1*bb4ee6a4SAndroid Build Coastguard Worker# Minijail 2*bb4ee6a4SAndroid Build Coastguard Worker 3*bb4ee6a4SAndroid Build Coastguard WorkerOn Linux hosts, crosvm uses [minijail](https://google.github.io/minijail/) to sandbox the child 4*bb4ee6a4SAndroid Build Coastguard Workerdevices. The minijail C library is utilized via a 5*bb4ee6a4SAndroid Build Coastguard Worker[Rust wrapper](https://chromium.googlesource.com/chromiumos/platform/minijail/+/refs/heads/main/rust/minijail/src/lib.rs) 6*bb4ee6a4SAndroid Build Coastguard Workerso as not to repeat the intricate sequence of syscalls used to make a secure isolated child process. 7*bb4ee6a4SAndroid Build Coastguard Worker 8*bb4ee6a4SAndroid Build Coastguard WorkerThe exact configuration of the sandbox varies by device, but they are mostly alike. See 9*bb4ee6a4SAndroid Build Coastguard Worker[`create_base_minijail`] from `jail/src/helpers.rs`. The set of security constraints explicitly used 10*bb4ee6a4SAndroid Build Coastguard Workerin crosvm are: 11*bb4ee6a4SAndroid Build Coastguard Worker 12*bb4ee6a4SAndroid Build Coastguard Worker- PID Namespace 13*bb4ee6a4SAndroid Build Coastguard Worker - Runs as init 14*bb4ee6a4SAndroid Build Coastguard Worker- [Deny setgroups](https://lwn.net/Articles/626665/) 15*bb4ee6a4SAndroid Build Coastguard Worker- Optional limit the capabilities mask to `0` 16*bb4ee6a4SAndroid Build Coastguard Worker- User namespace 17*bb4ee6a4SAndroid Build Coastguard Worker - Optional uid/gid mapping 18*bb4ee6a4SAndroid Build Coastguard Worker- Mount namespace 19*bb4ee6a4SAndroid Build Coastguard Worker - Optional pivot into a new root 20*bb4ee6a4SAndroid Build Coastguard Worker- Network namespace 21*bb4ee6a4SAndroid Build Coastguard Worker- [PR_SET_NO_NEW_PRIVS](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt) 22*bb4ee6a4SAndroid Build Coastguard Worker- [seccomp](seccomp.html) with optional log failure mode 23*bb4ee6a4SAndroid Build Coastguard Worker- Limit to number of file descriptors 24*bb4ee6a4SAndroid Build Coastguard Worker 25*bb4ee6a4SAndroid Build Coastguard Worker[`create_base_minijail`]: https://crosvm.dev/doc/jail/fn.create_base_minijail.html 26