• Home
  • History
  • Annotate
Name Date Size #Lines LOC

..--

.github/23-Nov-2023-4731

examples/23-Nov-2023-9459

linux-x86/23-Nov-2023-6,6446,637

rust/23-Nov-2023-1,6531,366

test/23-Nov-2023-177126

tools/23-Nov-2023-4,4123,434

.clang-formatD23-Nov-2023181 87

.gitignoreD23-Nov-2023701 5239

Android.bpD23-Nov-202314.2 KiB563506

CPPLINT.cfgD23-Nov-202317 21

CleanSpec.mkD23-Nov-20232.2 KiB521

HACKING.mdD23-Nov-20232.9 KiB8762

LICENSED23-Nov-20231.5 KiB2928

METADATAD23-Nov-202339 43

MODULE_LICENSE_BSDD23-Nov-20230

MakefileD23-Nov-20237.8 KiB249153

NOTICED23-Nov-20231.5 KiB2827

OWNERSD23-Nov-202388 65

PRESUBMIT.cfgD23-Nov-2023195 96

PREUPLOAD.cfgD23-Nov-2023133 64

README.mdD23-Nov-20233.8 KiB11780

RELEASE.mdD23-Nov-2023530 2517

TEST_MAPPINGD23-Nov-2023245 1716

arch.hD23-Nov-20232.4 KiB8768

bpf.cD23-Nov-202310.2 KiB398307

bpf.hD23-Nov-20236.4 KiB227156

common.mkD23-Nov-202332.3 KiB953561

dump_constants.ccD23-Nov-20231.5 KiB5138

elfparse.cD23-Nov-20234.7 KiB11988

elfparse.hD23-Nov-20234 KiB10070

gen_constants-inl.hD23-Nov-20232.3 KiB7654

gen_constants.cD23-Nov-202331 21

gen_constants.shD23-Nov-20231.7 KiB6233

gen_syscalls-inl.hD23-Nov-20231.7 KiB7655

gen_syscalls.cD23-Nov-202324 21

gen_syscalls.shD23-Nov-20231.6 KiB6132

get_googletest.shD23-Nov-2023209 73

libconstants.hD23-Nov-2023401 168

libminijail-private.hD23-Nov-20232.6 KiB9524

libminijail.cD23-Nov-202387.3 KiB3,4772,493

libminijail.hD23-Nov-202319 KiB511137

libminijail.pc.inD23-Nov-2023157 97

libminijail_unittest.ccD23-Nov-202335.2 KiB1,253937

libminijailpreload.cD23-Nov-20234.8 KiB14976

libsyscalls.hD23-Nov-2023448 1810

minijail0.1D23-Nov-202316.4 KiB386357

minijail0.5D23-Nov-20235.9 KiB167126

minijail0.cD23-Nov-20232 KiB8250

minijail0.shD23-Nov-2023332 102

minijail0_cli.cD23-Nov-202330.8 KiB1,108903

minijail0_cli.hD23-Nov-2023630 2814

minijail0_cli_unittest.ccD23-Nov-202314.8 KiB529309

navbar.mdD23-Nov-2023348 129

parse_seccomp_policy.ccD23-Nov-20232.8 KiB11186

platform2_preinstall.shD23-Nov-2023323 167

scoped_minijail.hD23-Nov-2023639 3318

setup.pyD23-Nov-20231.8 KiB5231

signal_handler.cD23-Nov-20231.6 KiB8355

signal_handler.hD23-Nov-2023346 154

syscall_filter.cD23-Nov-202324.8 KiB971677

syscall_filter.hD23-Nov-20231.9 KiB8762

syscall_filter_unittest.ccD23-Nov-202358.9 KiB2,0641,471

syscall_filter_unittest_macros.hD23-Nov-20233.6 KiB126101

syscall_wrapper.cD23-Nov-2023875 3521

syscall_wrapper.hD23-Nov-2023991 4528

system.cD23-Nov-202314 KiB546342

system.hD23-Nov-20231.6 KiB6943

system_unittest.ccD23-Nov-202310.5 KiB334220

testrunner.ccD23-Nov-2023704 3317

util.cD23-Nov-202312.9 KiB559403

util.hD23-Nov-20237.6 KiB25092

util_unittest.ccD23-Nov-202310.3 KiB361275

README.md

1# Minijail
2
3The Minijail homepage is
4https://google.github.io/minijail/.
5
6The main source repo is
7https://android.googlesource.com/platform/external/minijail/.
8
9There might be other copies floating around, but this is the official one!
10
11[TOC]
12
13## What is it?
14
15Minijail is a sandboxing and containment tool used in Chrome OS and Android.
16It provides an executable that can be used to launch and sandbox other programs,
17and a library that can be used by code to sandbox itself.
18
19## Getting the code
20
21You're one `git clone` away from happiness.
22
23```
24$ git clone https://android.googlesource.com/platform/external/minijail
25$ cd minijail
26```
27
28Releases are tagged as `linux-vXX`:
29https://android.googlesource.com/platform/external/minijail/+refs
30
31## Building
32
33See the [HACKING.md](./HACKING.md) document for more details.
34
35## Release process
36
37See the [RELEASE.md](./RELEASE.md) document for more details.
38
39## Additional tools
40
41See the [tools/README.md](./tools/README.md) document for more details.
42
43## Contact
44
45We've got a couple of contact points.
46
47* [minijail@chromium.org]: Public user & developer mailing list.
48* [minijail-users@google.com]: Internal Google user mailing list.
49* [minijail-dev@google.com]: Internal Google developer mailing list.
50* [crbug.com/list]: Existing bug reports & feature requests.
51* [crbug.com/new]: File new bug reports & feature requests.
52* [AOSP Gerrit]: Code reviews.
53
54[minijail@chromium.org]: https://groups.google.com/a/chromium.org/forum/#!forum/minijail
55[minijail-users@google.com]: https://groups.google.com/a/google.com/forum/#!forum/minijail-users
56[minijail-dev@google.com]: https://groups.google.com/a/google.com/forum/#!forum/minijail-dev
57[crbug.com/list]: https://crbug.com/?q=component:OS>Systems>Minijail
58[crbug.com/new]: https://bugs.chromium.org/p/chromium/issues/entry?components=OS>Systems>Minijail
59[AOSP Gerrit]: https://android-review.googlesource.com/q/project:platform/external/minijail
60
61## Talks and presentations
62
63The following talk serves as a good introduction to Minijail and how it can be used.
64
65[Video](https://drive.google.com/file/d/0BwPS_JpKyELWZTFBcTVsa1hhYjA/preview),
66[slides](https://docs.google.com/presentation/d/e/2PACX-1vRBqpin5xR9sng6lIBPjG0XQtu-uWWgr0ds-M3zW13XpDO-bTcMERLwoHUEB9078p1yqr9L-su9n5dk/pub).
67
68## Example usage
69
70The Chromium OS project has a comprehensive
71[sandboxing](https://chromium.googlesource.com/chromiumos/docs/+/master/sandboxing.md)
72document that is largely based on Minijail.
73
74After you play with the simple examples below, you should check that out.
75
76### Change root to any user
77
78```
79# id
80uid=0(root) gid=0(root) groups=0(root),128(pkcs11)
81# minijail0 -u jorgelo -g 5000 /usr/bin/id
82uid=72178(jorgelo) gid=5000(eng) groups=5000(eng)
83```
84
85### Drop root while keeping some capabilities
86
87```
88# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status
89Name: cat
90...
91CapInh: 0000000000003000
92CapPrm: 0000000000003000
93CapEff: 0000000000003000
94CapBnd: 0000000000003000
95```
96
97## Historical notes
98
99Q. "Why is it called minijail0?"
100
101A. It is minijail0 because it was a rewrite of an earlier program named
102minijail, which was considerably less mini, and in particular had a dependency
103on libchrome (the Chrome OS packaged version of Chromium's //base).  We needed a
104new name to not collide with the deprecated one.
105
106We didn't want to call it minijail2 or something that would make people
107start using it before we were ready, and it was also concretely _less_ since it
108dropped libbase, etc.  Technically, we needed to be able to fork/preload with
109minimal extra syscall noise which was too hard with libbase at the time (onexit
110handlers, etc that called syscalls we didn't want to allow).  Also, Elly made a
111strong case that C would be the right choice for this for linking and ease of
112controlled surprise system call use.
113
114https://crrev.com/c/4585/ added the original implementation.
115
116Source: Conversations with original authors, ellyjones@ and wad@.
117