commit | 130b3b94864ed367261111bef8f5d05b18cd81ce | [log] [tgz] |
---|---|---|
author | Victor Hsieh <[email protected]> | Mon Apr 10 18:12:55 2023 +0000 |
committer | Automerger Merge Worker <[email protected]> | Mon Apr 10 18:12:55 2023 +0000 |
tree | 17e5e26de0f068bbaca85f4c799bd8a32450a8bc | |
parent | 22a3d2bdfdd899c0d07fe104f516f1460010404e [diff] | |
parent | 3b8b7debd28ef95e476a0786b114649428ff677c [diff] |
PREUPLOAD hook to nudge sending code review to upstream am: 852af6ac35 am: df9c5bdcf8 am: a4c700d1ba am: 3b8b7debd2 Original change: https://android-review.googlesource.com/c/platform/external/minijail/+/2528601 Change-Id: I182341d1f047148d1c2a646a627595d5d3ec427f Signed-off-by: Automerger Merge Worker <[email protected]>
The Minijail homepage is https://google.github.io/minijail/.
The main source repo is https://chromium.googlesource.com/chromiumos/platform/minijail.
There might be other copies floating around, but this is the official one!
Minijail is a sandboxing and containment tool used in ChromeOS and Android. It provides an executable that can be used to launch and sandbox other programs, and a library that can be used by code to sandbox itself.
You're one git clone
away from happiness.
$ git clone https://chromium.googlesource.com/chromiumos/platform/minijail $ cd minijail
Releases are tagged as linux-vXX
: https://chromium.googlesource.com/chromiumos/platform/minijail/+refs
See the HACKING.md document for more details.
See the RELEASE.md document for more details.
See the tools/README.md document for more details.
We've got a couple of contact points.
The following talk serves as a good introduction to Minijail and how it can be used.
The ChromiumOS project has a comprehensive sandboxing document that is largely based on Minijail.
After you play with the simple examples below, you should check that out.
# id uid=0(root) gid=0(root) groups=0(root),128(pkcs11) # minijail0 -u jorgelo -g 5000 /usr/bin/id uid=72178(jorgelo) gid=5000(eng) groups=5000(eng)
# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status Name: cat ... CapInh: 0000000000003000 CapPrm: 0000000000003000 CapEff: 0000000000003000 CapBnd: 0000000000003000
Q. “Why is it called minijail0?”
A. It is minijail0 because it was a rewrite of an earlier program named minijail, which was considerably less mini, and in particular had a dependency on libchrome (the ChromeOS packaged version of Chromium's //base). We needed a new name to not collide with the deprecated one.
We didn‘t want to call it minijail2 or something that would make people start using it before we were ready, and it was also concretely less since it dropped libbase, etc. Technically, we needed to be able to fork/preload with minimal extra syscall noise which was too hard with libbase at the time (onexit handlers, etc that called syscalls we didn’t want to allow). Also, Elly made a strong case that C would be the right choice for this for linking and ease of controlled surprise system call use.
https://crrev.com/c/4585/ added the original implementation.
Source: Conversations with original authors, ellyjones@ and wad@.