From 082b3821bbcfa2b03c6740e5b0fba4b095ceaa5f Mon Sep 17 00:00:00 2001 From: Robert Swiecki Date: Thu, 26 Oct 2017 00:34:32 +0200 Subject: [PATCH] Makefile/indent: add clang-format for proto --- Makefile | 1 + cgroup.c | 6 +- config.proto | 163 +++++++++++++++++++++++++-------------------------- 3 files changed, 84 insertions(+), 86 deletions(-) diff --git a/Makefile b/Makefile index 6faa2af..85772f2 100644 --- a/Makefile +++ b/Makefile @@ -93,6 +93,7 @@ depend: indent: clang-format -style="{BasedOnStyle: google, IndentWidth: 8, UseTab: Always, IndentCaseLabels: false, ColumnLimit: 100, AlignAfterOpenBracket: false}" -i -sort-includes *.c *.h $(SRCS_CXX) + clang-format -style="{BasedOnStyle: google, IndentWidth: 4, UseTab: Always, ColumnLimit: 100}" -i $(SRCS_PROTO) # DO NOT DELETE THIS LINE -- make depend depends on it. diff --git a/cgroup.c b/cgroup.c index e523bc8..4e5a7b5 100644 --- a/cgroup.c +++ b/cgroup.c @@ -154,13 +154,13 @@ static bool cgroupInitNsFromParentNetCls(struct nsjconf_t* nsjconf, pid_t pid) { } bool cgroupInitNsFromParent(struct nsjconf_t* nsjconf, pid_t pid) { - if (cgroupInitNsFromParentMem(nsjconf, pid) == false) { + if (!cgroupInitNsFromParentMem(nsjconf, pid)) { return false; } - if (cgroupInitNsFromParentPids(nsjconf, pid) == false) { + if (!cgroupInitNsFromParentPids(nsjconf, pid)) { return false; } - if (cgroupInitNsFromParentNetCls(nsjconf, pid) == false) { + if (!cgroupInitNsFromParentNetCls(nsjconf, pid)) { return false; } return true; diff --git a/config.proto b/config.proto index d364960..335c6f4 100644 --- a/config.proto +++ b/config.proto @@ -4,30 +4,28 @@ package nsjail; enum Mode { LISTEN = 0; /* Listening on a TCP port */ - ONCE = 1; /* Running the command once only */ - RERUN = 2; /* Re-executing the command (forever) */ + ONCE = 1; /* Running the command once only */ + RERUN = 2; /* Re-executing the command (forever) */ EXECVE = 3; /* Executing command w/o the supervisor */ } /* Should be self explanatory */ enum LogLevel { - DEBUG = 0; /* Equivalent to the '-v' cmd-line option */ - INFO = 1; /* Default level */ + DEBUG = 0; /* Equivalent to the '-v' cmd-line option */ + INFO = 1; /* Default level */ WARNING = 2; /* Equivalent to the '-q' cmd-line option */ ERROR = 3; FATAL = 4; } -message IdMap -{ +message IdMap { /* Empty string means "current uid/gid" */ - optional string inside_id = 1 [ default = "" ]; - optional string outside_id = 2 [ default = "" ]; + optional string inside_id = 1 [default = ""]; + optional string outside_id = 2 [default = ""]; /* See 'man user_namespaces' for the meaning of count */ - optional uint32 count = 3 [ default = 1 ]; + optional uint32 count = 3 [default = 1]; /* Does this map use /usr/bin/new[u|g]idmap binary? */ - optional bool use_newidmap = 4 [ default = false ]; + optional bool use_newidmap = 4 [default = false]; } -message MountPt -{ +message MountPt { /* Can be skipped for filesystems like 'proc' */ optional string src = 1; /* Should 'src' path be prefixed with this envvar? */ @@ -39,29 +37,28 @@ message MountPt /* Should 'dst' path be prefixed with this envvar? */ optional string prefix_dst_env = 5; /* Can be empty for mount --bind mounts */ - optional string fstype = 6 [ default = "" ]; + optional string fstype = 6 [default = ""]; /* E.g. size=5000000 for 'tmpfs' */ - optional string options = 7 [ default = "" ]; + optional string options = 7 [default = ""]; /* Is it 'mount --bind src dst' type of mount */ - optional bool is_bind = 8 [ default = false ]; + optional bool is_bind = 8 [default = false]; /* It it R/W mount */ - optional bool rw = 9 [ default = false ]; + optional bool rw = 9 [default = false]; /* Is it directory? If not