Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

make indent depend

Browse Source
This commit is contained in:
Robert Swiecki
2026-08-26 21:39:07 +02:00
parent 60fe8833a8
commit 44e08fd4e5
8 changed files with 42 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
Makefile
View File

@@ -280,7 +280,8 @@ cmdline.o: mnt.h mnt_newapi.h user.h util.h
config.o: config.h nsjail.h config.pb.h caps.h cmdline.h logs.h macros.h config.o: config.h nsjail.h config.pb.h caps.h cmdline.h logs.h macros.h
config.o: mnt.h user.h util.h config.o: mnt.h user.h util.h
contain.o: contain.h nsjail.h config.pb.h caps.h cgroup.h cgroup2.h config.h contain.o: contain.h nsjail.h config.pb.h caps.h cgroup.h cgroup2.h config.h
contain.o: cpu.h logs.h macros.h mnt.h net.h pid.h user.h util.h uts.h contain.o: cpu.h logs.h macros.h missing_defs.h mnt.h net.h pid.h user.h
contain.o: util.h uts.h
cpu.o: cpu.h nsjail.h config.pb.h logs.h util.h cpu.o: cpu.h nsjail.h config.pb.h logs.h util.h
logs.o: logs.h macros.h util.h nsjail.h config.pb.h logs.o: logs.h macros.h util.h nsjail.h config.pb.h
mnt.o: mnt.h nsjail.h config.pb.h logs.h macros.h mnt_legacy.h mnt_newapi.h mnt.o: mnt.h nsjail.h config.pb.h logs.h macros.h mnt_legacy.h mnt_newapi.h
@@ -307,26 +308,27 @@ unotify/syscall.o: unotify/syscall.h unotify/record.h unotify/unotify.pb.h
unotify/syscall.o: logs.h macros.h unotify/syscall_defs.h util.h nsjail.h unotify/syscall.o: logs.h macros.h unotify/syscall_defs.h util.h nsjail.h
unotify/syscall.o: config.pb.h unotify/syscall.o: config.pb.h
util.o: util.h nsjail.h config.pb.h logs.h macros.h missing_defs.h util.o: util.h nsjail.h config.pb.h logs.h macros.h missing_defs.h
nstun/nstun.o: nstun/nstun.h nstun/core.h nstun/net_defs.h nstun/icmp.h nstun/nstun.o: nstun/nstun.h nstun/core.h nstun/buffer_budget.h
nstun/nstun.o: nstun/iface.h nstun/ip.h logs.h macros.h nstun/policy.h nstun/nstun.o: nstun/net_defs.h nstun/icmp.h nstun/iface.h nstun/ip.h logs.h
nstun/nstun.o: nstun/tcp.h nstun/tun.h nstun/udp.h util.h nsjail.h nstun/nstun.o: macros.h nstun/policy.h nstun/tcp.h nstun/tun.h nstun/udp.h
nstun/nstun.o: config.pb.h nstun/nstun.o: util.h nsjail.h config.pb.h
nstun/policy.o: nstun/policy.h nstun/core.h nstun/net_defs.h nstun/nstun.h nstun/policy.o: nstun/policy.h nstun/core.h nstun/buffer_budget.h
nstun/policy.o: logs.h config.pb.h nsjail.h nstun/policy.o: nstun/net_defs.h nstun/nstun.h logs.h config.pb.h nsjail.h
nstun/encap.o: nstun/encap.h nstun/net_defs.h logs.h nstun/encap.o: nstun/encap.h nstun/net_defs.h logs.h
nstun/iface.o: nstun/iface.h logs.h macros.h nstun/net_defs.h nsjail.h nstun/iface.o: nstun/iface.h logs.h macros.h nstun/net_defs.h nsjail.h
nstun/iface.o: config.pb.h nstun/nstun.h nstun/iface.o: config.pb.h nstun/nstun.h
nstun/tun.o: nstun/tun.h nstun/core.h nstun/net_defs.h nstun/nstun.h nstun/tun.o: nstun/tun.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
nstun/tun.o: nstun/icmp.h nstun/ip.h logs.h nstun/tun.o: nstun/nstun.h nstun/icmp.h nstun/ip.h logs.h
nstun/ip.o: nstun/ip.h nstun/core.h nstun/net_defs.h nstun/nstun.h nstun/ip.o: nstun/ip.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
nstun/ip.o: nstun/icmp.h logs.h nstun/tcp.h nstun/udp.h nstun/ip.o: nstun/nstun.h nstun/icmp.h logs.h nstun/tcp.h nstun/udp.h
nstun/icmp.o: nstun/icmp.h nstun/core.h nstun/net_defs.h nstun/nstun.h logs.h nstun/icmp.o: nstun/icmp.h nstun/core.h nstun/buffer_budget.h
nstun/icmp.o: macros.h nstun/policy.h nstun/tun.h nstun/icmp.o: nstun/net_defs.h nstun/nstun.h logs.h macros.h nstun/policy.h
nstun/udp.o: nstun/udp.h nstun/core.h nstun/net_defs.h nstun/nstun.h nstun/icmp.o: nstun/tun.h
nstun/udp.o: nstun/encap.h nstun/icmp.h logs.h macros.h nstun/policy.h nstun/udp.o: nstun/udp.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
nstun/udp.o: nstun/tun.h nstun/udp.o: nstun/nstun.h nstun/encap.h nstun/icmp.h logs.h macros.h
nstun/tcp.o: nstun/tcp.h nstun/core.h nstun/net_defs.h nstun/nstun.h nstun/udp.o: nstun/policy.h nstun/tun.h
nstun/tcp.o: nstun/encap.h logs.h macros.h nstun/policy.h nstun/tun.h util.h nstun/tcp.o: nstun/tcp.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
nstun/tcp.o: nsjail.h config.pb.h nstun/tcp.o: nstun/nstun.h nstun/encap.h logs.h macros.h nstun/policy.h
nstun/tcp.o: nstun/tun.h util.h nsjail.h config.pb.h
config.pb.o: config.pb.h config.pb.o: config.pb.h
unotify/unotify.pb.o: unotify/unotify.pb.h unotify/unotify.pb.o: unotify/unotify.pb.h

