proto/nsjail/config.proto

syntax = "proto2";

package nsjail;

option go_package = "go.chromium.org/goma/server/proto/nsjail";

enum Mode {
    LISTEN = 0; /* Listening on a TCP port */
    ONCE = 1;   /* Running the command once only */
    RERUN = 2;  /* Re-executing the command (forever) */
    EXECVE = 3; /* Executing command w/o the supervisor */
}
/* Should be self explanatory */
enum LogLevel {
    DEBUG = 0;   /* Equivalent to the '-v' cmd-line option */
    INFO = 1;    /* Default level */
    WARNING = 2; /* Equivalent to the '-q' cmd-line option */
    ERROR = 3;
    FATAL = 4;
}
message IdMap {
    /* Empty string means "current uid/gid" */
    optional string inside_id = 1 [default = ""];
    optional string outside_id = 2 [default = ""];
    /* See 'man user_namespaces' for the meaning of count */
    optional uint32 count = 3 [default = 1];
    /* Does this map use /usr/bin/new[u|g]idmap binary? */
    optional bool use_newidmap = 4 [default = false];
}
message MountPt {
    /* Can be skipped for filesystems like 'proc' */
    optional string src = 1 [default = ""];
    /* Should 'src' path be prefixed with this envvar? */
    optional string prefix_src_env = 2 [default = ""];
    /* If specified, contains buffer that will be written to the dst file */
    optional bytes src_content = 3 [default = ""];
    /* Mount point inside jail */
    required string dst = 4 [default = ""];
    /* Should 'dst' path be prefixed with this envvar? */
    optional string prefix_dst_env = 5 [default = ""];
    /* Can be empty for mount --bind mounts */
    optional string fstype = 6 [default = ""];
    /* E.g. size=5000000 for 'tmpfs' */
    optional string options = 7 [default = ""];
    /* Is it a 'mount --bind src dst' type of mount? */
    optional bool is_bind = 8 [default = false];
    /* Is it a R/W mount? */
    optional bool rw = 9 [default = false];
    /* Is it a directory? If not specified an internal
       heuristics will be used to determine that */
    optional bool is_dir = 10;
    /* Should the sandboxing fail if we cannot mount this resource? */
    optional bool mandatory = 11 [default = true];
    /* Is it a symlink (instead of real mount point)? */
    optional bool is_symlink = 12 [default = false];
    /* Is it a nosuid mount */
    optional bool nosuid = 13 [default = false];
    /* Is it a nodev mount */
    optional bool nodev = 14 [default = false];
    /* Is it a noexec mount */
    optional bool noexec = 15 [default = false];
}
enum RLimit {
    VALUE = 0; /* Use the provided value */
    SOFT = 1;  /* Use the current soft rlimit */
    HARD = 2;  /* Use the current hard rlimit */
    INF = 3;   /* Use RLIM64_INFINITY */
}
message Exe {
    /* Will be used both as execv's path and as argv[0] */
    required string path = 1;
    /* This will be argv[1] and so on.. */
    repeated string arg = 2;
    /* Override argv[0] */
    optional string arg0 = 3;
    /* Should execveat() be used to execute a file-descriptor instead? */
    optional bool exec_fd = 4 [default = false];
}
message NsJailConfig {
    /* Optional name and description for this config */
    optional string name = 1 [default = ""];
    repeated string description = 2;

    /* Execution mode: see 'msg Mode' description for more */
    optional Mode mode = 3 [default = ONCE];
    /* Equivalent to a bind mount with dst='/'. DEPRECATED: Use bind mounts. */
    optional string chroot_dir = 4 [deprecated = true];
    /* Applies both to the chroot_dir and to /proc mounts. DEPRECATED: Use bind mounts */
    optional bool is_root_rw = 5 [default = false, deprecated = true];
    /* Hostname inside jail */
    optional string hostname = 8 [default = "NSJAIL"];
    /* Initial current working directory for the binary */
    optional string cwd = 9 [default = "/"];

