Minijail

https://google.github.io/minijail/
Admin
Minijail is a sandboxing and containment tool used in ChromeOS and Android that provides an...
Tokens:1,911
Snippets:28
Trust Score:9.7
Update:5 months ago
Show doc for...
Tokens:
Raw
### Clone Minijail Repository

Source: https://google.github.io/minijail

Clone the Minijail repository to get the latest development code. Navigate into the cloned directory to proceed with building or usage.

```bash
git clone https://chromium.googlesource.com/chromiumos/platform/minijail
cd minijail
```

--------------------------------

### Drop Root Privileges While Retaining Capabilities

Source: https://google.github.io/minijail

Execute a command using minijail0 to drop root privileges but retain specific capabilities. This example shows how to use the '-c' flag to specify capabilities for the executed command, such as 'cat /proc/self/status'.

```bash
# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status
Name: cat
...
CapInh: 0000000000003000
CapPrm: 0000000000003000
CapEff: 0000000000003000
CapBnd: 0000000000003000
```

--------------------------------

### Change Root to a Specific User with Minijail

Source: https://google.github.io/minijail

Use minijail0 to change the root directory to a specified user and group, then execute a command. This example demonstrates changing the effective user and group for the 'id' command.

```bash
# id
uid=0(root) gid=0(root) groups=0(root),128(pkcs11)
# minijail0 -u jorgelo -g 5000 /usr/bin/id
uid=72178(jorgelo) gid=5000(eng) groups=5000(eng)
```

--------------------------------

### Seccomp Filter Policy for Bitwise AND Operation

Source: https://google.github.io/minijail/minijail0.5

Example of using the bitwise AND operator '&' in a seccomp filter policy to check for specific flags, such as O_RDONLY for the 'open' system call.

```policy
open: arg1 & O_RDONLY
```

--------------------------------

### Minijail Configuration File Syntax

Source: https://google.github.io/minijail/minijail0.5

A configuration file can specify command line options and other settings for minijail. It supports key-value pairs, options without arguments, comments, and line continuation with '\'. The first line must be '% minijail-config-file v0'.

```minijail-config
% minijail-config-file v0
<option>=<argument>
<no-argument-option>
<empty line>
# any single line comment
```

--------------------------------

### Switch User, Group, and Drop Capabilities

Source: https://google.github.io/minijail/minijail0.5

Safely switch from root to a non-privileged user and group, dropping all capabilities while inheriting supplementary groups.

```bash
# minijail0 -u nobody -g nobody -c 0 -G /usr/bin/whoami
nobody
```

--------------------------------

### Run with Seccomp Filter Policy

Source: https://google.github.io/minijail/minijail0.5

Execute a command with a seccomp filter policy applied, reducing privileges. Ensure the policy file path is correct for your architecture.

```bash
# minijail0 -S /usr/share/minijail0/$(uname -m)/cat.policy -- \
            /bin/cat /proc/self/seccomp_filter
```

--------------------------------

### Run in PID/VFS Namespace with Private /proc

Source: https://google.github.io/minijail/minijail0.5

Execute a process in a PID and VFS namespace, with a private view of /proc, without superuser capabilities.

```bash
# minijail0 -p -v -r -c 0 /bin/ps
  PID TTY           TIME CMD
    1 pts/0     00:00:00 minijail0
    2 pts/0     00:00:00 ps
```

--------------------------------

### Seccomp Filter Policy with Includes

Source: https://google.github.io/minijail/minijail0.5

Demonstrates how to include other policy files within a seccomp filter policy. Inclusion is limited to a single level.

```policy
@include /absolute/path/to/file.policy
@include ./path/relative/to/CWD/file.policy
```

--------------------------------

### Specify Return Error for Blocked Syscalls

Source: https://google.github.io/minijail/minijail0.5

Use the 'return {NUM}' syntax to force a specific errno to be returned instead of killing the process when a syscall is blocked. This is useful for controlling process behavior on blocked syscalls.

```minijail-policy
read: return EBADF
```

```minijail-policy
read: arg0 == 0; return EBADF
```

--------------------------------

### Basic Seccomp Filter Policy

Source: https://google.github.io/minijail/minijail0.5

A simple seccomp filter policy allowing read, write, sig_return, and exit system calls. The '1' acts as a wildcard, permitting any use of the specified syscall.

```policy
read: 1
write: 1
sig_return: 1
exit: 1
```

--------------------------------

### Advanced Seccomp Filter Policy for File Operations

Source: https://google.github.io/minijail/minijail0.5

An advanced seccomp filter policy allowing specific modes for 'open' and 'mmap2' system calls, along with 'munmap' and 'close'. This policy requires kernel support for CONFIG_FTRACE_SYSCALLS.

```policy
# open with O_LARGEFILE|O_RDONLY|O_NONBLOCK or some combination.
open: arg1 == 32768 || arg1 == 0 || arg1 == 34816 || arg1 == 2048
mmap2: arg2 == 0x0
munmap: 1
close: 1
```

--------------------------------

### Seccomp Filter Policy for mmap/mprotect Restrictions

Source: https://google.github.io/minijail/minijail0.5

Restricts 'mmap' and 'mprotect' system calls to only allow write^exec mappings using the 'in' operator and bitwise complement.

```policy
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
```

--------------------------------

### Seccomp Filter Policy with 'in' Operator for Flag Combinations

Source: https://google.github.io/minijail/minijail0.5

Utilizes the 'in' operator in a seccomp filter policy to allow specific combinations of flags for the 'mmap' system call, such as MAP_PRIVATE and MAP_ANONYMOUS.

```policy
mmap: arg3 in MAP_PRIVATE|MAP_ANONYMOUS
```
Tokens:
Raw