3
mnt_legacy.cc
View File

@@ -340,7 +340,8 @@ bool remountPt(mnt::mount_t& mpt) {
} }
std::string mp(p, endp - p); std::string mp(p, endp - p);
if (mp != mpt.dst && mp.compare(0, prefix.size(), prefix) == 0) { if (mp != mpt.dst && mp.compare(0, prefix.size(), prefix) == 0) {
/* best-effort; remountOne logs any submount it can't re-flag */ /* best-effort; remountOne logs any submount it can't
* re-flag */
remountOne(mp, mpt); remountOne(mp, mpt);
} }
} }

17
mnt_newapi.cc
View File

@@ -84,7 +84,8 @@ std::unique_ptr<std::string> buildMountTree(nsj_t*, std::vector<mnt::mount_t>*)
namespace mnt { namespace mnt {
namespace newapi { namespace newapi {
static bool applyMountFlags(int fd, uintptr_t flags, bool log_error = true, bool recursive = false) { static bool applyMountFlags(
int fd, uintptr_t flags, bool log_error = true, bool recursive = false) {
struct mount_attr attr = {}; struct mount_attr attr = {};
if (flags & MS_RDONLY) { if (flags & MS_RDONLY) {
@@ -185,8 +186,8 @@ static bool remountWithLegacyMount(const mount_t& mpt) {
} }
static bool openMountForRemount(mount_t* mpt, int parent_fd, const char* basename) { static bool openMountForRemount(mount_t* mpt, int parent_fd, const char* basename) {
mpt->fd = util::syscall( mpt->fd = util::syscall(__NR_open_tree, (uintptr_t)parent_fd, (uintptr_t)basename,
__NR_open_tree, (uintptr_t)parent_fd, (uintptr_t)basename, (uintptr_t)OPEN_TREE_CLOEXEC); (uintptr_t)OPEN_TREE_CLOEXEC);
if (mpt->fd < 0) { if (mpt->fd < 0) {
PLOG_W("open_tree(parent_fd, '%s')", basename); PLOG_W("open_tree(parent_fd, '%s')", basename);
return false; return false;
@@ -417,7 +418,8 @@ static bool mountSymlinkAt(mount_t* mpt, int parent_fd, const char* basename) {
PLOG_E("symlinkat('%s' -> '%s')", mpt->src.c_str(), basename); PLOG_E("symlinkat('%s' -> '%s')", mpt->src.c_str(), basename);
return false; return false;
} }
PLOG_W("symlinkat('%s' -> '%s') failed (non-mandatory)", mpt->src.c_str(), basename); PLOG_W(
"symlinkat('%s' -> '%s') failed (non-mandatory)", mpt->src.c_str(), basename);
} }
return true; return true;
} }
@@ -492,8 +494,7 @@ static bool doBindMountAt(mount_t* mpt, int parent_fd, const char* basename) {
* keep their original suid/dev/exec-permitting attributes inside the jail. * keep their original suid/dev/exec-permitting attributes inside the jail.
* This mirrors the recursive read-only pass done later on the root. * This mirrors the recursive read-only pass done later on the root.
*/ */
if (!applyMountFlags( if (!applyMountFlags(mnt_fd, mpt->flags & ~MS_RDONLY, true, (mpt->flags & MS_REC) != 0)) {
mnt_fd, mpt->flags & ~MS_RDONLY, true, (mpt->flags & MS_REC) != 0)) {
LOG_W("Failed to apply mount flags to '%s'", basename); LOG_W("Failed to apply mount flags to '%s'", basename);
} }
@@ -542,8 +543,8 @@ static bool mountSinglePointAt(mount_t* mpt, int root_fd) {
} }
} }
} else { } else {
int fd = openat(parent_fd, basename.c_str(), int fd = openat(
O_CREAT | O_RDONLY | O_CLOEXEC | O_NOFOLLOW, 0644); parent_fd, basename.c_str(), O_CREAT | O_RDONLY | O_CLOEXEC | O_NOFOLLOW, 0644);
if (fd >= 0) { if (fd >= 0) {
close(fd); close(fd);
} else if (errno != EROFS || !util::existsAsRegAt(parent_fd, basename.c_str())) { } else if (errno != EROFS || !util::existsAsRegAt(parent_fd, basename.c_str())) {

