From 5ede85c55fd6c52fb4391a40485c0b6662fc03b1 Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Wed, 30 Jan 2019 22:58:05 -0800 Subject: [PATCH] io_jail: allow mounting minimal set of devices This plumbs in minijail_mount_dev() to allow mounting minimal set of devices, such as full, zero, urandom, etc. in the jail. BUG=b:117989168 TEST=cargo test -p io_jail Change-Id: I072347a5eedab32d1fad6255c4e18e0242b9ac9f Signed-off-by: Dmitry Torokhov Reviewed-on: https://chromium-review.googlesource.com/1447330 Tested-by: kokoro Reviewed-by: Chirantan Ekbote Reviewed-by: Zach Reizner --- io_jail/src/lib.rs | 5 +++++ io_jail/src/libminijail.rs | 1 + 2 files changed, 6 insertions(+) diff --git a/io_jail/src/lib.rs b/io_jail/src/lib.rs index c50916e678..53c6533a56 100644 --- a/io_jail/src/lib.rs +++ b/io_jail/src/lib.rs @@ -442,6 +442,11 @@ impl Minijail { } Ok(()) } + pub fn mount_dev(&mut self) { + unsafe { + libminijail::minijail_mount_dev(self.jail); + } + } pub fn mount_tmp(&mut self) { unsafe { libminijail::minijail_mount_tmp(self.jail); diff --git a/io_jail/src/libminijail.rs b/io_jail/src/libminijail.rs index 8762721ac2..6edacdce3b 100644 --- a/io_jail/src/libminijail.rs +++ b/io_jail/src/libminijail.rs @@ -56,6 +56,7 @@ extern "C" { pub fn minijail_enter_pivot_root(j: *mut minijail, dir: *const c_char) -> c_int; pub fn minijail_fork(j: *mut minijail) -> pid_t; pub fn minijail_get_original_path(j: *mut minijail, chroot_path: *const c_char) -> *mut c_char; + pub fn minijail_mount_dev(j: *mut minijail); pub fn minijail_mount_tmp(j: *mut minijail); pub fn minijail_mount_tmp_size(j: *mut minijail, size: usize); pub fn minijail_mount_with_data(