2021-05-05 19:50:51 +08:00
|
|
|
# Example config for nsjail
|
|
|
|
|
2017-05-28 09:22:11 +08:00
|
|
|
name: "imagemagick-convert"
|
|
|
|
|
2017-09-14 04:03:21 +08:00
|
|
|
description: "This policy allows to run ImageMagick's convert inside a jail."
|
|
|
|
description: "Your $HOME's Documents will be mapped as /user/Documents"
|
|
|
|
description: ""
|
|
|
|
description: "Run as:"
|
|
|
|
description: ""
|
2021-08-10 23:46:44 +08:00
|
|
|
description: "./nsjail --config imagemagick-convert.cfg -- /usr/bin/convert jpg:/user/Documents/input.jpg png:/user/Documents/output.png "
|
|
|
|
description: "or "
|
|
|
|
description: "./nsjail --config imagemagick-convert.cfg -- /usr/bin/convert jpg:- png:- <file.jpg >file.png
|
2017-05-28 09:22:11 +08:00
|
|
|
|
|
|
|
mode: ONCE
|
|
|
|
hostname: "IM-CONVERT"
|
|
|
|
cwd: "/user"
|
|
|
|
|
|
|
|
time_limit: 120
|
|
|
|
|
|
|
|
envar: "HOME=/user"
|
|
|
|
envar: "TMP=/tmp"
|
|
|
|
|
2017-05-28 23:42:15 +08:00
|
|
|
rlimit_as: 2048
|
2017-05-28 09:22:11 +08:00
|
|
|
rlimit_cpu: 1000
|
|
|
|
rlimit_fsize: 1024
|
2017-12-05 22:01:27 +08:00
|
|
|
rlimit_nofile: 64
|
2017-05-28 09:22:11 +08:00
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib"
|
|
|
|
dst: "/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/usr/lib"
|
|
|
|
dst: "/usr/lib"
|
|
|
|
is_bind: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib64"
|
|
|
|
dst: "/lib64"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
src: "/lib32"
|
|
|
|
dst: "/lib32"
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/tmp"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
is_bind: false
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
dst: "/user"
|
|
|
|
fstype: "tmpfs"
|
|
|
|
rw: true
|
|
|
|
}
|
|
|
|
|
|
|
|
mount {
|
|
|
|
prefix_src_env: "HOME"
|
|
|
|
src: "/Documents"
|
|
|
|
dst: "/user/Documents"
|
|
|
|
rw: true
|
|
|
|
is_bind: true
|
|
|
|
mandatory: false
|
|
|
|
}
|
|
|
|
|
2018-09-06 17:14:24 +08:00
|
|
|
seccomp_string: "ALLOW {"
|
|
|
|
seccomp_string: " read, write, open, openat, close, newstat, newfstat,"
|
|
|
|
seccomp_string: " newlstat, lseek, mmap, mprotect, munmap, brk,"
|
|
|
|
seccomp_string: " rt_sigaction, rt_sigprocmask, pwrite64, access,"
|
|
|
|
seccomp_string: " getpid, execveat, getdents, unlink, fchmod,"
|
|
|
|
seccomp_string: " getrlimit, getrusage, sysinfo, times, futex,"
|
|
|
|
seccomp_string: " arch_prctl, sched_getaffinity, set_tid_address,"
|
|
|
|
seccomp_string: " clock_gettime, set_robust_list, exit_group,"
|
2019-07-12 22:07:06 +08:00
|
|
|
seccomp_string: " clone, getcwd, pread64, readlink, prlimit64, madvise"
|
2017-09-27 21:49:12 +08:00
|
|
|
seccomp_string: "}"
|
2018-09-06 17:14:24 +08:00
|
|
|
seccomp_string: "DEFAULT KILL"
|
2017-12-05 22:01:27 +08:00
|
|
|
|
|
|
|
exec_bin {
|
2019-04-02 05:32:06 +08:00
|
|
|
path: ""
|
|
|
|
arg0: "/usr/bin/convert"
|
2017-12-05 22:01:27 +08:00
|
|
|
exec_fd: true
|
|
|
|
}
|