diff --git a/config.proto b/config.proto index 1fbab6d..b0ea829 100644 --- a/config.proto +++ b/config.proto @@ -3,167 +3,165 @@ syntax = "proto2"; package nsjail; enum Mode { - LISTEN = 0; /* Listening on a TCP port */ - ONCE = 1; /* Running the command once only */ - RERUN = 2; /* Re-executing the command (forever) */ - EXECVE = 3; /* Executing command w/o the supervisor */ + LISTEN = 0; /* Listening on a TCP port */ + ONCE = 1; /* Running the command once only */ + RERUN = 2; /* Re-executing the command (forever) */ + EXECVE = 3; /* Executing command w/o the supervisor */ } - -/* Should be self explanatory */ -enum LogLevel { - DEBUG = 0; - INFO = 1; - WARNING = 2; - ERROR = 3; - FATAL = 4; +/* Should be self explanatory */ enum LogLevel { + DEBUG = 0; + INFO = 1; + WARNING = 2; + ERROR = 3; + FATAL = 4; } - -message IdMap { - /* Empty string means "current uid/gid" */ - required string inside_id = 1 [default = ""]; - required string outside_id = 2 [default = ""]; - /* 'man user_namespaces' for the meaning of count */ - required uint32 count = 3 [default = 1]; - /* Does this map use /usr/bin/new[u|g]idmap binary? */ - required bool use_newidmap = 4 [default = false]; +message IdMap +{ + /* Empty string means "current uid/gid" */ + required string inside_id = 1 [ default = "" ]; + required string outside_id = 2 [ default = "" ]; + /* 'man user_namespaces' for the meaning of count */ + required uint32 count = 3 [ default = 1 ]; + /* Does this map use /usr/bin/new[u|g]idmap binary? */ + required bool use_newidmap = 4 [ default = false ]; } - -message MountPt { - /* Can be empty string for filesystems like 'proc' */ - required string src = 1; - required string dst = 2; - /* Can be empty for mount --bind mounts */ - required string fstype = 3; - /* E.g. size=5000000 for 'tmpfs' */ - required string options = 4 [default = ""]; - /* Is it 'mount --bind src dst' type of mount */ - required bool is_bind = 5 [default = false]; - /* It it RO mount */ - required bool is_ro = 6 [default = false]; - /* Is it directory? If not specified an internal +message MountPt +{ + /* Can be empty string for filesystems like 'proc' */ + required string src = 1; + required string dst = 2; + /* Can be empty for mount --bind mounts */ + required string fstype = 3; + /* E.g. size=5000000 for 'tmpfs' */ + required string options = 4 [ default = "" ]; + /* Is it 'mount --bind src dst' type of mount */ + required bool is_bind = 5 [ default = false ]; + /* It it RO mount */ + required bool is_ro = 6 [ default = false ]; + /* Is it directory? If not specified an internal * heuristics will be used to determine that */ - optional bool is_dir = 7; + optional bool is_dir = 7; } - -message Exe { - /* This will be usef both for path and for argv[0] */ - required string path = 1; - /* This will be argv[1] and so on.. */ - repeated string arg = 2; +message Exe +{ + /* This will be usef both for path and for argv[0] */ + required string path = 1; + /* This will be argv[1] and so on.. */ + repeated string arg = 2; } +message NsJailConfig +{ + /* Execution mode: see 'msg Mode' description for more */ + required Mode mode = 1 [ default = ONCE ]; + /* Equivalent to a mount with dst='/' */ + optional string chroot_dir = 2; + /* Applies both to the chroot_dir and to /proc mounts */ + required bool is_root_rw = 3 [ default = false ]; + /* Hostname inside jail */ + required string hostname = 6 [ default = "NSJAIL" ]; + /* Initial current working directory for the binary */ + required string cwd = 7 [ default = "/" ]; -message NsJailConfig { - /* Execution mode: see 'msg Mode' description for more */ - required Mode mode = 1 [default = ONCE]; - /* Equivalent to a mount with dst='/' */ - optional string chroot_dir = 2; - /* Applies both to the chroot_dir and to /proc mounts */ - required bool is_root_rw = 3 [default = false]; - /* Hostname inside jail */ - required string hostname = 6 [default = "NSJAIL"]; - /* Initial current working directory for the binary */ - required string cwd = 7 [default = "/"]; + /* TCP port to listen to. Valid with mode=LISTEN only */ + required uint32 port = 8 [ default = 0 ]; + /* Host to bind to for mode=LISTEN. Must be in IPv6 format */ + required string bindhost = 9 [ default = "::" ]; + /* For mode=LISTEN, maximum number of connections from a single IP */ + required uint32 max_conns_per_ip = 10 [ default = 0 ]; - /* TCP port to listen to. Valid with mode=LISTEN only */ - required uint32 port = 8 [default = 0]; - /* Host to bind to for mode=LISTEN. Must be in IPv6 format */ - required string bindhost = 9 [default = "::"]; - /* For mode=LISTEN, maximum number of connections from a single IP */ - required uint32 max_conns_per_ip = 10 [default = 0]; - - /* Wall-time time limit for commands */ - required uint32 time_limit = 11 [default = 600]; - /* Should nsjail go into background? */ - required bool daemon = 12 [default = false]; - /* File to save lofs to */ - optional string log_file = 13; - /* Minimum log level displayed. + /* Wall-time time limit for commands */ + required uint32 time_limit = 11 [ default = 600 ]; + /* Should nsjail go into background? */ + required bool daemon = 12 [ default = false ]; + /* File to save lofs to */ + optional string log_file = 13; + /* Minimum log level displayed. See 'msg LogLevel' description for more */ - optional LogLevel log_level = 14; - /* Should the current environment variables be kept + optional LogLevel log_level = 14; + /* Should the current environment variables be kept when executing the binary */ - required bool keep_env = 15 [default = false]; - /* Should nsjail close FD=0,1,2 before executing the process */ - required bool silent = 16 [default = false]; - /* Should the child process have control over terminal? - Can be useful to allow /bin/sh to provide - job control / signals */ - required bool skip_setsid = 17 [default = false]; - /* Which FDs should be passed to the newly executed process + required bool keep_env = 15 [ default = false ]; + /* Should nsjail close FD=0,1,2 before executing the process */ + required bool silent = 16 [ default = false ]; + /* Should the child process have control over terminal? + Can be useful to allow /bin/sh to provide + job control / signals */ + required bool skip_setsid = 17 [ default = false ]; + /* Which FDs should be passed to the newly executed process By default only FD=0,1,2 are passed */ - repeated int32 pass_fd = 18; - /* Should pivot_root be used instead of chroot? + repeated int32 pass_fd = 18; + /* Should pivot_root be used instead of chroot? Using pivot_root allows to have subnamespaces */ - required bool pivot_root_only = 19 [ default = false]; - /* Setting it to true will allow to have set-uid binaries - inside the jail */ - required bool disable_no_new_privs = 20 [default = false]; + required bool pivot_root_only = 19 [ default = false ]; + /* Setting it to true will allow to have set-uid binaries + inside the jail */ + required bool disable_no_new_privs = 20 [ default = false ]; - required uint64 rlimit_as = 21 [default = 512]; /* In MiB */ - required uint64 rlimit_core = 22 [default = 0]; /* In MiB */ - required uint64 rlimit_cpu = 23 [default = 600]; /* In seconds */ - required uint64 rlimit_fsize = 24 [default = 1]; /* In MiB */ - required uint64 rlimit_nofile = 25 [default = 32]; - optional uint64 rlimit_nproc = 26; - optional uint64 rlimit_stack = 27; /* In MiB */ + required uint64 rlimit_as = 21 [ default = 512 ]; /* In MiB */ + required uint64 rlimit_core = 22 [ default = 0 ]; /* In MiB */ + required uint64 rlimit_cpu = 23 [ default = 600 ]; /* In seconds */ + required uint64 rlimit_fsize = 24 [ default = 1 ]; /* In MiB */ + required uint64 rlimit_nofile = 25 [ default = 32 ]; + optional uint64 rlimit_nproc = 26; + optional uint64 rlimit_stack = 27; /* In MiB */ - /* See 'man personality' for more */ - required bool persona_addr_compat_layout = 28 [default = false]; - required bool persona_mmap_page_zero = 29 [default = false]; - required bool persona_read_implies_exec = 30 [default = false]; - required bool persona_addr_limit_3gb = 31 [default = false]; - required bool persona_addr_no_randomize = 32 [default = false]; + /* See 'man personality' for more */ + required bool persona_addr_compat_layout = 28 [ default = false ]; + required bool persona_mmap_page_zero = 29 [ default = false ]; + required bool persona_read_implies_exec = 30 [ default = false ]; + required bool persona_addr_limit_3gb = 31 [ default = false ]; + required bool persona_addr_no_randomize = 32 [ default = false ]; - /* Which name-spaces should be used? */ - required bool clone_newnet = 33 [default = true]; - required bool clone_newuser = 34 [default = true]; - required bool clone_newns = 35 [default = true]; - required bool clone_newpid = 36 [default = true]; - required bool clone_newipc = 37 [default = true]; - required bool