/* Copyright 2012 The ChromiumOS Authors

* Use of this source code is governed by a BSD-style license that can be

* found in the LICENSE file.

*/

#define _BSD_SOURCE

#define _DEFAULT_SOURCE

#define _GNU_SOURCE

#include <asm/unistd.h>

#include <assert.h>

#include <dirent.h>

#include <errno.h>

#include <fcntl.h>

#include <grp.h>

#include <limits.h>

#include <linux/capability.h>

#include <linux/filter.h>

#include <sched.h>

#include <signal.h>

#include <stddef.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/capability.h>

#include <sys/mount.h>

#include <sys/param.h>

#include <sys/prctl.h>

#include <sys/resource.h>

#include <sys/stat.h>

#include <sys/sysmacros.h>

#include <sys/types.h>

#include <sys/user.h>

#include <sys/wait.h>

#include <syscall.h>

#include <unistd.h>

#include "landlock_util.h"

#include "libminijail-private.h"

#include "libminijail.h"

#include "signal_handler.h"

#include "syscall_filter.h"

#include "syscall_wrapper.h"

#include "system.h"

#include "util.h"

/* Until these are reliably available in linux/prctl.h. */

#ifndef PR_ALT_SYSCALL

#define PR_ALT_SYSCALL 0x43724f53

#endif

/* New cgroup namespace might not be in linux-headers yet. */

#ifndef CLONE_NEWCGROUP

#define CLONE_NEWCGROUP 0x02000000

#endif

#define MAX_CGROUPS 10 /* 10 different controllers supported by Linux. */

#define MAX_RLIMITS 32 /* Currently there are 15 supported by Linux. */

#define MAX_PRESERVED_FDS 256U

/* Paths to newuidmap/newgidmap helper binaries for unprivileged ID mapping. */

#ifndef NEWUIDMAP_PATH

#define NEWUIDMAP_PATH "/usr/bin/newuidmap"

#endif

#ifndef NEWGIDMAP_PATH

#define NEWGIDMAP_PATH "/usr/bin/newgidmap"

#endif

/* Keyctl commands. */

#define KEYCTL_JOIN_SESSION_KEYRING 1

/*

* The userspace equivalent of MNT_USER_SETTABLE_MASK, which is the mask of all

* flags that can be modified by MS_REMOUNT.

*/

#define MS_USER_SETTABLE_MASK \

(MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_NOATIME | MS_NODIRATIME | \

MS_RELATIME | MS_RDONLY)

/*

* Required for Android host glibc which is permanently stuck on 2.17. Causes

* no harm for newer glibc versions.

*/

#ifndef MS_NOSYMFOLLOW

/* Added locally in kernels 4.x+. */

#define MS_NOSYMFOLLOW 256

#endif

struct minijail_rlimit {

int type;

rlim_t cur;

rlim_t max;

};

struct mountpoint {

char *src;

char *dest;

char *type;

char *data;

int has_data;

unsigned long flags;

struct mountpoint *next;

};

struct minijail_remount {

unsigned long remount_mode;

char *mount_name;

struct minijail_remount *next;

};

struct hook {

minijail_hook_t hook;

void *payload;

minijail_hook_event_t event;

struct hook *next;

};

struct fs_rule {

char *path;

uint64_t landlock_flags;

struct fs_rule *next;

};

struct preserved_fd {

int parent_fd;

int child_fd;

};

/*

* minijail struct: new fields should either be marshaled/unmarshaled or have a

* comment explaining why that's unnecessary.

*/

struct minijail {

/*

* WARNING: new bool flags should always be added to this struct,

* unless you’re certain they don’t need to remain after marshaling.

* If you add a flag here you need to make sure it's

* accounted for in minijail_pre{enter|exec}() below.

