2017-05-26 11:01:22 +08:00
|
|
|
syntax = "proto2";
|
2017-05-26 07:55:02 +08:00
|
|
|
|
|
|
|
package nsjail;
|
|
|
|
|
2017-05-26 10:37:50 +08:00
|
|
|
enum Mode {
|
|
|
|
LISTEN = 0;
|
|
|
|
ONCE = 1;
|
|
|
|
RERUN = 2;
|
|
|
|
EXECVE = 3;
|
|
|
|
}
|
|
|
|
|
2017-05-26 20:08:09 +08:00
|
|
|
enum LogLevel {
|
|
|
|
DEBUG = 0;
|
|
|
|
INFO = 1;
|
|
|
|
WARNING = 2;
|
|
|
|
ERROR = 3;
|
|
|
|
FATAL = 4;
|
|
|
|
}
|
|
|
|
|
2017-05-26 23:50:28 +08:00
|
|
|
message IdMap {
|
2017-05-27 06:16:28 +08:00
|
|
|
required string inside_id = 1 [default = ""];
|
|
|
|
required string outside_id = 2 [default = ""];
|
2017-05-26 23:50:28 +08:00
|
|
|
required uint32 count = 3 [default = 1];
|
2017-05-27 06:33:25 +08:00
|
|
|
required bool use_newidmap = 4 [default = false];
|
2017-05-26 23:50:28 +08:00
|
|
|
}
|
|
|
|
|
2017-05-27 07:16:12 +08:00
|
|
|
message MountPt {
|
|
|
|
required string src = 1;
|
|
|
|
required string dst = 2;
|
|
|
|
required string fstype = 3;
|
|
|
|
required string options = 4 [default = ""];
|
|
|
|
required bool is_bind = 5 [default = false];
|
|
|
|
required bool is_ro = 6 [default = false];
|
|
|
|
optional bool is_dir = 7;
|
|
|
|
}
|
|
|
|
|
2017-05-26 07:55:02 +08:00
|
|
|
message NsJailConfig {
|
2017-05-26 11:01:22 +08:00
|
|
|
required Mode mode = 1 [default = ONCE];
|
2017-05-27 06:09:08 +08:00
|
|
|
optional string chroot_dir = 2;
|
2017-05-26 11:01:22 +08:00
|
|
|
required bool is_root_rw = 3 [default = false];
|
2017-05-27 06:09:08 +08:00
|
|
|
required string hostname = 6 [default = "NSJAIL"];
|
|
|
|
required string cwd = 7 [default = "/"];
|
2017-05-26 23:50:28 +08:00
|
|
|
|
2017-05-26 11:12:01 +08:00
|
|
|
required uint32 port = 8 [default = 0];
|
2017-05-27 06:09:08 +08:00
|
|
|
required string bindhost = 9 [default = "::"];
|
2017-05-26 11:12:01 +08:00
|
|
|
required uint32 max_conns_per_ip = 10 [default = 0];
|
2017-05-26 23:50:28 +08:00
|
|
|
|
2017-05-26 21:22:59 +08:00
|
|
|
required uint32 time_limit = 11 [default = 600];
|
|
|
|
required bool daemon = 12 [default = false];
|
2017-05-27 06:09:08 +08:00
|
|
|
optional string log_file = 13;
|
2017-05-26 21:22:59 +08:00
|
|
|
optional LogLevel log_level = 14;
|
2017-05-26 20:08:09 +08:00
|
|
|
required bool keep_env = 15 [default = false];
|
|
|
|
required bool silent = 16 [default = false];
|
|
|
|
required bool skip_setsid = 17 [default = false];
|
|
|
|
repeated int32 pass_fd = 18;
|
|
|
|
required bool pivot_root_only = 19 [ default = false];
|
|
|
|
required bool disable_no_new_privs = 20 [default = false];
|
2017-05-26 23:50:28 +08:00
|
|
|
|
2017-05-26 20:08:09 +08:00
|
|
|
required uint64 rlimit_as = 21 [default = 512];
|
|
|
|
required uint64 rlimit_core = 22 [default = 0];
|
|
|
|
required uint64 rlimit_cpu = 23 [default = 600];
|
|
|
|
required uint64 rlimit_fsize = 24 [default = 1];
|
|
|
|
required uint64 rlimit_nofile = 25 [default = 32];
|
|
|
|
optional uint64 rlimit_nproc = 26;
|
|
|
|
optional uint64 rlimit_stack = 27;
|
2017-05-26 23:50:28 +08:00
|
|
|
|
|
|
|
required bool persona_addr_compat_layout = 28 [default = false];
|
|
|
|
required bool persona_mmap_page_zero = 29 [default = false];
|
|
|
|
required bool persona_read_implies_exec = 30 [default = false];
|
|
|
|
required bool persona_addr_limit_3gb = 31 [default = false];
|
|
|
|
required bool persona_addr_no_randomize = 32 [default = false];
|
|
|
|
|
|
|
|
required bool clone_newnet = 33 [default = true];
|
|
|
|
required bool clone_newuser = 34 [default = true];
|
|
|
|
required bool clone_newns = 35 [default = true];
|
|
|
|
required bool clone_newpid = 36 [default = true];
|
|
|
|
required bool clone_newipc = 37 [default = true];
|
|
|
|
required bool clone_newuts = 38 [default = true];
|
|
|
|
required bool clone_newcgroup = 39 [default = false];
|
|
|
|
|
2017-05-27 05:26:07 +08:00
|
|
|
repeated IdMap uidmap = 40;
|
|
|
|
repeated IdMap gidmap = 41;
|
2017-05-27 07:16:12 +08:00
|
|
|
|
|
|
|
repeated MountPt mount = 42;
|
2017-05-26 07:55:02 +08:00
|
|
|
}
|