mirror of
https://github.com/google/nsjail.git
synced 2026-08-30 18:41:30 -07:00
191 lines
3.2 KiB
INI
191 lines
3.2 KiB
INI
# Example config for nsjail
|
|
|
|
name: "chromium-with-net-wayland"
|
|
|
|
description: "This policy allows to run chromium inside a jail. Access to networking is "
|
|
description: "permitted with this setup (via pasta)."
|
|
description: ""
|
|
description: "The only permitted home directory is $HOME/.mozilla and $HOME/Documents."
|
|
description: "The rest of available on the FS files/dires are libs and X-related files/dirs."
|
|
description: ""
|
|
description: "Run as:"
|
|
description: ""
|
|
description: "./nsjail --config configs/chromium-with-net-wayland.cfg"
|
|
description: ""
|
|
description: "You can then go to https://uploadfiles.io/ and try to upload a file in order"
|
|
description: "to see how your local directory (also, all system directories) look like."
|
|
|
|
mode: ONCE
|
|
hostname: "CHROMIUM"
|
|
cwd: "/user"
|
|
|
|
time_limit: 0
|
|
|
|
clone_newnet: true
|
|
user_net { }
|
|
|
|
envar: "HOME=/user"
|
|
envar: "DISPLAY"
|
|
envar: "TMP=/tmp"
|
|
envar: "FONTCONFIG_FILE=/etc/fonts/fonts.conf"
|
|
envar: "FC_CONFIG_FILE=/etc/fonts/fonts.conf"
|
|
envar: "XDG_RUNTIME_DIR=/run/user/1000"
|
|
envar: "WAYLAND_DISPLAY"
|
|
|
|
rlimit_as: 8388608
|
|
rlimit_cpu: 1000
|
|
rlimit_fsize: 4096
|
|
rlimit_nofile: 1024
|
|
|
|
uidmap {
|
|
inside_id: "1000"
|
|
}
|
|
|
|
gidmap {
|
|
inside_id: "1000"
|
|
}
|
|
|
|
mount {
|
|
dst: "/proc"
|
|
fstype: "proc"
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib"
|
|
dst: "/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/usr/lib"
|
|
dst: "/usr/lib"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src: "/lib64"
|
|
dst: "/lib64"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/lib32"
|
|
dst: "/lib32"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/usr/share"
|
|
dst: "/usr/share"
|
|
is_bind: true
|
|
}
|
|
|
|
mount {
|
|
src_content: "<?xml version=\"1.0\"?>\n<!DOCTYPE fontconfig SYSTEM \"fonts.dtd\">\n<fontconfig><dir>/usr/share/fonts</dir><cachedir>/tmp/fontconfig</cachedir></fontconfig>"
|
|
dst: "/etc/fonts/fonts.conf"
|
|
}
|
|
|
|
mount {
|
|
src: "/etc/ssl"
|
|
dst: "/etc/ssl"
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/urandom"
|
|
dst: "/dev/urandom"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src: "/dev/null"
|
|
dst: "/dev/null"
|
|
is_bind: true
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
src_content: "nameserver 8.8.8.8\n"
|
|
dst: "/etc/resolv.conf"
|
|
}
|
|
|
|
mount {
|
|
dst: "/tmp"
|
|
fstype: "tmpfs"
|
|
rw: true
|
|
is_bind: false
|
|
}
|
|
|
|
mount {
|
|
dst: "/dev/shm"
|
|
fstype: "tmpfs"
|
|
rw: true
|
|
is_bind: false
|
|
}
|
|
|
|
mount {
|
|
dst: "/user"
|
|
fstype: "tmpfs"
|
|
rw: true
|
|
}
|
|
|
|
mount {
|
|
prefix_src_env: "HOME"
|
|
src: "/Documents"
|
|
dst: "/user/Documents"
|
|
rw: true
|
|
is_bind: true
|
|
mandatory: false
|
|
}
|
|
|
|
# Uncomment, if you want your config to be loaded
|
|
# mount {
|
|
# prefix_src_env: "HOME"
|
|
# src: "/.config/chromium"
|
|
# dst: "/user/.config/.chromium"
|
|
# is_bind: true
|
|
# rw: true
|
|
# mandatory: false
|
|
#}
|
|
|
|
mount {
|
|
# Change it to your user id
|
|
src: "/run/user/1000/wayland-0"
|
|
dst: "/run/user/1000/wayland-0"
|
|
is_bind: true
|
|
rw: false
|
|
mandatory: true
|
|
}
|
|
|
|
mount {
|
|
# Change it to your user id
|
|
src: "/run/user/1000/pulse/native"
|
|
dst: "/run/user/1000/pulse/native"
|
|
is_bind: true
|
|
rw: false
|
|
mandatory: false
|
|
}
|
|
|
|
seccomp_string: "KILL_PROCESS {"
|
|
seccomp_string: " ptrace,"
|
|
seccomp_string: " process_vm_readv,"
|
|
seccomp_string: " process_vm_writev"
|
|
seccomp_string: "}"
|
|
seccomp_string: "ERRNO(38) {"
|
|
seccomp_string: " io_uring_setup,"
|
|
seccomp_string: " io_uring_enter,"
|
|
seccomp_string: " io_uring_register"
|
|
seccomp_string: "}"
|
|
seccomp_string: "DEFAULT ALLOW"
|
|
|
|
exec_bin {
|
|
path: "/usr/lib/chromium/chromium"
|
|
arg: "--ozone-platform=wayland"
|
|
arg: "--incognito"
|
|
}
|