    /* TCP port to listen to. Valid with mode=LISTEN only */
    optional uint32 port = 10 [default = 0];
    /* Host to bind to for mode=LISTEN. Must be in IPv6 format */
    optional string bindhost = 11 [default = "::"];
    /* For mode=LISTEN, maximum number of connections from a single IP */
    optional uint32 max_conns_per_ip = 12 [default = 0];

    /* Wall-time time limit for commands */
    optional uint32 time_limit = 13 [default = 600];
    /* Should nsjail go into background? */
    optional bool daemon = 14 [default = false];
    /* Maximum number of CPUs to use: 0 - no limit */
    optional uint32 max_cpus = 15 [default = 0];

    /* FD to log to. */
    optional int32 log_fd = 16;
    /* File to save lofs to */
    optional string log_file = 17;
    /* Minimum log level displayed.
       See 'msg LogLevel' description for more */
    optional LogLevel log_level = 18;

    /* Should the current environment variables be kept
       when executing the binary */
    optional bool keep_env = 19 [default = false];
    /* EnvVars to be set before executing binaries. If the envvar doesn't contain '='
       (e.g. just the 'DISPLAY' string), the current envvar value will be used */
    repeated string envar = 20;

    /* Should capabilities be preserved or dropped */
    optional bool keep_caps = 21 [default = false];
    /* Which capabilities should be preserved if keep_caps == false.
       Format: "CAP_SYS_PTRACE" */
    repeated string cap = 22;
    /* Should nsjail close FD=0,1,2 before executing the process */
    optional bool silent = 23 [default = false];
    /* Should the child process have control over terminal?
       Can be useful to allow /bin/sh to provide
       job control / signals. Dangerous, can be used to put
       characters into the controlling terminal back */
    optional bool skip_setsid = 24 [default = false];
    /* Redirect sdterr of the process to /dev/null instead of the socket or original TTY */
    optional bool stderr_to_null = 25 [default = false];
    /* Which FDs should be passed to the newly executed process
       By default only FD=0,1,2 are passed */
    repeated int32 pass_fd = 26;
    /* Setting it to true will allow to have set-uid binaries
       inside the jail */
    optional bool disable_no_new_privs = 27 [default = false];

    /* Various rlimits, the rlimit_as/rlimit_core/... are used only if
       rlimit_as_type/rlimit_core_type/... are set to RLimit::VALUE */
    optional uint64 rlimit_as = 28 [default = 512]; /* In MiB */
    optional RLimit rlimit_as_type = 29 [default = VALUE];
    optional uint64 rlimit_core = 30 [default = 0]; /* In MiB */
    optional RLimit rlimit_core_type = 31 [default = VALUE];
    optional uint64 rlimit_cpu = 32 [default = 600]; /* In seconds */
    optional RLimit rlimit_cpu_type = 33 [default = VALUE];
    optional uint64 rlimit_fsize = 34 [default = 1]; /* In MiB */
    optional RLimit rlimit_fsize_type = 35 [default = VALUE];
    optional uint64 rlimit_nofile = 36 [default = 32];
    optional RLimit rlimit_nofile_type = 37 [default = VALUE];
    /* RLIMIT_NPROC is system-wide - tricky to use; use the soft limit value by
     * default here */
    optional uint64 rlimit_nproc = 38 [default = 1024];
    optional RLimit rlimit_nproc_type = 39 [default = SOFT];
    /* In MiB, use the soft limit value by default */
    optional uint64 rlimit_stack = 40 [default = 1048576];
    optional RLimit rlimit_stack_type = 41 [default = SOFT];

    /* See 'man personality' for more */
    optional bool persona_addr_compat_layout = 42 [default = false];
    optional bool persona_mmap_page_zero = 43 [default = false];
    optional bool persona_read_implies_exec = 44 [default = false];
    optional bool persona_addr_limit_3gb = 45 [default = false];
    optional bool persona_addr_no_randomize = 46 [default = false];

