minijail0: add minimalistic-mountns-nodev profile
We have a decent number of situations where people want access to
some /dev nodes, but are unable to bind specific nodes/dirs because
the names are dynamic/flexible, or are hotplugged (and mignt not
exist at startup). The current solution for them is to copy the
full command line that minimalistic-mountns uses but drop the /dev
related settings.
Lets create a minimalistic-mountns-nodev profile that is equivalent
to minimalistic-mountns but doesn't set up /dev at all. This lets
callers -b/dev or do whatever else they like instead.
Bug: None
Test: `make check` passes
Test: `minijail0 --profile=minimalistic-mountns-nodev /bin/ls -l /dev/` works
Change-Id: I4b8b2a9e5cfaa84d5911b91bb46349b51c5589a6
diff --git a/minijail0.1 b/minijail0.1
index 642c48c..cab94ec 100644
--- a/minijail0.1
+++ b/minijail0.1
@@ -309,6 +309,10 @@
\fBminimalistic-mountns\fR
Set up a minimalistic mount namespace. Equivalent to \fB-v -P /var/empty
-b / -b /proc -b /dev/log -t -r --mount-dev\fR.
+.TP
+\fBminimalistic-mountns-nodev\fR
+Set up a minimalistic mount namespace with an empty /dev path. Equivalent to
+\fB-v -P /var/empty -b/ -b/proc -t -r\fR.
.SH IMPLEMENTATION
This program is broken up into two parts: \fBminijail0\fR (the frontend) and a helper
library called \fBlibminijailpreload\fR. Some jailings can only be achieved
diff --git a/minijail0_cli.c b/minijail0_cli.c
index 277c222..f19a053 100644
--- a/minijail0_cli.c
+++ b/minijail0_cli.c
@@ -376,7 +376,8 @@
{
/* Note: New profiles should be added in minijail0_cli_unittest.cc. */
- if (!strcmp(profile, "minimalistic-mountns")) {
+ if (!strcmp(profile, "minimalistic-mountns") ||
+ !strcmp(profile, "minimalistic-mountns-nodev")) {
minijail_namespace_vfs(j);
if (minijail_bind(j, "/", "/", 0)) {
fprintf(stderr, "minijail_bind(/) failed.\n");
@@ -386,11 +387,13 @@
fprintf(stderr, "minijail_bind(/proc) failed.\n");
exit(1);
}
- if (minijail_bind(j, "/dev/log", "/dev/log", 0)) {
- fprintf(stderr, "minijail_bind(/dev/log) failed.\n");
- exit(1);
+ if (!strcmp(profile, "minimalistic-mountns")) {
+ if (minijail_bind(j, "/dev/log", "/dev/log", 0)) {
+ fprintf(stderr, "minijail_bind(/dev/log) failed.\n");
+ exit(1);
+ }
+ minijail_mount_dev(j);
}
- minijail_mount_dev(j);
if (!*tmp_size) {
/* Avoid clobbering |tmp_size| if it was already set. */
*tmp_size = DEFAULT_TMP_SIZE;
diff --git a/minijail0_cli_unittest.cc b/minijail0_cli_unittest.cc
index 0d6a07d..077f5f7 100644
--- a/minijail0_cli_unittest.cc
+++ b/minijail0_cli_unittest.cc
@@ -286,6 +286,7 @@
// This should list all valid profiles.
const std::vector<std::string> profiles = {
"minimalistic-mountns",
+ "minimalistic-mountns-nodev",
};
for (const auto profile : profiles) {