clone_newuts = 38 [default = true]; - /* It's only supported in newer kernels, hence disabled by default */ - required bool clone_newcgroup = 39 [default = false]; + /* Which name-spaces should be used? */ + required bool clone_newnet = 33 [ default = true ]; + required bool clone_newuser = 34 [ default = true ]; + required bool clone_newns = 35 [ default = true ]; + required bool clone_newpid = 36 [ default = true ]; + required bool clone_newipc = 37 [ default = true ]; + required bool clone_newuts = 38 [ default = true ]; + /* It's only supported in newer kernels, hence disabled by default */ + required bool clone_newcgroup = 39 [ default = false ]; - /* Mappings for UIDs and GIDs. See the description for 'msg IdMap' + /* Mappings for UIDs and GIDs. See the description for 'msg IdMap' for more */ - repeated IdMap uidmap = 40; - repeated IdMap gidmap = 41; + repeated IdMap uidmap = 40; + repeated IdMap gidmap = 41; - /* Mount points inside the jail. See the description for 'msg MountPt' + /* Mount points inside the jail. See the description for 'msg MountPt' for more */ - repeated MountPt mount = 42; - /* Should /proc be mounted? One can also force this in the 'mount' */ - required bool mount_proc = 43 [default = true]; + repeated MountPt mount = 42; + /* Should /proc be mounted? One can also force this in the 'mount' */ + required bool mount_proc = 43 [ default = true ]; - /* Kafel seccomp policy file or string. + /* Kafel seccomp policy file or string. Homepage of the project: https://github.com/google/kafel */ - optional string seccomp_policy_file = 44; - optional string seccomp_string = 45; + optional string seccomp_policy_file = 44; + optional string seccomp_string = 45; - /* If > 0, maximum cumulative size of RAM used inside jail */ - required uint64 cgroup_mem_max = 46 [default = 0]; /* In MiB */ - /* Mount point for cgroups-memory */ - required string cgroup_mem_mount = 47 [default = "/sys/fs/cgroup/memory"]; - /* Writeable directory (for the nsjail user) under cgroup_mem_mount */ - required string cgroup_mem_parent = 48 [default = "NSJAIL"]; + /* If > 0, maximum cumulative size of RAM used inside jail */ + required uint64 cgroup_mem_max = 46 [ default = 0 ]; /* In MiB */ + /* Mount point for cgroups-memory */ + required string cgroup_mem_mount = 47 [ default = "/sys/fs/cgroup/memory" ]; + /* Writeable directory (for the nsjail user) under cgroup_mem_mount */ + required string cgroup_mem_parent = 48 [ default = "NSJAIL" ]; - /* If > 0, maximum number of PIDs (threads/processes) inside jail */ - required uint64 cgroup_pids_max = 49 [default = 0]; - /* Mount point for cgroups-memory */ - required string cgroup_pids_mount = 50 [default = "/sys/fs/cgroup/pids"]; - /* Writeable directory (for the nsjail user) under cgroup_pids_mount */ - required string cgroup_pids_parent = 51 [default = "NSJAIL"]; + /* If > 0, maximum number of PIDs (threads/processes) inside jail */ + required uint64 cgroup_pids_max = 49 [ default = 0 ]; + /* Mount point for cgroups-memory */ + required string cgroup_pids_mount = 50 [ default = "/sys/fs/cgroup/pids" ]; + /* Writeable directory (for the nsjail user) under cgroup_pids_mount */ + required string cgroup_pids_parent = 51 [ default = "NSJAIL" ]; - /* Should the 'lo' interface be brought up inside jail? */ - required bool iface_no_lo = 52 [default = false]; + /* Should the 'lo' interface be brought up inside jail? */ + required bool iface_no_lo = 52 [ default = false ]; - /* Parameters for the cloned MACVLAN interface inside jail */ - optional string macvlan_iface = 53; /* Interface to be cloned, eg 'eth0' */ - required string macvlan_vs_ip = 54 [default = "192.168.0.2"]; - required string macvlan_vs_nm = 55 [default = "255.255.255.0"]; - required string macvlan_vs_gw = 56 [default = "192.168.0.1"]; + /* Parameters for the cloned MACVLAN interface inside jail */ + optional string macvlan_iface = 53; /* Interface to be cloned, eg 'eth0' */ + required string macvlan_vs_ip = 54 [ default = "192.168.0.2" ]; + required string macvlan_vs_nm = 55 [ default = "255.255.255.0" ]; + required string macvlan_vs_gw = 56 [ default = "192.168.0.1" ]; - /* Binary with arguments to be executed. If not specified here, it can be + /* Binary with arguments to be executed. If not specified here, it can be specified with the command-line as "-- /path/to/command arg1 arg2" */ - optional Exe exec_bin = 57; + optional Exe exec_bin = 57; }