*/

struct {

bool uid : 1;

bool gid : 1;

bool inherit_suppl_gids : 1;

bool set_suppl_gids : 1;

bool keep_suppl_gids : 1;

bool use_caps : 1;

bool capbset_drop : 1;

bool set_ambient_caps : 1;

bool vfs : 1;

bool enter_vfs : 1;

bool pids : 1;

bool ipc : 1;

bool uts : 1;

bool net : 1;

bool net_loopback : 1;

bool enter_net : 1;

bool ns_cgroups : 1;

bool userns : 1;

bool disable_setgroups : 1;

bool seccomp : 1;

bool remount_proc_ro : 1;

bool no_new_privs : 1;

bool seccomp_filter : 1;

bool seccomp_filter_tsync : 1;

bool seccomp_filter_logging : 1;

bool seccomp_filter_allow_speculation : 1;

bool chroot : 1;

bool pivot_root : 1;

bool mount_dev : 1;

bool mount_tmp : 1;

bool do_init : 1;

bool run_as_init : 1;

bool pid_file : 1;

bool cgroups : 1;

bool alt_syscall : 1;

bool reset_signal_mask : 1;

bool reset_signal_handlers : 1;

bool close_open_fds : 1;

bool new_session_keyring : 1;

bool forward_signals : 1;

bool setsid : 1;

bool using_minimalistic_mountns : 1;

bool enable_fs_restrictions : 1;

bool enable_profile_fs_restrictions : 1;

bool enable_default_runtime : 1;

bool enable_new_sessions : 1;

} flags;

uid_t uid;

gid_t gid;

gid_t usergid;

char *user;

size_t suppl_gid_count;

gid_t *suppl_gid_list;

uint64_t caps;

uint64_t cap_bset;

pid_t initpid;

int mountns_fd;

int netns_fd;

int fs_rules_fd;

int fs_rules_landlock_abi;

char *chrootdir;

char *pid_file_path;

char *uidmap;

char *gidmap;

char *hostname;

char *preload_path;

/*

* Filename that will be executed, unless an ELF fd is used instead.

* This field is only used for logs and isn't included in marshaling.

*/

char *filename;

size_t filter_len;

struct sock_fprog *filter_prog;

char *alt_syscall_table;

struct mountpoint *mounts_head;

struct mountpoint *mounts_tail;

size_t mounts_count;

unsigned long remount_mode;

struct minijail_remount *remounts_head;

struct minijail_remount *remounts_tail;

size_t tmpfs_size;

struct fs_rule *fs_rules_head;

struct fs_rule *fs_rules_tail;

size_t fs_rules_count;

char *cgroups[MAX_CGROUPS];

size_t cgroup_count;

struct minijail_rlimit rlimits[MAX_RLIMITS];

size_t rlimit_count;

uint64_t securebits_skip_mask;

struct hook *hooks_head;

struct hook *hooks_tail;

struct preserved_fd preserved_fds[MAX_PRESERVED_FDS];

size_t preserved_fd_count;

char *seccomp_policy_path;

};

static void run_hooks_or_die(const struct minijail *j,

minijail_hook_event_t event);

static bool seccomp_is_logging_allowed(const struct minijail *j)

{

return seccomp_default_ret_log() || j->flags.seccomp_filter_logging;

}

static void free_mounts_list(struct minijail *j)

{

while (j->mounts_head) {

struct mountpoint *m = j->mounts_head;

j->mounts_head = j->mounts_head->next;

free(m->data);

free(m->type);

free(m->dest);

free(m->src);

free(m);

}

// No need to clear mounts_head as we know it's NULL after the loop.

j->mounts_tail = NULL;

}

static void free_remounts_list(struct minijail *j)

{

while (j->remounts_head) {

struct minijail_remount *m = j->remounts_head;

j->remounts_head = j->remounts_head->next;

free(m->mount_name);

free(m);

}

// No need to clear remounts_head as we know it's NULL after the loop.

j->remounts_tail = NULL;

}

static void free_fs_rules_list(struct minijail *j)

{

while (j->fs_rules_head) {

struct fs_rule *r = j->fs_rules_head;

j->fs_rules_head = j->fs_rules_head->next;

free(r->path);

free(r);

}

j->fs_rules_tail = NULL;

}

/*

* Writes exactly n bytes from buf to file descriptor fd.

* Returns 0 on success or a negative error code on error.

