Skip to content

Commit

Permalink
config.proto: reflow field numbering
Browse files Browse the repository at this point in the history
  • Loading branch information
@robertswiecki
robertswiecki committed Jun 27, 2024
1 parent 3a7788d commit 86679ca
Showing 1 changed file with 89 additions and 93 deletions.
182 changes: 89 additions & 93 deletions config.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,178 +104,174 @@ message NsJailConfig {
optional bool daemon = 12 [default = false];
/* Maximum number of CPUs to use: 0 - no limit */
optional uint32 max_cpus = 13 [default = 0];
/* Niceness level of the jailed process */
optional int32 nice_level = 14 [default = 19];

/* FD to log to. */
optional int32 log_fd = 14;
optional int32 log_fd = 15;
/* File to save logs to. */
optional string log_file = 15;
optional string log_file = 16;
/* Minimum log level displayed.
See 'msg LogLevel' description for more */
optional LogLevel log_level = 16;
optional LogLevel log_level = 17;

/* Should the current environment variables be kept
when executing the binary */
optional bool keep_env = 17 [default = false];
optional bool keep_env = 18 [default = false];
/* EnvVars to be set before executing binaries. If the envar doesn't contain '='
(e.g. just the 'DISPLAY' string), the current envar value will be used */
repeated string envar = 18;
repeated string envar = 19;

/* Should capabilities be preserved or dropped */
optional bool keep_caps = 19 [default = false];
optional bool keep_caps = 20 [default = false];
/* Which capabilities should be preserved if keep_caps == false.
Format: "CAP_SYS_PTRACE" */
repeated string cap = 20;
repeated string cap = 21;
/* Should nsjail close FD=0,1,2 before executing the process */
optional bool silent = 21 [default = false];
optional bool silent = 22 [default = false];
/* Should the child process have control over terminal?
Can be useful to allow /bin/sh to provide
job control / signals. Dangerous, can be used to put
characters into the controlling terminal back */
optional bool skip_setsid = 22 [default = false];
optional bool skip_setsid = 23 [default = false];
/* Redirect sdterr of the process to /dev/null instead of the socket or original TTY */
optional bool stderr_to_null = 23 [default = false];
optional bool stderr_to_null = 24 [default = false];
/* Which FDs should be passed to the newly executed process
By default only FD=0,1,2 are passed */
repeated int32 pass_fd = 24;
repeated int32 pass_fd = 25;
/* Setting it to true will allow to have set-uid binaries
inside the jail */
optional bool disable_no_new_privs = 25 [default = false];
optional bool disable_no_new_privs = 26 [default = false];
/* Set this to true to forward fatal signals to the child process instead
* of always using SIGKILL. */
optional bool forward_signals = 27 [default = false];
/* Disable rdtsc and rdtscp instructions. WARNING: To make it effective, you also need to
* forbid `prctl(PR_SET_TSC, PR_TSC_ENABLE, ...)` in seccomp rules! (x86 and x86_64 only).
* Dynamic binaries produced by GCC seem to rely on RDTSC, but static ones should work. */
optional bool disable_tsc = 28 [default = false];

/* Various rlimits, the rlimit_as/rlimit_core/... are used only if
rlimit_as_type/rlimit_core_type/... are set to RLimit::VALUE */
optional uint64 rlimit_as = 26 [default = 4096]; /* In MiB */
optional RLimit rlimit_as_type = 27 [default = VALUE];
optional uint64 rlimit_core = 28 [default = 0]; /* In MiB */
optional RLimit rlimit_core_type = 29 [default = VALUE];
optional uint64 rlimit_cpu = 30 [default = 600]; /* In seconds */
optional RLimit rlimit_cpu_type = 31 [default = VALUE];
optional uint64 rlimit_fsize = 32 [default = 1]; /* In MiB */
optional RLimit rlimit_fsize_type = 33 [default = VALUE];
optional uint64 rlimit_nofile = 34 [default = 32];
optional RLimit rlimit_nofile_type = 35 [default = VALUE];
optional uint64 rlimit_as = 29 [default = 4096]; /* In MiB */
optional RLimit rlimit_as_type = 30 [default = VALUE];
optional uint64 rlimit_core = 31 [default = 0]; /* In MiB */
optional RLimit rlimit_core_type = 32 [default = VALUE];
optional uint64 rlimit_cpu = 33 [default = 600]; /* In seconds */
optional RLimit rlimit_cpu_type = 34 [default = VALUE];
optional uint64 rlimit_fsize = 35 [default = 1]; /* In MiB */
optional RLimit rlimit_fsize_type = 36 [default = VALUE];
optional uint64 rlimit_nofile = 37 [default = 32];
optional RLimit rlimit_nofile_type = 38 [default = VALUE];
/* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by
* default here */
optional uint64 rlimit_nproc = 36 [default = 1024];
optional RLimit rlimit_nproc_type = 37 [default = SOFT];
optional uint64 rlimit_nproc = 39 [default = 1024];
optional RLimit rlimit_nproc_type = 40 [default = SOFT];
/* In MiB, use the soft limit value by default */
optional uint64 rlimit_stack = 38 [default = 8];
optional RLimit rlimit_stack_type = 39 [default = SOFT];
optional uint64 rlimit_stack = 41 [default = 8];
optional RLimit rlimit_stack_type = 42 [default = SOFT];
/* In KB, use the soft limit value by default */
optional uint64 rlimit_memlock = 40 [default = 64];
optional RLimit rlimit_memlock_type = 41 [default = SOFT];
optional uint64 rlimit_rtprio = 42 [default = 0];
optional RLimit rlimit_rtprio_type = 43 [default = SOFT];
optional uint64 rlimit_msgqueue = 44 [default = 1024]; /* In bytes */
optional RLimit rlimit_msgqueue_type = 45 [default = SOFT];
optional uint64 rlimit_memlock = 43 [default = 64];
optional RLimit rlimit_memlock_type = 44 [default = SOFT];
optional uint64 rlimit_rtprio = 45 [default = 0];
optional RLimit rlimit_rtprio_type = 46 [default = SOFT];
optional uint64 rlimit_msgqueue = 47 [default = 1024]; /* In bytes */
optional RLimit rlimit_msgqueue_type = 48 [default = SOFT];