    /* Which name-spaces should be used? */
    optional bool clone_newnet = 47 [default = true];
    optional bool clone_newuser = 48 [default = true];
    optional bool clone_newns = 49 [default = true];
    optional bool clone_newpid = 50 [default = true];
    optional bool clone_newipc = 51 [default = true];
    optional bool clone_newuts = 52 [default = true];
    /* Disable for kernel versions < 4.6 as it's not supported there */
    optional bool clone_newcgroup = 53 [default = true];

    /* Mappings for UIDs and GIDs. See the description for 'msg IdMap'
       for more */
    repeated IdMap uidmap = 54;
    repeated IdMap gidmap = 55;

    /* Should /proc be mounted (R/O)? This can also be added in the 'mount'
       section below */
    optional bool mount_proc = 56 [default = false];
    /* Mount points inside the jail. See the description for 'msg MountPt'
       for more */
    repeated MountPt mount = 57;

    /* Kafel seccomp-bpf policy file or a string:
       Homepage of the project: https://github.com/google/kafel */
    optional string seccomp_policy_file = 58;
    repeated string seccomp_string = 59;
    /* Setting it to true makes audit write seccomp logs to dmesg */
    optional bool seccomp_log = 60 [default = false];

    /* If > 0, maximum cumulative size of RAM used inside any jail */
    optional uint64 cgroup_mem_max = 61 [default = 0]; /* In MiB */
    /* Mount point for cgroups-memory in your system */
    optional string cgroup_mem_mount = 62 [default = "/sys/fs/cgroup/memory"];
    /* Writeable directory (for the nsjail user) under cgroup_mem_mount */
    optional string cgroup_mem_parent = 63 [default = "NSJAIL"];

    /* If > 0, maximum number of PIDs (threads/processes) inside jail */
    optional uint64 cgroup_pids_max = 64 [default = 0];
    /* Mount point for cgroups-pids in your system */
    optional string cgroup_pids_mount = 65 [default = "/sys/fs/cgroup/pids"];
    /* Writeable directory (for the nsjail user) under cgroup_pids_mount */
    optional string cgroup_pids_parent = 66 [default = "NSJAIL"];

    /* If > 0, Class identifier of network packets inside jail */
    optional uint32 cgroup_net_cls_classid = 67 [default = 0];
    /* Mount point for cgroups-net-cls in your system */
    optional string cgroup_net_cls_mount = 68 [default = "/sys/fs/cgroup/net_cls"];
    /* Writeable directory (for the nsjail user) under cgroup_net_mount */
    optional string cgroup_net_cls_parent = 69 [default = "NSJAIL"];

    /* If > 0 number of milliseconds of CPU that jail processes can use per each second */
    optional uint32 cgroup_cpu_ms_per_sec = 70 [default = 0];
    /* Mount point for cgroups-cpu in your system */
    optional string cgroup_cpu_mount = 71 [default = "/sys/fs/cgroup/cpu"];
    /* Writeable directory (for the nsjail user) under cgroup_cpu_mount */
    optional string cgroup_cpu_parent = 72 [default = "NSJAIL"];

    /* Should the 'lo' interface be brought up (active) inside this jail? */
    optional bool iface_no_lo = 73 [default = false];

    /* Put this interface inside the jail */
    repeated string iface_own = 74;

    /* Parameters for the cloned MACVLAN interface inside jail */
    optional string macvlan_iface = 75; /* Interface to be cloned, eg 'eth0' */
    optional string macvlan_vs_ip = 76 [default = "192.168.0.2"];
    optional string macvlan_vs_nm = 77 [default = "255.255.255.0"];
    optional string macvlan_vs_gw = 78 [default = "192.168.0.1"];
    optional string macvlan_vs_ma = 79 [default = ""];

    /* Binary path (with arguments) to be executed. If not specified here, it
       can be specified with cmd-line as "-- /path/to/command arg1 arg2" */
    optional Exe exec_bin = 80;
}