*/

static int write_exactly(int fd, const void *buf, size_t n)

{

const char *p = buf;

while (n > 0) {

const ssize_t written = write(fd, p, n);

if (written < 0) {

if (errno == EINTR)

continue;

return -errno;

}

p += written;

n -= written;

}

return 0;

}

/*

* Reads exactly n bytes from file descriptor fd into buf.

* Returns 0 on success or a negative error code on error.

*/

static int read_exactly(int fd, void *buf, size_t n)

{

char *p = buf;

while (n > 0) {

const ssize_t bytes = read(fd, p, n);

if (bytes < 0) {

if (errno == EINTR)

continue;

return -errno;

}

if (bytes == 0) {

errno = EPIPE;

return -EPIPE;

}

p += bytes;

n -= bytes;

}

return 0;

}

/* Closes *pfd and sets it to -1. */

static void close_and_reset(int *pfd)

{

if (*pfd != -1)

close(*pfd);

*pfd = -1;

}

/*

* Strip out flags meant for the parent.

* We keep things that are not inherited across execve(2) (e.g. capabilities),

* or are easier to set after execve(2) (e.g. seccomp filters).

*/

void minijail_preenter(struct minijail *j)

{

j->flags.vfs = 0;

j->flags.enter_vfs = 0;

j->flags.ns_cgroups = 0;

j->flags.net = 0;

j->flags.net_loopback = 0;

j->flags.uts = 0;

j->flags.remount_proc_ro = 0;

j->flags.pids = 0;

j->flags.do_init = 0;

j->flags.run_as_init = 0;

j->flags.pid_file = 0;

j->flags.cgroups = 0;

j->flags.forward_signals = 0;

j->flags.setsid = 0;

j->remount_mode = 0;

j->flags.using_minimalistic_mountns = 0;

j->flags.enable_profile_fs_restrictions = 0;

j->flags.enable_default_runtime = 0;

j->flags.enable_new_sessions = 0;

free_remounts_list(j);

}

static bool fs_refer_restriction_supported(struct minijail *j)

{

if (j->fs_rules_landlock_abi < 0) {

const int abi = landlock_create_ruleset(

NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);

/*

* If we have a valid ABI, save the result. Otherwise, leave

* the struct field unmodified to make sure it's correctly

* marshaled and unmarshaled.

*/

if (abi > 0) {

j->fs_rules_landlock_abi = abi;

}

}

return j->fs_rules_landlock_abi >= LANDLOCK_ABI_FS_REFER_SUPPORTED;

}

/* Sets fs_rules_fd to an empty ruleset, if Landlock is available. */

static int setup_fs_rules_fd(struct minijail *j)

{

struct minijail_landlock_ruleset_attr ruleset_attr = {

.handled_access_fs = HANDLED_ACCESS_TYPES};

if (fs_refer_restriction_supported(j)) {

ruleset_attr.handled_access_fs |= LANDLOCK_ACCESS_FS_REFER;

}

j->fs_rules_fd =

landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);

if (j->fs_rules_fd < 0) {

/*

* As of Landlock ABI=3, the useful errors we expect here are

* ENOSYS or EOPNOTSUPP. In both cases, Landlock is not

* supported by the kernel and Minijail can silently ignore it.

* TODO(b/300142205): log when we no longer have 5.4 kernels in

* ChromeOS (~EoY 2024).

*/

return errno;

}

return 0;

}

/* Adds a rule for a given path to apply once minijail is entered. */

static int add_fs_restriction_path(struct minijail *j, const char *path,

uint64_t landlock_flags)

{

struct fs_rule *r = calloc(1, sizeof(*r));

if (!r)

return -ENOMEM;

r->path = strdup(path);

if (!r->path) {

free(r);

return -ENOMEM;

}

r->landlock_flags = landlock_flags;

if (j->fs_rules_tail) {

j->fs_rules_tail->next = r;

j->fs_rules_tail = r;

} else {

j->fs_rules_head = r;

j->fs_rules_tail = r;

}

/*

* If this is our first rule, set up the rules FD early for API users.

*

* This is important for users calling minijail_enter() directly.

* Otherise, this is handled later inside minijail_run_internal().

