mirror of
https://github.com/google/nsjail.git
synced 2026-08-30 18:41:30 -07:00
273a691dd5
Major changes: - Co-developed with gemini-cli (reviewed by a human) - Per-child epoll-based monitor thread with thread_local context - Replaced fixed-size arrays with STL containers (unordered_map, vector) - Zero-copy splice proxy for listen mode (sockproxy) - Seccomp unotify integrated into epoll loop (no dedicated thread) - nstun: SOCKS5/HTTP CONNECT proxy, MemPool allocator, IPv6 support - close_range() for FD cleanup - Test coverage for nstun standalone/listen modes
107 lines
2.2 KiB
C++
107 lines
2.2 KiB
C++
/*
|
|
|
|
nsjail
|
|
-----------------------------------------
|
|
|
|
Copyright 2014 Google Inc. All Rights Reserved.
|
|
Copyright 2016 Sergiusz Bazanski. All Rights Reserved.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
*/
|
|
|
|
#ifndef NS_NSJAIL_H
|
|
#define NS_NSJAIL_H
|
|
|
|
#include <linux/filter.h>
|
|
#include <netinet/ip6.h>
|
|
#include <signal.h>
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <time.h>
|
|
#include <unistd.h>
|
|
|
|
#include <map>
|
|
#include <string>
|
|
#include <thread>
|
|
#include <vector>
|
|
|
|
#include "config.pb.h"
|
|
|
|
static const int nssigs[] = {
|
|
SIGINT,
|
|
SIGQUIT,
|
|
SIGUSR1,
|
|
SIGALRM,
|
|
SIGCHLD,
|
|
SIGTERM,
|
|
SIGTTIN,
|
|
SIGTTOU,
|
|
SIGPIPE,
|
|
};
|
|
|
|
struct pids_t {
|
|
pid_t pid;
|
|
time_t start;
|
|
int pidfd;
|
|
std::string remote_txt;
|
|
struct sockaddr_in6 remote_addr;
|
|
|
|
pid_t pasta_pid;
|
|
std::thread thread;
|
|
};
|
|
|
|
struct idmap_t {
|
|
uid_t inside_id;
|
|
uid_t outside_id;
|
|
size_t count;
|
|
bool is_newidmap;
|
|
};
|
|
|
|
struct nsj_t {
|
|
nsjail::NsJailConfig njc;
|
|
|
|
int exec_fd;
|
|
std::vector<std::string> argv;
|
|
uid_t orig_uid;
|
|
uid_t orig_euid;
|
|
/*
|
|
* Map of active child processes.
|
|
* Thread-safety: Mutated exclusively by the main thread.
|
|
* Monitor threads receive required context by-value at startup and do not access this map.
|
|
* See "The Data Isolation Law" in goal.md.
|
|
*/
|
|
std::map<pid_t, pids_t> pids;
|
|
std::vector<idmap_t> uids;
|
|
std::vector<idmap_t> gids;
|
|
std::vector<int> openfds;
|
|
|
|
int exit_status;
|
|
std::string chroot;
|
|
std::string proc_path;
|
|
bool is_root_rw;
|
|
bool mnt_newapi;
|
|
bool is_proc_rw;
|
|
struct sock_fprog seccomp_fprog;
|
|
struct sock_fprog seccomp_unotify_fprog;
|
|
};
|
|
|
|
namespace nsjail {
|
|
int getSigFatal();
|
|
bool shouldShowProc();
|
|
void clearShowProc();
|
|
} // namespace nsjail
|
|
|
|
#endif /* NS_NSJAIL_H */
|