4
nstun/icmp.cc
View File

@@ -179,7 +179,7 @@ void handle_icmp6(Context* ctx, const ip6_hdr* ip, std::span<const uint8_t> payl
LOG_D("ICMPv6 dropped by policy"); LOG_D("ICMPv6 dropped by policy");
return; return;
} else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 || } else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 ||
rule.action == NSTUN_ACTION_ENCAP_CONNECT) { rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
LOG_D("Proxy encapsulation is not supported for ICMPv6, dropping"); LOG_D("Proxy encapsulation is not supported for ICMPv6, dropping");
return; return;
} else if (rule.action == NSTUN_ACTION_REJECT) { } else if (rule.action == NSTUN_ACTION_REJECT) {
@@ -303,7 +303,7 @@ void handle_icmp4(Context* ctx, const ip4_hdr* ip, std::span<const uint8_t> payl
LOG_D("ICMP dropped by policy"); LOG_D("ICMP dropped by policy");
return; return;
} else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 || } else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 ||
rule.action == NSTUN_ACTION_ENCAP_CONNECT) { rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
LOG_D("Proxy encapsulation is not supported for ICMP, dropping"); LOG_D("Proxy encapsulation is not supported for ICMP, dropping");
return; return;
} else if (rule.action == NSTUN_ACTION_REJECT) { } else if (rule.action == NSTUN_ACTION_REJECT) {

4
nstun/nstun.cc
View File

@@ -547,8 +547,8 @@ void nstun_destroy_parent(struct nstun_context_handle* handle) {
if (handle->context != nullptr && handle->context->stop_fd != -1) { if (handle->context != nullptr && handle->context->stop_fd != -1) {
const uint64_t one = 1; const uint64_t one = 1;
if (TEMP_FAILURE_RETRY( if (TEMP_FAILURE_RETRY(write(handle->context->stop_fd, &one, sizeof(one))) == -1 &&
write(handle->context->stop_fd, &one, sizeof(one))) == -1 && errno != EPIPE) { errno != EPIPE) {
PLOG_W("write(stop_fd)"); PLOG_W("write(stop_fd)");
} }
} }

3
nstun/nstun.h
View File

@@ -52,8 +52,7 @@ struct nsj_t;
struct nstun_context_handle; struct nstun_context_handle;
bool nstun_init_child(int sock, struct nsj_t* nsj); bool nstun_init_child(int sock, struct nsj_t* nsj);
bool nstun_init_parent( bool nstun_init_parent(int sock, struct nsj_t* nsj, struct nstun_context_handle** out_handle);
int sock, struct nsj_t* nsj, struct nstun_context_handle** out_handle);
void nstun_destroy_parent(struct nstun_context_handle* handle); void nstun_destroy_parent(struct nstun_context_handle* handle);
#ifdef __cplusplus #ifdef __cplusplus

7
sandbox.cc
View File

@@ -139,10 +139,9 @@ bool applyPolicy(nsj_t* nsj, int pipefd) {
* running with NO seccomp policy at all despite one being requested. * running with NO seccomp policy at all despite one being requested.
* Fail loudly instead of silently dropping the requested policy. * Fail loudly instead of silently dropping the requested policy.
*/ */
LOG_E( LOG_E("seccomp_unotify was requested but this execution mode has no "
"seccomp_unotify was requested but this execution mode has no " "supervisor to receive the notification fd; refusing to run the "
"supervisor to receive the notification fd; refusing to run the " "sandboxee without the requested seccomp policy");
"sandboxee without the requested seccomp policy");
return false; return false;
} }
if (!installUnotifyFilter(nsj, pipefd)) { if (!installUnotifyFilter(nsj, pipefd)) {

4
util.cc
View File

@@ -300,8 +300,8 @@ bool createDirRecursively(const char* dir) {
int dir_fd = TEMP_FAILURE_RETRY( int dir_fd = TEMP_FAILURE_RETRY(
openat(prev_dir_fd, curr, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW)); openat(prev_dir_fd, curr, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW));
if (dir_fd == -1) { if (dir_fd == -1) {
PLOG_W("openat('%d', %s, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW)", prev_dir_fd, PLOG_W("openat('%d', %s, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW)",
QC(curr)); prev_dir_fd, QC(curr));
close(prev_dir_fd); close(prev_dir_fd);
return false; return false;
} }