*

* The reason for this is because setup_fs_rules_fd() needs to be

* called from inside the process that applies Landlock rules. For

* minijail_enter(), that's this process. For minijail_run_internal(),

* that's the child process.

*/

if (j->fs_rules_count == 0)

setup_fs_rules_fd(j);

j->fs_rules_count++;

return 0;

}

bool mount_has_bind_flag(struct mountpoint *m)

{

return !!(m->flags & MS_BIND);

}

bool mount_has_readonly_flag(struct mountpoint *m)

{

return !!(m->flags & MS_RDONLY);

}

bool mount_events_allowed(struct mountpoint *m)

{

return !!(m->flags & MS_SHARED) || !!(m->flags & MS_SLAVE);

}

/*

* Strip out flags meant for the child.

* We keep things that are inherited across execve(2).

*/

void minijail_preexec(struct minijail *j)

{

int vfs = j->flags.vfs;

int enter_vfs = j->flags.enter_vfs;

int ns_cgroups = j->flags.ns_cgroups;

int net = j->flags.net;

int net_loopback = j->flags.net_loopback;

int uts = j->flags.uts;

int remount_proc_ro = j->flags.remount_proc_ro;

int userns = j->flags.userns;

int using_minimalistic_mountns = j->flags.using_minimalistic_mountns;

int enable_fs_restrictions = j->flags.enable_fs_restrictions;

int enable_profile_fs_restrictions =

j->flags.enable_profile_fs_restrictions;

int enable_default_runtime = j->flags.enable_default_runtime;

int enable_new_sessions = j->flags.enable_new_sessions;

if (j->user)

free(j->user);

j->user = NULL;

if (j->suppl_gid_list)

free(j->suppl_gid_list);

j->suppl_gid_list = NULL;

if (j->preload_path)

free(j->preload_path);

j->preload_path = NULL;

free_mounts_list(j);

free_fs_rules_list(j);

memset(&j->flags, 0, sizeof(j->flags));

/* Now restore anything we meant to keep. */

j->flags.vfs = vfs;

j->flags.enter_vfs = enter_vfs;

j->flags.ns_cgroups = ns_cgroups;

j->flags.net = net;

j->flags.net_loopback = net_loopback;

j->flags.uts = uts;

j->flags.remount_proc_ro = remount_proc_ro;

j->flags.userns = userns;

j->flags.using_minimalistic_mountns = using_minimalistic_mountns;

j->flags.enable_fs_restrictions = enable_fs_restrictions;

j->flags.enable_profile_fs_restrictions =

enable_profile_fs_restrictions;

j->flags.enable_default_runtime = enable_default_runtime;

j->flags.enable_new_sessions = enable_new_sessions;

/* Note, |pids| will already have been used before this call. */

}

/* Minijail API. */

struct minijail API *minijail_new(void)

{

struct minijail *j = calloc(1, sizeof(struct minijail));

if (j) {

j->remount_mode = MS_PRIVATE;

j->fs_rules_fd = -1;

j->fs_rules_landlock_abi = -1;

j->flags.using_minimalistic_mountns = false;

j->flags.enable_fs_restrictions = true;

j->flags.enable_profile_fs_restrictions = true;

j->flags.enable_default_runtime = true;

j->flags.enable_new_sessions = true;

}

return j;

}

void API minijail_change_uid(struct minijail *j, uid_t uid)

{

if (uid == 0)

die("useless change to uid 0");

j->uid = uid;

j->flags.uid = 1;

}

void API minijail_change_gid(struct minijail *j, gid_t gid)

{

if (gid == 0)

die("useless change to gid 0");

j->gid = gid;

j->flags.gid = 1;

}

void API minijail_set_supplementary_gids(struct minijail *j, size_t size,

const gid_t *list)

{

size_t i;

if (j->flags.inherit_suppl_gids)

die("cannot inherit *and* set supplementary groups");

if (j->flags.keep_suppl_gids)

die("cannot keep *and* set supplementary groups");

if (size == 0) {

/* Clear supplementary groups. */

j->suppl_gid_list = NULL;

j->suppl_gid_count = 0;

j->flags.set_suppl_gids = 1;

return;

