "/dev/null"
|
|
|
|
is_bind: true
|
|
|
|
rw: true
|
|
|
|
}
|
|
|
|
|
2017-05-28 02:47:42 +08:00
|
|
|
mount {
|
|
|
|
src: "/etc/passwd"
|
|
|
|
dst: "/etc/passwd"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
seccomp_string: "
|
|
|
|
POLICY example {
|
|
|
|
KILL {
|
|
|
|
ptrace,
|
|
|
|
process_vm_readv,
|
|
|
|
process_vm_writev
|
|
|
|
}
|
|
|
|
}
|
|
|
|
USE example DEFAULT ALLOW
|
|
|
|
"
|