name: "imagemagick-convert"

description: "This policy allows to run ImageMagick's convert inside a jail."
description: "Your $HOME's Documents will be mapped as /user/Documents"
description: ""
description: "Run as:"
description: ""
description: "./nsjail --config imagemagick-convert.cfg -- /usr/bin/convert \\"
description: "	jpg:/user/Documents/input.jpg png:/user/Documents/output.png"

mode: ONCE
hostname: "IM-CONVERT"
cwd: "/user"

time_limit: 120

envar: "HOME=/user"
envar: "TMP=/tmp"

rlimit_as: 2048
rlimit_cpu: 1000
rlimit_fsize: 1024
rlimit_nofile: 16

mount {
	src: "/lib"
	dst: "/lib"
	is_bind: true
}

mount {
	src: "/usr/lib"
	dst: "/usr/lib"
	is_bind: true
}

mount {
	src: "/lib64"
	dst: "/lib64"
	is_bind: true
	mandatory: false
}

mount {
	src: "/lib32"
	dst: "/lib32"
	is_bind: true
	mandatory: false
}

mount {
	src: "/usr/bin/convert"
	dst: "/usr/bin/convert"
	is_bind: true
}

mount {
	dst: "/tmp"
	fstype: "tmpfs"
	rw: true
	is_bind: false
}

mount {
	dst: "/user"
	fstype: "tmpfs"
	rw: true
}

mount {
	prefix_src_env: "HOME"
	src: "/Documents"
	dst: "/user/Documents"
	rw: true
	is_bind: true
	mandatory: false
}

seccomp_string: "POLICY example {"
seccomp_string: "	KILL {"
seccomp_string: "		ptrace,"
seccomp_string: "		process_vm_readv,"
seccomp_string: "		process_vm_writev"
seccomp_string: "	}"
seccomp_string: "}"
seccomp_string: "USE example DEFAULT ALLOW"