3 commits

Author	SHA1	Message	Date
Zach Reizner	848b9ff625	io_jail: add bind mount ... This will be used by some device jails to get access to unix sockets after being jailed. TEST=None BUG=None Change-Id: I870bfb155b275769ccb3248b1441e7c0b8f20ad7 Reviewed-on: https://chromium-review.googlesource.com/558447 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>	2017-06-30 22:24:50 -07:00
Dylan Reid	fa8c6802b6	io_jail: Overwrite standard I/O FDs ... The FDs for stdin, stdout, and stderr shouldn't be left empty. Just closing these FDs causes the next open() call from the jailed process to reuse the 0, 1, or 2 FD. This confuses basic infrastructure like println!. Change-Id: I40ea471b4a011f2be5132e1a0ff50656ae2ec14a Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/549659	2017-06-28 00:59:00 -07:00
Dylan Reid	d6c579fcef	io_jail: Add a wrapper around minijail ... The io_jail is used to jail io processes run from crosvm. Under the hood it mostly configures a minijail jail to run in. The minijail restrictions are applied when iojail::enter is called. This closes extra FDs and calls minijail_enter. The minijail_run* functions are left out as we don't have a need to exec foreign programs. libminijail will be used to jail separate processes spawned from the main crosvm process. The ability to close all open file descriptors is added. Minijail only closes FDs after forking and before exec. Change-Id: Ida7f52022c934e9e6edeb7b604cd6e6399860cb9 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/505100 Reviewed-by: Zach Reizner <zachr@chromium.org>	2017-05-25 12:25:27 -07:00