xref: /aosp_15_r20/external/crosvm/docs/book/src/appendix/minijail.md (revision bb4ee6a4ae7042d18b07a98463b9c8b875e44b39)
1*bb4ee6a4SAndroid Build Coastguard Worker# Minijail
2*bb4ee6a4SAndroid Build Coastguard Worker
3*bb4ee6a4SAndroid Build Coastguard WorkerOn Linux hosts, crosvm uses [minijail](https://google.github.io/minijail/) to sandbox the child
4*bb4ee6a4SAndroid Build Coastguard Workerdevices. The minijail C library is utilized via a
5*bb4ee6a4SAndroid Build Coastguard Worker[Rust wrapper](https://chromium.googlesource.com/chromiumos/platform/minijail/+/refs/heads/main/rust/minijail/src/lib.rs)
6*bb4ee6a4SAndroid Build Coastguard Workerso as not to repeat the intricate sequence of syscalls used to make a secure isolated child process.
7*bb4ee6a4SAndroid Build Coastguard Worker
8*bb4ee6a4SAndroid Build Coastguard WorkerThe exact configuration of the sandbox varies by device, but they are mostly alike. See
9*bb4ee6a4SAndroid Build Coastguard Worker[`create_base_minijail`] from `jail/src/helpers.rs`. The set of security constraints explicitly used
10*bb4ee6a4SAndroid Build Coastguard Workerin crosvm are:
11*bb4ee6a4SAndroid Build Coastguard Worker
12*bb4ee6a4SAndroid Build Coastguard Worker- PID Namespace
13*bb4ee6a4SAndroid Build Coastguard Worker  - Runs as init
14*bb4ee6a4SAndroid Build Coastguard Worker- [Deny setgroups](https://lwn.net/Articles/626665/)
15*bb4ee6a4SAndroid Build Coastguard Worker- Optional limit the capabilities mask to `0`
16*bb4ee6a4SAndroid Build Coastguard Worker- User namespace
17*bb4ee6a4SAndroid Build Coastguard Worker  - Optional uid/gid mapping
18*bb4ee6a4SAndroid Build Coastguard Worker- Mount namespace
19*bb4ee6a4SAndroid Build Coastguard Worker  - Optional pivot into a new root
20*bb4ee6a4SAndroid Build Coastguard Worker- Network namespace
21*bb4ee6a4SAndroid Build Coastguard Worker- [PR_SET_NO_NEW_PRIVS](https://www.kernel.org/doc/Documentation/prctl/no_new_privs.txt)
22*bb4ee6a4SAndroid Build Coastguard Worker- [seccomp](seccomp.html) with optional log failure mode
23*bb4ee6a4SAndroid Build Coastguard Worker- Limit to number of file descriptors
24*bb4ee6a4SAndroid Build Coastguard Worker
25*bb4ee6a4SAndroid Build Coastguard Worker[`create_base_minijail`]: https://crosvm.dev/doc/jail/fn.create_base_minijail.html
26