/* Disable all rlimits, default to limits set by parent */
optional bool disable_rl = 46 [default = false];
optional bool disable_rl = 49 [default = false];

/* See 'man personality' for more */
optional bool persona_addr_compat_layout = 47 [default = false];
optional bool persona_mmap_page_zero = 48 [default = false];
optional bool persona_read_implies_exec = 49 [default = false];
optional bool persona_addr_limit_3gb = 50 [default = false];
optional bool persona_addr_no_randomize = 51 [default = false];
optional bool persona_addr_compat_layout = 50 [default = false];
optional bool persona_mmap_page_zero = 51 [default = false];
optional bool persona_read_implies_exec = 52 [default = false];
optional bool persona_addr_limit_3gb = 53 [default = false];
optional bool persona_addr_no_randomize = 54 [default = false];

/* Which name-spaces should be used? */
optional bool clone_newnet = 52 [default = true];
optional bool clone_newuser = 53 [default = true];
optional bool clone_newns = 54 [default = true];
optional bool clone_newpid = 55 [default = true];
optional bool clone_newipc = 56 [default = true];
optional bool clone_newuts = 57 [default = true];
optional bool clone_newnet = 55 [default = true];
optional bool clone_newuser = 56 [default = true];
optional bool clone_newns = 57 [default = true];
optional bool clone_newpid = 58 [default = true];
optional bool clone_newipc = 59 [default = true];
optional bool clone_newuts = 60 [default = true];
/* Disable for kernel versions < 4.6 as it's not supported there */
optional bool clone_newcgroup = 58 [default = true];
optional bool clone_newcgroup = 61 [default = true];
/* Supported with kernel versions >= 5.3 */
optional bool clone_newtime = 59 [default = false];
optional bool clone_newtime = 62 [default = false];

/* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
for more */
repeated IdMap uidmap = 60;
repeated IdMap gidmap = 61;
repeated IdMap uidmap = 63;
repeated IdMap gidmap = 64;

/* Should /proc be mounted (R/O)? This can also be added in the 'mount'
section below */
optional bool mount_proc = 62 [default = false];
optional bool mount_proc = 65 [default = false];
/* Mount points inside the jail. See the description for 'msg MountPt'
for more */
repeated MountPt mount = 63;
repeated MountPt mount = 66;

/* Kafel seccomp-bpf policy file or a string:
Homepage of the project: https://github.com/google/kafel */
optional string seccomp_policy_file = 64;
repeated string seccomp_string = 65;
optional string seccomp_policy_file = 67;
repeated string seccomp_string = 68;
/* Setting it to true makes audit write seccomp logs to dmesg */
optional bool seccomp_log = 66 [default = false];
optional bool seccomp_log = 69 [default = false];

/* If > 0, maximum cumulative size of RAM used inside any jail */
optional uint64 cgroup_mem_max = 67 [default = 0]; /* In bytes */
optional uint64 cgroup_mem_max = 70 [default = 0]; /* In bytes */
/* If > 0, maximum cumulative size of RAM + swap used inside any jail */
optional uint64 cgroup_mem_memsw_max = 91 [default = 0]; /* In bytes */
optional uint64 cgroup_mem_memsw_max = 71 [default = 0]; /* In bytes */
/* If >= 0, maximum cumulative size of swap used inside any jail */
optional int64 cgroup_mem_swap_max = 92 [default = -1]; /* In bytes */
optional int64 cgroup_mem_swap_max = 72 [default = -1]; /* In bytes */
/* Mount point for cgroups-memory in your system */
optional string cgroup_mem_mount = 68 [default = "/sys/fs/cgroup/memory"];
optional string cgroup_mem_mount = 73 [default = "/sys/fs/cgroup/memory"];
/* Writeable directory (for the nsjail user) under cgroup_mem_mount */
optional string cgroup_mem_parent = 69 [default = "NSJAIL"];
optional string cgroup_mem_parent = 74 [default = "NSJAIL"];