specified an internal heuristics will be used to determine that */ optional bool is_dir = 10; /* Should the sandboxing fail if we cannot mount this resource? */ - optional bool mandatory = 11 [ default = true ]; + optional bool mandatory = 11 [default = true]; /* Is it a symlink (instead of real mount point)? */ - optional bool is_symlink = 12 [ default = false ]; + optional bool is_symlink = 12 [default = false]; } enum RLimit { VALUE = 0; /* Use the provided value */ - SOFT = 1; /* Use the current soft rlimit */ - HARD = 2; /* Use the current hard rlimit */ - INF = 3; /* Use RLIM64_INFINITY */ + SOFT = 1; /* Use the current soft rlimit */ + HARD = 2; /* Use the current hard rlimit */ + INF = 3; /* Use RLIM64_INFINITY */ } -message Exe -{ +message Exe { /* Will be used both as execv's path and as argv[0] */ required string path = 1; /* This will be argv[1] and so on.. */ @@ -69,38 +66,37 @@ message Exe /* Override argv[0] */ optional string arg0 = 3; /* Should execveat() be used to execute a file-descriptor instead? */ - optional bool exec_fd = 4 [ default = false ]; + optional bool exec_fd = 4 [default = false]; } -message NsJailConfig -{ +message NsJailConfig { /* Optional name and description for this config */ - optional string name = 1 [ default = "" ]; + optional string name = 1 [default = ""]; repeated string description = 2; /* Execution mode: see 'msg Mode' description for more */ - optional Mode mode = 3 [ default = ONCE ]; + optional Mode mode = 3 [default = ONCE]; /* Equivalent to a bind mount with dst='/' */ optional string chroot_dir = 4; /* Applies both to the chroot_dir and to /proc mounts */ - optional bool is_root_rw = 5 [ default = false ]; + optional bool is_root_rw = 5 [default = false]; /* Hostname inside jail */ - optional string hostname = 8 [ default = "NSJAIL" ]; + optional string hostname = 8 [default = "NSJAIL"]; /* Initial current working directory for the binary */ - optional string cwd = 9 [ default = "/" ]; + optional string cwd = 9 [default = "/"]; /* TCP port to listen to. Valid with mode=LISTEN only */ - optional uint32 port = 10 [ default = 0 ]; + optional uint32 port = 10 [default = 0]; /* Host to bind to for mode=LISTEN. Must be in IPv6 format */ - optional string bindhost = 11 [ default = "::" ]; + optional string bindhost = 11 [default = "::"]; /* For mode=LISTEN, maximum number of connections from a single IP */ - optional uint32 max_conns_per_ip = 12 [ default = 0 ]; + optional uint32 max_conns_per_ip = 12 [default = 0]; /* Wall-time time limit for commands */ - optional uint32 time_limit = 13 [ default = 600 ]; + optional uint32 time_limit = 13 [default = 600]; /* Should nsjail go into background? */ - optional bool daemon = 14 [ default = false ]; + optional bool daemon = 14 [default = false]; /* Maximum number of CPUs to use: 0 - no limit */ - optional uint32 max_cpus = 15 [ default = 0 ]; + optional uint32 max_cpus = 15 [default = 0]; /* FD to log to. */ optional int32 log_fd = 16; @@ -112,63 +108,64 @@ message NsJailConfig /* Should the current environment variables be kept when executing the binary */ - optional bool keep_env = 19 [ default = false ]; + optional bool keep_env = 19 [default = false]; /* EnvVars to be set before executing binaries */ repeated string envar = 20; /* Should capabilities be preserved or dropped */ - optional bool keep_caps = 21 [ default = false ]; + optional bool keep_caps = 21 [default = false]; /* Which capabilities should be preserved if keep_caps == false. Format: "CAP_SYS_PTRACE" */ repeated string cap = 22; /* Should nsjail close FD=0,1,2 before executing the process */ - optional bool silent = 23 [ default = false ]; + optional bool