Darren Carreras
660c20d237
contain: fail closed when setsid fails
2026-08-27 17:15:16 -04:00
Robert Swiecki
fc38d1257a
Merge branch 'master' of github.com:google/nsjail
2026-08-26 20:20:49 +02:00
Robert Swiecki
1a13dc98fa
Merge pull request #268 from Vincent550102/reject_directory_stdio
...
Reject directory stdio fds unless explicitly passed
2026-08-26 20:12:26 +02:00
robertswiecki
012e316fe4
Merge pull request #299 from srkyn/fix-pdeathsig-setup-race
...
contain: close PR_SET_PDEATHSIG setup race
2026-08-26 20:11:25 +02:00
David Sarkisyan
900f6649e2
contain: close parent-death signal setup race
2026-08-15 16:31:04 -04:00
David Sarkisyan
3c9e848c61
contain: fail closed when no_new_privs cannot be set
2026-07-20 14:41:33 -04:00
Alexander Lvov
81784bfbac
contain: add core scheduling support (PR_SCHED_CORE)
...
Adds --use_core_scheduling proto flag that calls prctl(PR_SCHED_CORE_CREATE) in the child process, giving each jail its own SMT scheduling group. Prevents sharing a physical core with other tenants and mitigates L1TF/MDS side-channel attacks in multi-tenant environments. Requires Linux >= 5.14; guarded with #ifdef PR_SCHED_CORE for compatibility with older kernel headers.
2026-06-11 10:33:53 +03:00
Vincent550102
9d41a57452
Reject directory stdio fds unless explicitly passed
2026-05-11 20:04:39 +08:00
Robert Swiecki
57a6e17e50
nsjail.h/all - reduce size of nsjail_t and stop duplicating nsjail::NsJailConfig fields. Now nsjail::NsJailConfig is the source of truth for jails' configuraiton
2025-11-24 17:12:43 +01:00
Robert Swiecki
06350410ac
nsjail.h+all: move nsjail::NsJailConfig into struct nsj_t to avoid parameter duplicaiton. Now nsjail::NsJailConfig is the source of configuration truth for jails
2025-11-24 07:21:35 +01:00
Robert Swiecki
7041800e8f
contain/util: implement global close-on-exec via close_range(2). Available since Linux kernel 5.11
2025-09-23 07:08:57 +02:00
Robert Swiecki
84f6d75d26
convert strcmp() to util::StrEq
2023-10-21 18:37:57 +02:00
Robert Swiecki
98ec95ca85
Use nullptr where appropriate
2023-10-20 18:01:36 +02:00
Robert Swiecki
c1515459d7
contain: fail of fcntl(F_GETFD) fails for a fd with something else then EBADFD
2023-10-01 00:32:29 +02:00
Robert Swiecki
f388cad3e0
contain: use prlimit64 instead of setrlimit64 which seems to be glibc-specific, so it compiles with musl too
2023-09-29 18:11:40 +02:00
Robert Swiecki
439606be70
Makefile/indent: add AlwaysBreakBeforeMultilineStrings:false
2023-09-19 20:31:57 +02:00
Robert Swiecki
02458084fe
contain: call prctl(PR_SET_TSC) under x86/x86-64 only
2022-02-18 16:12:27 +01:00
Michał Kowalczyk
16b4416d75
Add disable_tsc option
...
Implemented via prctl(PR_SET_TSC, PR_TSC_SIGSEGV, ...).
2022-02-17 23:53:13 +01:00
Wiktor Garbacz
95e112cf41
Fix formatting
2021-08-03 17:46:08 +02:00
Eli Zrihen
0f903ba9a0
Added rt, memlock & msgq limits
2021-07-19 17:21:34 +03:00
Jay Lees
86293b052e
Add flag to disable rlimits
2019-08-05 03:25:22 -07:00
Robert Swiecki
28d2220b1e
cmdline: no need to check for nice values
2019-06-30 22:03:57 +02:00
Robert Swiecki
494a5f63cd
Add nice_level to cmd-line/config options
2019-06-30 21:50:56 +02:00
Robert Swiecki
d1151ea4bd
contain: log formatting
2019-01-21 20:03:17 +01:00
Robert Swiecki
6a4315f318
More of RETURN_ON_FAILURE
2019-01-01 11:36:02 +01:00
Robert Swiecki
272a85477a
config: Implement --stderr_to_null
2018-06-25 03:12:27 +02:00
Robert Swiecki
b8798fc9a7
use strtoimax when needed
2018-05-26 13:54:17 +02:00
Robert Swiecki
9ed90812c0
better checks for strto*l errors
2018-05-25 23:53:11 +02:00
Robert Swiecki
c4b51e6495
missing macros.h include
2018-04-12 23:49:10 +02:00
Robert Swiecki
810394cf16
switc all == false cmps to !
2018-02-12 15:17:33 +01:00
Robert Swiecki
0efa230cdd
change global vars to _ prefix
2018-02-10 20:32:04 +01:00
Robert Swiecki
97278f191b
log: rename log to logs due to clash with glibc's log
2018-02-10 17:49:15 +01:00
Robert Swiecki
4494deffa7
omit keyword 'struct'
2018-02-10 15:50:12 +01:00
Robert Swiecki
ecd4c32d9a
mnt: replace sys/queue with std::vector
2018-02-10 14:38:01 +01:00
Robert Swiecki
63eb13ecde
nsjail: move openfd from queue to vector
2018-02-09 22:47:00 +01:00
Robert Swiecki
7f72cbd497
all: move to C++
2018-02-09 18:55:42 +01:00
Robert Swiecki
a82abf4dcb
mount: move to C++
2018-02-09 18:26:16 +01:00
Robert Swiecki
15170f9d6c
cgroup: move to C++
2018-02-09 18:13:17 +01:00
Robert Swiecki
27a226ad28
user: move to C++
2018-02-09 18:08:11 +01:00
Robert Swiecki
8e8fcc2815
uts: move to C++
2018-02-09 17:59:51 +01:00
Robert Swiecki
a07f389a50
pid: move to C++
2018-02-09 17:57:19 +01:00
Robert Swiecki
c4e57bf27e
caps: move to C++
2018-02-09 17:49:13 +01:00
Robert Swiecki
ff282fb385
cpu: move to C++
2018-02-09 17:41:16 +01:00
Robert Swiecki
cb6222abdf
net: move to C++
2018-02-09 17:27:28 +01:00
Robert Swiecki
21e1495c24
contain: move to C++
2018-02-09 17:09:58 +01:00