/* If > 0, maximum number of PIDs (threads/processes) inside jail */
optional uint64 cgroup_pids_max = 70 [default = 0];
optional uint64 cgroup_pids_max = 75 [default = 0];
/* Mount point for cgroups-pids in your system */
optional string cgroup_pids_mount = 71 [default = "/sys/fs/cgroup/pids"];
optional string cgroup_pids_mount = 76 [default = "/sys/fs/cgroup/pids"];
/* Writeable directory (for the nsjail user) under cgroup_pids_mount */
optional string cgroup_pids_parent = 72 [default = "NSJAIL"];
optional string cgroup_pids_parent = 77 [default = "NSJAIL"];

/* If > 0, Class identifier of network packets inside jail */
optional uint32 cgroup_net_cls_classid = 73 [default = 0];
optional uint32 cgroup_net_cls_classid = 78 [default = 0];
/* Mount point for cgroups-net-cls in your system */
optional string cgroup_net_cls_mount = 74 [default = "/sys/fs/cgroup/net_cls"];
optional string cgroup_net_cls_mount = 79 [default = "/sys/fs/cgroup/net_cls"];
/* Writeable directory (for the nsjail user) under cgroup_net_mount */
optional string cgroup_net_cls_parent = 75 [default = "NSJAIL"];
optional string cgroup_net_cls_parent = 80 [default = "NSJAIL"];

/* If > 0, number of milliseconds of CPU time per second that jailed processes can use */
optional uint32 cgroup_cpu_ms_per_sec = 76 [default = 0];
optional uint32 cgroup_cpu_ms_per_sec = 81 [default = 0];
/* Mount point for cgroups-cpu in your system */
optional string cgroup_cpu_mount = 77 [default = "/sys/fs/cgroup/cpu"];
optional string cgroup_cpu_mount = 82 [default = "/sys/fs/cgroup/cpu"];
/* Writeable directory (for the nsjail user) under cgroup_cpu_mount */
optional string cgroup_cpu_parent = 78 [default = "NSJAIL"];
optional string cgroup_cpu_parent = 83 [default = "NSJAIL"];

/* Mount point for cgroup v2 in your system */
optional string cgroupv2_mount = 79 [default = "/sys/fs/cgroup"];
optional string cgroupv2_mount = 84 [default = "/sys/fs/cgroup"];
/* Use cgroup v2 */
optional bool use_cgroupv2 = 80 [default = false];
optional bool use_cgroupv2 = 85 [default = false];
/* Check whether cgroupv2 is available, and use it if available. */
optional bool detect_cgroupv2 = 86 [default = false];

/* Should the 'lo' interface be brought up (active) inside this jail? */
optional bool iface_no_lo = 81 [default = false];
optional bool iface_no_lo = 87 [default = false];

/* Put this interface inside the jail */
repeated string iface_own = 82;
repeated string iface_own = 88;

/* Parameters for the cloned MACVLAN interface inside jail */
optional string macvlan_iface = 83; /* Interface to be cloned, eg 'eth0' */
optional string macvlan_vs_ip = 84 [default = "192.168.0.2"];
optional string macvlan_vs_nm = 85 [default = "255.255.255.0"];
optional string macvlan_vs_gw = 86 [default = "192.168.0.1"];
optional string macvlan_vs_ma = 87 [default = ""];
optional string macvlan_vs_mo = 88 [default = "private"];

/* Niceness level of the jailed process */
optional int32 nice_level = 89 [default = 19];
optional string macvlan_iface = 89; /* Interface to be cloned, eg 'eth0' */
optional string macvlan_vs_ip = 90 [default = "192.168.0.2"];
optional string macvlan_vs_nm = 91 [default = "255.255.255.0"];
optional string macvlan_vs_gw = 92 [default = "192.168.0.1"];
optional string macvlan_vs_ma = 93 [default = ""];
optional string macvlan_vs_mo = 94 [default = "private"];

/* Binary path (with arguments) to be executed. If not specified here, it
can be specified with cmd-line as "-- /path/to/command arg1 arg2" */
optional Exe exec_bin = 90;

/* Disable rdtsc and rdtscp instructions. WARNING: To make it effective, you also need to
* forbid `prctl(PR_SET_TSC, PR_TSC_ENABLE, ...)` in seccomp rules! (x86 and x86_64 only).
* Dynamic binaries produced by GCC seem to rely on RDTSC, but static ones should work. */
optional bool disable_tsc = 93 [default = false];

/* Set this to true to forward fatal signals to the child process instead
* of always using SIGKILL. */
optional bool forward_signals = 94 [default = false];

/* Check whether cgroupv2 is available, and use it if available. */
optional bool detect_cgroupv2 = 95 [default = false];
optional Exe exec_bin = 95;
}

0 comments on commit 86679ca

Please sign in to comment.