silent = 23 [default = false]; /* Should the child process have control over terminal? Can be useful to allow /bin/sh to provide job control / signals */ - optional bool skip_setsid = 24 [ default = false ]; + optional bool skip_setsid = 24 [default = false]; /* Which FDs should be passed to the newly executed process By default only FD=0,1,2 are passed */ repeated int32 pass_fd = 25; /* Setting it to true will allow to have set-uid binaries inside the jail */ - optional bool disable_no_new_privs = 26 [ default = false ]; + optional bool disable_no_new_privs = 26 [default = false]; /* Various rlimits, the rlimit_as/rlimit_core/... are used only if rlimit_as_type/rlimit_core_type/... are set to RLimit::VALUE */ - optional uint64 rlimit_as = 27 [ default = 512 ]; /* In MiB */ - optional RLimit rlimit_as_type = 28 [ default = VALUE ]; - optional uint64 rlimit_core = 29 [ default = 0 ]; /* In MiB */ - optional RLimit rlimit_core_type = 30 [ default = VALUE ]; - optional uint64 rlimit_cpu = 31 [ default = 600 ]; /* In seconds */ - optional RLimit rlimit_cpu_type = 32 [ default = VALUE ]; - optional uint64 rlimit_fsize = 33 [ default = 1 ]; /* In MiB */ - optional RLimit rlimit_fsize_type = 34 [ default = VALUE ]; - optional uint64 rlimit_nofile = 35 [ default = 32 ]; - optional RLimit rlimit_nofile_type = 36 [ default = VALUE ]; - /* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by default here */ - optional uint64 rlimit_nproc = 37 [ default = 1024 ]; - optional RLimit rlimit_nproc_type = 38 [ default = SOFT ]; + optional uint64 rlimit_as = 27 [default = 512]; /* In MiB */ + optional RLimit rlimit_as_type = 28 [default = VALUE]; + optional uint64 rlimit_core = 29 [default = 0]; /* In MiB */ + optional RLimit rlimit_core_type = 30 [default = VALUE]; + optional uint64 rlimit_cpu = 31 [default = 600]; /* In seconds */ + optional RLimit rlimit_cpu_type = 32 [default = VALUE]; + optional uint64 rlimit_fsize = 33 [default = 1]; /* In MiB */ + optional RLimit rlimit_fsize_type = 34 [default = VALUE]; + optional uint64 rlimit_nofile = 35 [default = 32]; + optional RLimit rlimit_nofile_type = 36 [default = VALUE]; + /* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by + * default here */ + optional uint64 rlimit_nproc = 37 [default = 1024]; + optional RLimit rlimit_nproc_type = 38 [default = SOFT]; /* In MiB, use the soft limit value by default */ - optional uint64 rlimit_stack = 39 [ default = 1048576 ]; - optional RLimit rlimit_stack_type = 40 [ default = SOFT ]; + optional uint64 rlimit_stack = 39 [default = 1048576]; + optional RLimit rlimit_stack_type = 40 [default = SOFT]; /* See 'man personality' for more */ - optional bool persona_addr_compat_layout = 41 [ default = false ]; - optional bool persona_mmap_page_zero = 42 [ default = false ]; - optional bool persona_read_implies_exec = 43 [ default = false ]; - optional bool persona_addr_limit_3gb = 44 [ default = false ]; - optional bool persona_addr_no_randomize = 45 [ default = false ]; + optional bool persona_addr_compat_layout = 41 [default = false]; + optional bool persona_mmap_page_zero = 42 [default = false]; + optional bool persona_read_implies_exec = 43 [default = false]; + optional bool persona_addr_limit_3gb = 44 [default = false]; + optional bool persona_addr_no_randomize = 45 [default = false]; /* Which name-spaces should be used? */ - optional bool clone_newnet = 46 [ default = true ]; - optional bool clone_newuser = 47 [ default = true ]; - optional bool clone_newns = 48 [ default = true ]; - optional bool clone_newpid = 49 [ default = true ]; - optional bool clone_newipc = 50 [ default = true ]; - optional bool clone_newuts = 51 [ default = true ]; + optional bool clone_newnet = 46 [default = true]; + optional bool clone_newuser = 47 [default = true]; + optional bool clone_newns = 48 [default = true]; + optional bool clone_newpid = 49 [default = true]; + optional bool clone_newipc = 50 [default = true]; + optional bool clone_newuts = 51 [default = true]; /* It's only supported in newer kernels, hence disabled by default */ - optional bool clone_newcgroup = 52 [ default = false ]; + optional bool clone_newcgroup = 52 [default = false]; /* Mappings for UIDs and GIDs. See the description for 'msg IdMap' for more */ @@ -177,7 +174,7 @@ message NsJailConfig /* Should /proc be mounted (R/O)? This can also be added in the 'mount' section below */ - optional bool mount_proc = 55 [ default = false ]; + optional bool mount_proc = 55 [default = false]; /* Mount points inside the jail. See the description for 'msg MountPt' for more */ repeated MountPt mount = 56; @@ -188,36 +185,36 @@ message NsJailConfig repeated string seccomp_string = 58; /* If > 0, maximum cumulative size of RAM used inside any jail */ - optional uint64 cgroup_mem_max = 59 [ default = 0 ]; /* In MiB */ + optional uint64 cgroup_mem_max = 59 [default = 0]; /* In MiB */ /* Mount point for cgroups-memory in your system */ - optional string cgroup_mem_mount = 60 [ default = "/sys/fs/cgroup/memory" ]; + optional string cgroup_mem_mount = 60 [default = "/sys/fs/cgroup/memory"]; /* Writeable directory (for the nsjail user) under cgroup_mem_mount */ - optional string cgroup_mem_parent = 61 [ default = "NSJAIL" ]; + optional string cgroup_mem_parent = 61 [default = "NSJAIL"]; /* If > 0, maximum number of PIDs (threads/processes) inside jail */ - optional uint64 cgroup_pids_max = 62 [ default = 0 ]; + optional uint64 cgroup_pids_max = 62 [default = 0]; /* Mount point for cgroups-pids in your system */ - optional string cgroup_pids_mount = 63 [ default = "/sys/fs/cgroup/pids" ]; + optional string cgroup_pids_mount = 63 [default = "/sys/fs/cgroup/pids"]; /* Writeable directory (for the nsjail user) under cgroup_pids_mount */ - optional string cgroup_pids_parent = 64 [ default = "NSJAIL" ]; + optional string cgroup_pids_parent = 64 [default = "NSJAIL"]; /* Should the 'lo' interface be brought up (active) inside this jail? */ - optional bool iface_no_lo = 65 [ default = false ]; + optional bool iface_no_lo = 65 [default = false]; /* Parameters for the cloned MACVLAN interface inside jail */ optional string macvlan_iface = 66; /* Interface to be cloned, eg 'eth0' */ - optional string macvlan_vs_ip = 67 [ default = "192.168.0.2" ]; - optional string macvlan_vs_nm = 68 [ default = "255.255.255.0" ]; - optional string macvlan_vs_gw = 69 [ default = "192.168.0.1" ]; + optional string macvlan_vs_ip = 67 [default = "192.168.0.2"]; + optional string macvlan_vs_nm = 68 [default = "255.255.255.0"]; + optional string macvlan_vs_gw = 69 [default = "192.168.0.1"]; /* Binary path (with arguments) to be executed. If not specified here, it can be specified with cmd-line as "-- /path/to/command arg1 arg2" */ optional Exe exec_bin = 70; /* If > 0, Class identifier of network packets inside jail */ - optional uint32 cgroup_net_cls_classid = 71 [ default = 0 ]; + optional uint32 cgroup_net_cls_classid = 71 [default = 0]; /* Mount point for cgroups-net-cls in your system */ - optional string cgroup_net_cls_mount = 72 [ default = "/sys/fs/cgroup/net_cls" ]; + optional string cgroup_net_cls_mount = 72 [default = "/sys/fs/cgroup/net_cls"]; /* Writeable directory (for the nsjail user) under cgroup_net_mount */ - optional string cgroup_net_cls_parent = 73 [ default = "NSJAIL" ]; + optional string cgroup_net_cls_parent = 73 [default = "NSJAIL"]; }