Robert Swiecki
73f1d44c92
Allow to use IPv4 addr with --bindhost
2017-06-19 22:35:57 +02:00
Robert Swiecki
ceaed43133
config: implement max_cpu_num in PB
2017-06-19 17:05:01 +02:00
Robert Swiecki
0e7393cccf
cmdline: implement affinity setting, to limit jailed process to n max cpus
2017-06-19 17:01:50 +02:00
Robert Swiecki
1dd3223b74
iface -> iface_vs
2017-06-12 22:20:21 +02:00
Robert Swiecki
63e4059f7a
Slight fixes to log_fd
2017-06-12 00:27:27 +02:00
Tony Young
c55dc8cb12
Add an extra log_fd argument to specify an FD to log to.
...
In some situations, setting --log to /proc/self/fd/# is not sufficient to log out to a different FD. For instance, if a master process passes its stderr to the child nsjail process as fd 3, the nsjail child may not always be able to log to /proc/self/fd/3, e.g. if the master process is running under systemd, whose /proc/self/fd/2 is actually a socket and not a pipe. However, having nsjail write to fd 3 directly is fine and there's no other good way to handle this situation.
2017-06-11 22:12:18 +00:00
Tony Young
d0261d281d
Add an --exec_file argument to allow argv[0] to differ from the binary being exec'd.
2017-06-09 00:00:12 +00:00
Robert Swiecki
9519f1038b
mount: introduce mountDescribeMountPt
2017-05-29 16:52:24 +02:00
Robert Swiecki
0271586e81
Get rid of pivot_root_only - achieve the same in different way
2017-05-29 03:11:32 +02:00
Robert Swiecki
7b2fc9cdac
add configs/firefox-with-cloned-net.cfg
2017-05-28 16:56:16 +02:00
Robert Swiecki
d7ccf0c9d8
Simplify uids/gids maps
2017-05-28 01:05:27 +02:00
Robert Swiecki
ed72ce3762
cmdline: avoid using %s with nullptr
2017-05-27 17:40:30 +02:00
Robert Swiecki
ec50c1346d
mount: nonmandatory mounts
2017-05-27 15:17:11 +02:00
Robert Swiecki
f0cb243a89
config: allow skipping arguments in mount points
2017-05-27 15:01:34 +02:00
Robert Swiecki
03e8578e79
config: executable in config
2017-05-27 02:24:41 +02:00
Robert Swiecki
53f825115f
More work on uid mappings
2017-05-26 23:26:07 +02:00
Robert Swiecki
4eaa6cc9d3
Rewrite uid mapping system
2017-05-26 23:07:47 +02:00
Robert Swiecki
8e39afa25f
config: more options in the config #5
2017-05-26 15:22:59 +02:00
Robert Swiecki
08de9db57c
config: more options in the config #4
2017-05-26 14:08:09 +02:00
Robert Swiecki
92939c754e
config: more options in the config #3
2017-05-26 05:12:01 +02:00
Robert Swiecki
1bf794f492
config: add basic config support
2017-05-26 01:44:16 +02:00
Robert Swiecki
591188910e
cmdline/mount: use 'none' as src for tmpfs/proc
2017-05-24 17:09:24 +02:00
Robert Swiecki
c1165cf120
mount: simplify checking for whether source is dir or file
2017-05-24 14:46:44 +02:00
Robert Swiecki
054c4a3b4b
Merge branch 'master' of github.com:google/nsjail
2017-05-24 14:32:45 +02:00
Robert Swiecki
9c4c278021
Warn about uid/gid 0
2017-05-24 14:32:39 +02:00
Robert Swiecki
0d5befbd6f
TLS semantics for subprocCloneFlagsToStr and mountFlagsToStr
2017-05-22 01:10:49 +02:00
Robert Swiecki
525ba9e2dd
Convert mount flags to str
2017-05-21 17:37:18 +02:00
Serge Bazanski
00f7944718
Merge branch 'master' of github.com:google/nsjail into deprecate-iface-flag-names
2017-05-11 16:18:07 +01:00
Serge Bazanski
3b05a70b6b
Deprecate current iface/macvlan options.
...
This is in preparation for other networking models. The current option
names were very generic, and without namespacing them we could end up
with some very confusing naming.
Also some miscellaneous indentation fixes.
2017-05-11 15:17:54 +01:00
Robert Swiecki
e0ffb55b04
cmdline: examples for --iface_cs
2017-05-11 15:33:15 +02:00
Robert Swiecki
cf163807db
Kafel: wrong check
2017-05-08 15:53:43 +02:00
Robert Swiecki
d9cb28b97d
Use kafel unconditionally
2017-05-08 15:50:29 +02:00
Robert Swiecki
6596adb5e2
cmdline: 'i'
2017-05-07 21:10:39 +02:00
Robert Swiecki
ec765851f4
apply --rw to /proc as well
2017-04-22 23:54:33 +02:00
Robert Swiecki
cc5d4b65c9
cgroups: support for PIDs
2017-04-20 17:48:20 +02:00
Sam Clegg
74010d0c45
Exit with non-zero status on bad command line option
2017-02-15 17:23:55 -08:00
Robert Swiecki
478d2b3789
cmdline: provide both -v/verbose and -q/quiet for logging
2017-02-14 21:54:02 +01:00
Robert Swiecki
9f832aa35a
Uid/Gid fix
2017-02-08 00:42:23 +01:00
Robert Swiecki
4a154733e0
Allow to specify multiple uid/gid maps
2017-02-08 00:36:32 +01:00
Robert Swiecki
a0cc72aa5c
cmdline: typo
2017-01-28 14:25:09 +01:00
Robert Swiecki
c9847562dd
Less use of USE_KAFEL
2016-10-17 18:17:08 +02:00
Robert Swiecki
238df2ed87
Missing USE_KAFEL defines
2016-10-17 18:09:05 +02:00
Robert Swiecki
950c91e4dd
Allow to use kafel_string
2016-10-12 03:52:08 +02:00
Robert Swiecki
df38185c6f
Slight rework of kafel use
2016-10-12 03:15:33 +02:00
Robert Swiecki
a30e2f107c
Make indent
2016-10-12 00:59:10 +02:00
Stephen Röttger
f4d43e3336
New option pivot_root_only to support nested namespaces
...
If pivot_root_only is setthe chroot in the job setup will be skipped.
2016-09-30 16:30:59 +02:00
robertswiecki
f995ff9475
Merge pull request #9 from sroettger/newuidmap
...
Support more complex uid and gid mappings
2016-09-30 16:03:33 +02:00
Stephen Röttger
1c950391a1
Support more complex uid and gid mappings
...
Introduces the new options uid_mapping and gid_mapping that specify
arbitrary custom mappings. If these options are used, nsjail will
use newuidmap/newgidmap to write the map files.
2016-09-30 15:30:15 +02:00
robertswiecki
8a63a24981
Merge pull request #8 from sroettger/no_no_new_privs
...
new flag to skip no_new_privs: --disable_no_new_privs
2016-09-30 15:27:07 +02:00
Stephen Röttger
6501357f98
new flag to skip no_new_privs: --disable_no_new_privs
2016-09-30 15:23:04 +02:00
