name: "firefox-with-cloned-net"
description: "
This policy allows to run firefox inside a jail on a separate eth interface.
A separate networking context separates process from the global \"lo\", and
from global abstract socket namespace.

The only permitted home directory is $HOME/.mozilla and $HOME/Documents.
The rest of available on the FS files/dires are libs and X-related files/dirs.

As this needs to be run as root, you will have to set-up correct uid&gid
mappings (here: 'jagger'), name of your local interface (here: 'enp0s31f6'),
and correct IPv4 addresses.

IPv6 should work out-of-the-box, given that your local IPv6 discovery is set
up correctly.

Run as:

sudo ./nsjail --config configs/firefox-with-cloned-net.cfg

You can then go to https://uploadfiles.io/ and try to upload a file in order
to see how your local directory (also, all system directories) look like.
"

mode: ONCE
hostname: "FF-MACVTAP"
cwd: "/user"

time_limit: 0

envar: "HOME=/user"
envar: "DISPLAY=:0"
envar: "TMP=/tmp"

rlimit_as: 4096
rlimit_cpu: 1000
rlimit_fsize: 1024
rlimit_nofile: 128

uidmap {
	inside_id: "9999999"
	outside_id: "jagger"
}

gidmap {
	inside_id: "9999999"
	outside_id: "jagger"
}

mount {
	dst: "/proc"
	fstype: "proc"
}

mount {
	src: "/lib"
	dst: "/lib"
	is_bind: true
}

mount {
	src: "/usr/lib"
	dst: "/usr/lib"
	is_bind: true
}

mount {
	src: "/lib64"
	dst: "/lib64"
	is_bind: true
	mandatory: false
}

mount {
	src: "/lib32"
	dst: "/lib32"
	is_bind: true
	mandatory: false
}

mount {
	src: "/usr/lib/firefox"
	dst: "/usr/lib/firefox"
	is_bind: true
}

mount {
	src: "/usr/bin/firefox"
	dst: "/usr/bin/firefox"
	is_bind: true
}

mount {
	src: "/usr/share"
	dst: "/usr/share"
	is_bind: true
}

mount {
	src: "/dev/urandom"
	dst: "/dev/urandom"
	is_bind: true
	rw: true
}

mount {
	src_content: "nameserver 8.8.8.8"
	dst: "/etc/resolv.conf"
}

mount {
	dst: "/tmp"
	fstype: "tmpfs"
	rw: true
	is_bind: false
}

mount {
	dst: "/user"
	fstype: "tmpfs"
	rw: true
}

mount {
	prefix_src_env: "HOME"
	src: "/Documents"
	dst: "/user/Documents"
	rw: true
	is_bind: true
	mandatory: false
}

mount {
	prefix_src_env: "HOME"
	src: "/.mozilla"
	dst: "/user/.mozilla"
	is_bind: true
	rw: true
	mandatory: false
}

mount {
	src: "/tmp/.X11-unix/X0"
	dst: "/tmp/.X11-unix/X0"
	is_bind: true
}

seccomp_string: "
	POLICY example {
		KILL {
			ptrace,
			process_vm_readv,
			process_vm_writev
		}
	}
	USE example DEFAULT ALLOW
"

macvlan_iface: "enp0s31f6"
macvlan_vs_ip: "192.168.10.223"
macvlan_vs_nm: "255.255.255.0"
macvlan_vs_gw: "192.168.10.1"

exec_bin {
        path: "/usr/lib/firefox/firefox"
}