woj/nsjail
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
2 Commits 2 Branches 0 Tags 1.5 MiB
C++ 92.4%
Roff 4.8%
Makefile 1.9%
C 0.7%
Dockerfile 0.2%
970f3b70b4
Go to file
Robert Swiecki 970f3b70b4 README -> README.md
2015-05-15 01:45:18 +02:00
seccomp Initial import 2015-05-14 23:44:48 +02:00
cmdline.c Initial import 2015-05-14 23:44:48 +02:00
cmdline.h Initial import 2015-05-14 23:44:48 +02:00
common.h Initial import 2015-05-14 23:44:48 +02:00
contain.c Initial import 2015-05-14 23:44:48 +02:00
contain.h Initial import 2015-05-14 23:44:48 +02:00
CONTRIBUTING Initial import 2015-05-14 23:44:48 +02:00
LICENSE Initial import 2015-05-14 23:44:48 +02:00
log.c Initial import 2015-05-14 23:44:48 +02:00
log.h Initial import 2015-05-14 23:44:48 +02:00
Makefile Initial import 2015-05-14 23:44:48 +02:00
net.c Initial import 2015-05-14 23:44:48 +02:00
net.h Initial import 2015-05-14 23:44:48 +02:00
nsjail.c Initial import 2015-05-14 23:44:48 +02:00
nsjail.h Initial import 2015-05-14 23:44:48 +02:00
README.md README -> README.md 2015-05-15 01:45:18 +02:00
sandbox.c Initial import 2015-05-14 23:44:48 +02:00
sandbox.h Initial import 2015-05-14 23:44:48 +02:00
subproc.c Initial import 2015-05-14 23:44:48 +02:00
subproc.h Initial import 2015-05-14 23:44:48 +02:00

README.md

WHAT IS IT?

NsJail is a Linux isolation tool making use of the namespacing and seccomp-bpf subsystems of the Linux kernel.

WHAT KIND OF ISOLATION DOES IT PROVIDE?

  1. Linux namespaces: UTS, MOUNT, PID, IPC, NET, USER (optional)
  2. FS chroot-ing (chroot()/pivot_root())
  3. Seccomp-bpf syscall filters

WHAT USE-CASES DOES IT COVER?

  1. Isolating networking daemons (inetd-style)

  • Server: $ ./nsjail -Ml --port 9000 --chroot /chroot/ --user 99999 --group 99999 -- /bin/sh -i

  • Client: $ nc 127.0.0.1 9000 / $ ifconfig / $ ifconfig -a lo Link encap:Local Loopback LOOPBACK MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

  1. Isolating local processes (run it once, and exit)

$ ./nsjail -Mo --chroot /chroot/ --user 99999 --group 99999 -- /bin/sh -i / $ ifconfig -a lo Link encap:Local Loopback LOOPBACK MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) / $ id uid=99999 gid=99999 / $exit $

  1. Isolating local processes (and re-running them)

$ ./nsjail -Mr --chroot /chroot/ --user 99999 --group 99999 -- /bin/sh -i BusyBox v1.21.1 (Ubuntu 1:1.21.0-1ubuntu1) built-in shell (ash) Enter 'help' for a list of built-in commands. / $ exit BusyBox v1.21.1 (Ubuntu 1:1.21.0-1ubuntu1) built-in shell (ash) Enter 'help' for a list of built-in commands. / $

MORE INFO?

Type: './nsjail --help' - cmd-line switches are well-documented