}

/* Copy the gid_t array. */

j->suppl_gid_list = calloc(size, sizeof(gid_t));

if (!j->suppl_gid_list) {

die("failed to allocate internal supplementary group array");

}

for (i = 0; i < size; i++) {

j->suppl_gid_list[i] = list[i];

}

j->suppl_gid_count = size;

j->flags.set_suppl_gids = 1;

}

void API minijail_keep_supplementary_gids(struct minijail *j)

{

j->flags.keep_suppl_gids = 1;

}

int API minijail_change_user(struct minijail *j, const char *user)

{

uid_t uid;

gid_t gid;

int rc = lookup_user(user, &uid, &gid);

if (rc)

return rc;

minijail_change_uid(j, uid);

j->user = strdup(user);

if (!j->user)

return -ENOMEM;

j->usergid = gid;

return 0;

}

int API minijail_change_group(struct minijail *j, const char *group)

{

gid_t gid;

int rc = lookup_group(group, &gid);

if (rc)

return rc;

minijail_change_gid(j, gid);

return 0;

}

void API minijail_use_seccomp(struct minijail *j)

{

j->flags.seccomp = 1;

}

void API minijail_no_new_privs(struct minijail *j)

{

j->flags.no_new_privs = 1;

}

void API minijail_use_seccomp_filter(struct minijail *j)

{

j->flags.seccomp_filter = 1;

}

void API minijail_set_seccomp_filter_tsync(struct minijail *j)

{

if (j->filter_len > 0 && j->filter_prog != NULL) {

die("minijail_set_seccomp_filter_tsync() must be called "

"before minijail_parse_seccomp_filters()");

}

if (seccomp_is_logging_allowed(j) && !seccomp_ret_log_available()) {

/*

* If SECCOMP_RET_LOG is not available, we don't want to use

* SECCOMP_RET_TRAP to both kill the entire process and report

* failing syscalls, since it will be brittle. Just bail.

*/

die("SECCOMP_RET_LOG not available, cannot use logging with "

"thread sync at the same time");

}

j->flags.seccomp_filter_tsync = 1;

}

void API minijail_set_seccomp_filter_allow_speculation(struct minijail *j)

{

if (j->filter_len > 0 && j->filter_prog != NULL) {

die("minijail_set_seccomp_filter_allow_speculation() must be "

"called before minijail_parse_seccomp_filters()");

}

j->flags.seccomp_filter_allow_speculation = 1;

}

void API minijail_log_seccomp_filter_failures(struct minijail *j)

{

if (j->filter_len > 0 && j->filter_prog != NULL) {

die("minijail_log_seccomp_filter_failures() must be called "

"before minijail_parse_seccomp_filters()");

}

if (j->flags.seccomp_filter_tsync && !seccomp_ret_log_available()) {

/*

* If SECCOMP_RET_LOG is not available, we don't want to use

* SECCOMP_RET_TRAP to both kill the entire process and report

* failing syscalls, since it will be brittle. Just bail.

*/

die("SECCOMP_RET_LOG not available, cannot use thread sync "

"with logging at the same time");

}

if (debug_logging_allowed()) {

j->flags.seccomp_filter_logging = 1;

} else {

warn("non-debug build: ignoring request to enable seccomp "

"logging");

}

}

void API minijail_set_using_minimalistic_mountns(struct minijail *j)

{

j->flags.using_minimalistic_mountns = true;

}

void API minijail_set_enable_new_sessions(struct minijail *j,

bool enable_new_sessions)

{

j->flags.enable_new_sessions = enable_new_sessions;

}

void API minijail_set_enable_default_runtime(struct minijail *j,

bool enable_default_runtime)

{

j->flags.enable_default_runtime = enable_default_runtime;

}

bool API minijail_get_enable_default_runtime(struct minijail *j)

{

return j->flags.enable_default_runtime;

}

bool API minijail_is_fs_restriction_available(void)

{

const int abi =

landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);

// ABI > 0 is considered supported.

return abi > 0;

