Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

mnt: added nosuid/nodev/noexec flags to config

Browse Source 
Closes #70
This commit is contained in:
Wiktor Garbacz
2018-07-27 11:27:01 +02:00
parent 26d086f986
commit ba14675185
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
config.cc
View File

@@ -210,6 +210,9 @@ static bool configParseInternal(nsjconf_t* nsjconf, const nsjail::NsJailConfig&
uintptr_t flags = (!njc.mount(i).rw()) ? MS_RDONLY : 0;
flags |= njc.mount(i).is_bind() ? (MS_BIND | MS_REC | MS_PRIVATE) : 0;
flags |= njc.mount(i).nosuid() ? MS_NOSUID : 0;
flags |= njc.mount(i).nodev() ? MS_NODEV : 0;
flags |= njc.mount(i).noexec() ? MS_NOEXEC : 0;
bool is_mandatory = njc.mount(i).mandatory();
bool is_symlink = njc.mount(i).is_symlink();
std::string src_content = njc.mount(i).src_content();

6
config.proto
View File

@@ -51,6 +51,12 @@ message MountPt {
optional bool mandatory = 11 [default = true];
/* Is it a symlink (instead of real mount point)? */
optional bool is_symlink = 12 [default = false];
/* Is it a nosuid mount */
optional bool nosuid = 13 [default = false];
/* Is it a nodev mount */
optional bool nodev = 14 [default = false];
/* Is it a noexec mount */
optional bool noexec = 15 [default = false];
}
enum RLimit {
VALUE = 0; /* Use the provided value */

5
mnt.cc
View File

@@ -248,7 +248,10 @@ static bool remount(const mount_t& mpt) {
{MS_RELATIME, ST_RELATIME},
};
unsigned long new_flags = MS_REMOUNT | MS_BIND | (mpt.flags & MS_RDONLY);
const unsigned long per_mountpoint_flags =
MS_LAZYTIME | MS_MANDLOCK | MS_NOATIME | MS_NODEV | MS_NODIRATIME | MS_NOEXEC |
MS_NOSUID | MS_RELATIME | MS_RDONLY | MS_SYNCHRONOUS;
unsigned long new_flags = MS_REMOUNT | MS_BIND | (mpt.flags & per_mountpoint_flags);
for (const auto& i : mountPairs) {
if (vfs.f_flag & i.vfs_flag) {
new_flags |= i.mount_flag;