2021-05-05 19:50:51 +08:00
|
|
|
# Example config for nsjail
|
|
|
|
|
2017-12-07 21:39:19 +08:00
|
|
|
name: "xchat-with-net"
|
|
|
|
|
|
|
|
description: "This policy allows to run xchat inside a jail. Access to networking is"
|
|
|
|
description: "permitted with this setup (clone_newnet: false)."
|
|
|
|
description: ""
|
|
|
|
description: "The only permitted home directory is $HOME/.xchat2 and $HOME/Documents."
|
|
|
|
description: "The rest of available on the FS files/dires are libs and X-related files/dirs."
|
|
|
|
description: ""
|
|
|
|
description: "Run as:"
|
2019-09-29 05:00:21 +08:00
|
|
|
description: "./nsjail --config configs/xchat-with-net.cfg"
|
2017-12-07 21:39:19 +08:00
|
|
|
|
|
|
|
mode: ONCE
|
|
|
|
hostname: "XCHAT"
|
|
|
|
cwd: "/user"
|
2019-09-29 05:00:21 +08:00
|
|
|
daemon: true
|
2017-12-07 21:39:19 +08:00
|
|
|
|
|
|
|
time_limit: 0
|
2022-08-09 06:03:20 +08:00
|
|
|
max_cpus: 2
|
2017-12-07 21:39:19 +08:00
|
|
|
|
|
|
|
envar: "HOME=/user"
|
2018-10-29 00:15:55 +08:00
|
|
|
envar: "DISPLAY"
|
2017-12-07 21:39:19 +08:00
|
|
|
envar: "TMP=/tmp"
|
|
|
|
envar: "FONTCONFIG_FILE=/etc/fonts/fonts.conf"
|
|
|
|
envar: "FC_CONFIG_FILE=/etc/fonts/fonts.conf"
|
2018-10-29 00:15:55 +08:00
|
|
|
envar: "LANG"
|
2017-12-07 21:39:19 +08:00
|
|
|
|
|
|
|
rlimit_as: 4096
|
2017-12-07 22:35:52 +08:00
|
|
|
rlimit_cpu_type: INF
|
2017-12-07 21:39:19 +08:00
|
|
|
rlimit_fsize: 4096
|
|
|
|
rlimit_nofile: 128
|
|
|
|
|
|
|
|
clone_newnet: false
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/proc"
|
|
|
|
fstype: "proc"
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib"
|
|
|
|
dst: "/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/usr/lib"
|
|
|
|
dst: "/usr/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib64"
|
|
|
|
dst: "/lib64"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib32"
|
|
|
|
dst: "/lib32"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2017-12-07 22:06:31 +08:00
|
|
|
src_content: "<?xml version=\"1.0\"?>\n<!DOCTYPE fontconfig SYSTEM \"fonts.dtd\">\n<fontconfig><dir>/usr/share/fonts</dir><cachedir>/tmp/fontconfig</cachedir></fontconfig>"
|
|
|
|
dst: "/etc/fonts/fonts.conf"
|
2017-12-07 21:39:19 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/usr/share"
|
|
|
|
dst: "/usr/share"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/dev/urandom"
|
|
|
|
dst: "/dev/urandom"
|
|
|
|
is_bind: true
|
|
|
|
rw: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
2022-08-26 06:44:21 +08:00
|
|
|
src_content: "nameserver 8.8.8.8"
|
2017-12-07 21:39:19 +08:00
|
|
|
dst: "/etc/resolv.conf"
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/tmp"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
is_bind: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/dev/shm"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
is_bind: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/user"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
prefix_src_env: "HOME"
|
|
|
|
src: "/Documents"
|
|
|
|
dst: "/user/Documents"
|
|
|
|
rw: true
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
prefix_src_env: "HOME"
|
2022-10-25 20:55:04 +08:00
|
|
|
src: "/.config/xchat2"
|
2017-12-07 21:39:19 +08:00
|
|
|
dst: "/user/.xchat2"
|
|
|
|
is_bind: true
|
|
|
|
rw: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
2022-09-04 18:07:55 +08:00
|
|
|
mount {
|
|
|
|
prefix_src_env: "XAUTHORITY"
|
|
|
|
src: ""
|
|
|
|
dst: "/user/.Xauthority"
|
|
|
|
is_bind: true
|
|
|
|
rw: false
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
2017-12-07 21:39:19 +08:00
|
|
|
mount {
|
2023-01-03 15:11:47 +08:00
|
|
|
src: "/tmp/.X11-unix"
|
|
|
|
dst: "/tmp/.X11-unix"
|
2022-09-04 18:07:55 +08:00
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
2017-12-07 21:39:19 +08:00
|
|
|
}
|
|
|
|
|
2022-08-09 22:38:12 +08:00
|
|
|
seccomp_string: "KILL_PROCESS { "
|
|
|
|
seccomp_string: " ptrace, "
|
|
|
|
seccomp_string: " process_vm_readv, "
|
|
|
|
seccomp_string: " process_vm_writev "
|
|
|
|
seccomp_string: "}, "
|
|
|
|
seccomp_string: "ERRNO(1) { "
|
|
|
|
seccomp_string: " sched_setaffinity "
|
|
|
|
seccomp_string: "} "
|
|
|
|
seccomp_string: "DEFAULT ALLOW "
|
2017-12-07 21:39:19 +08:00
|
|
|
|
|
|
|
exec_bin {
|
2023-06-25 18:36:47 +08:00
|
|
|
path: "/usr/bin/xchat"
|
|
|
|
exec_fd: true
|
2017-12-07 21:39:19 +08:00
|
|
|
}
|