}

void API minijail_disable_fs_restrictions(struct minijail *j)

{

j->flags.enable_fs_restrictions = false;

}

void API minijail_set_enable_profile_fs_restrictions(struct minijail *j)

{

j->flags.enable_profile_fs_restrictions = true;

}

void API minijail_add_minimalistic_mountns_fs_rules(struct minijail *j)

{

struct mountpoint *m = j->mounts_head;

bool landlock_enabled_by_profile = false;

if (!j->flags.using_minimalistic_mountns ||

!j->flags.enable_profile_fs_restrictions)

return;

/* Apply Landlock rules. */

while (m) {

landlock_enabled_by_profile = true;

minijail_add_fs_restriction_rx(j, m->dest);

/*

* Allow rw if mounted as writable, or mount flags allow mount

* events.

*/

if (!mount_has_readonly_flag(m) || mount_events_allowed(m))

minijail_add_fs_restriction_advanced_rw(j, m->dest);

m = m->next;

}

if (landlock_enabled_by_profile) {

minijail_enable_default_fs_restrictions(j);

minijail_add_fs_restriction_edit(j, "/dev");

minijail_add_fs_restriction_ro(j, "/proc");

if (j->flags.vfs)

minijail_add_fs_restriction_rw(j, "/tmp");

}

}

void API minijail_enable_default_fs_restrictions(struct minijail *j)

{

// Common library locations.

minijail_add_fs_restriction_rx(j, "/lib");

minijail_add_fs_restriction_rx(j, "/lib64");

minijail_add_fs_restriction_rx(j, "/usr/lib");

minijail_add_fs_restriction_rx(j, "/usr/lib64");

// Common locations for services invoking Minijail.

minijail_add_fs_restriction_rx(j, "/bin");

minijail_add_fs_restriction_rx(j, "/sbin");

minijail_add_fs_restriction_rx(j, "/usr/sbin");

minijail_add_fs_restriction_rx(j, "/usr/bin");

// Common /etc locations.

minijail_add_fs_restriction_ro(j, "/etc/group");

minijail_add_fs_restriction_ro(j, "/etc/passwd");

}

void API minijail_use_caps(struct minijail *j, uint64_t capmask)

{

/*

* 'minijail_use_caps' configures a runtime-capabilities-only

* environment, including a bounding set matching the thread's runtime

* (permitted|inheritable|effective) sets.

* Therefore, it will override any existing bounding set configurations

* since the latter would allow gaining extra runtime capabilities from

* file capabilities.

*/

if (j->flags.capbset_drop) {

warn("overriding bounding set configuration");

j->cap_bset = 0;

j->flags.capbset_drop = 0;

}

j->caps = capmask;

j->flags.use_caps = 1;

}

void API minijail_capbset_drop(struct minijail *j, uint64_t capmask)

{

if (j->flags.use_caps) {

/*

* 'minijail_use_caps' will have already configured a capability

* bounding set matching the (permitted|inheritable|effective)

* sets. Abort if the user tries to configure a separate

* bounding set. 'minijail_capbset_drop' and 'minijail_use_caps'

* are mutually exclusive.

*/

die("runtime capabilities already configured, can't drop "

"bounding set separately");

}

j->cap_bset = capmask;

j->flags.capbset_drop = 1;

}

void API minijail_set_ambient_caps(struct minijail *j)

{

j->flags.set_ambient_caps = 1;

}

void API minijail_reset_signal_mask(struct minijail *j)

{

j->flags.reset_signal_mask = 1;

}

void API minijail_reset_signal_handlers(struct minijail *j)

{

j->flags.reset_signal_handlers = 1;

}

void API minijail_namespace_vfs(struct minijail *j)

{

j->flags.vfs = 1;

}

void API minijail_namespace_enter_vfs(struct minijail *j, const char *ns_path)

{

/* Note: Do not use O_CLOEXEC here. We'll close it after we use it. */

int ns_fd = open(ns_path, O_RDONLY);

if (ns_fd < 0) {

pdie("failed to open namespace '%s'", ns_path);

}

j->mountns_fd = ns_fd;

j->flags.enter_vfs = 1;

}

void API minijail_new_session_keyring(struct minijail *j)

{

j->flags.new_session_keyring = 1;

}

void API minijail_skip_setting_securebits(struct minijail *j,

uint64_t securebits_skip_mask)

{

j->securebits_skip_mask = securebits_skip_mask;

}

void API minijail_remount_mode(struct minijail *j, unsigned long mode)

{

j->remount_mode = mode;

}

void API minijail_skip_remount_private(struct minijail *j)

{

j->remount_mode = 0;

}

void API minijail_namespace_pids(struct minijail *j)

{

j->flags.vfs = 1;

j->flags.remount_proc_ro = 1;

j->flags.pids = 1;

j->flags.do_init = 1;

}

void API minijail_namespace_pids_rw_proc(struct minijail *j)

{

j->flags.vfs = 1;

j->flags.pids = 1;

j->flags.do_init = 1;

}

void API minijail_namespace_ipc(struct minijail *j)

{

j->flags.ipc = 1;

}

void API minijail_namespace_uts(struct minijail *j)

{

j->flags.uts = 1;

}

int API minijail_namespace_set_hostname(struct minijail *j, const char *name)

{

if (j->hostname)

return -EINVAL;

minijail_namespace_uts(j);

j->hostname = strdup(name);

if (!j->hostname)

return -ENOMEM;

return 0;

}

void API minijail_namespace_net_loopback(struct minijail *j,

bool enable_loopback)

{

j->flags.net = 1;

j->flags.net_loopback = enable_loopback;

}

void API minijail_namespace_net(struct minijail *j)

{

minijail_namespace_net_loopback(j, true);

}

void API minijail_namespace_enter_net(struct minijail *j, const char *ns_path)

{

/* Note: Do not use O_CLOEXEC here. We'll close it after we use it. */

int ns_fd = open(ns_path, O_RDONLY);

if (ns_fd < 0) {

pdie("failed to open namespace '%s'", ns_path);

}

j->netns_fd = ns_fd;

j->flags.enter_net = 1;

}

void API minijail_namespace_cgroups(struct minijail *j)

{

j->flags.ns_cgroups = 1;

}

void API minijail_close_open_fds(struct minijail *j)

{

j->flags.close_open_fds = 1;

}

void API minijail_remount_proc_readonly(struct minijail *j)

{

j->flags.vfs = 1;

j->flags.remount_proc_ro = 1;

}

void API minijail_namespace_user(struct minijail *j)

{

j->flags.userns = 1;

}

void API minijail_namespace_user_disable_setgroups(struct minijail *j)

{

j->flags.disable_setgroups = 1;

}

int API minijail_uidmap(struct minijail *j, const char *uidmap)

{

j->uidmap = strdup(uidmap);

if (!j->uidmap)

return -ENOMEM;

char *ch;

for (ch = j->uidmap; *ch; ch++) {

if (*ch == ',')

*ch = '\n';

}

return 0;

}

int API minijail_gidmap(struct minijail *j, const char *gidmap)

{

j->gidmap = strdup(gidmap);

if (!j->gidmap)

return -ENOMEM;

char *ch;

for (ch = j->gidmap; *ch; ch++) {

if (*ch == ',')

*ch = '\n';

}

return 0;

}

void API minijail_inherit_usergroups(struct minijail *j)

{

j->flags.inherit_suppl_gids = 1;

}

void API minijail_run_as_init(struct minijail *j)

{

/*

* Since the jailed program will become 'init' in the new PID namespace,

* Minijail does not need to fork an 'init' process.

*/

j->flags.run_as_init = 1;

}

int API minijail_enter_chroot(struct minijail *j, const char *dir)

{

if (j->chrootdir)

return -EINVAL;

j->chrootdir = strdup(dir);

if (!j->chrootdir)

return -ENOMEM;

j->flags.chroot = 1;

return 0;

}

int API minijail_enter_pivot_root(struct minijail *j, const char *dir)

{

if (j->chrootdir)

return -EINVAL;

j->chrootdir = strdup(dir);

if (!j->chrootdir)