mirror of
https://github.com/RGBCube/serenity
synced 2025-07-28 11:57:36 +00:00
Kernel: Allow configuring a Jail to not impose PID isolation restriction
This is quite useful for userspace applications that can't cope with the restriction, but it's still useful to impose other non-configurable restrictions by using jails.
This commit is contained in:
parent
cf8875426d
commit
8289759f1d
11 changed files with 62 additions and 23 deletions
|
@ -31,7 +31,9 @@ ErrorOr<int> serenity_main(Main::Arguments arguments)
|
|||
if (existing_jail_index.has_value()) {
|
||||
TRY(Core::System::join_jail(existing_jail_index.value()));
|
||||
} else {
|
||||
u64 new_jail_index = TRY(Core::System::create_jail(new_jail_name.is_null() ? ""sv : new_jail_name));
|
||||
// NOTE: We create a jail with "default" isolation options (as we define them in this program)
|
||||
JailIsolationFlags default_flags = (JailIsolationFlags::PIDIsolation);
|
||||
u64 new_jail_index = TRY(Core::System::create_jail(new_jail_name.is_null() ? ""sv : new_jail_name, default_flags));
|
||||
TRY(Core::System::join_jail(new_jail_index));
|
||||
}
|
||||
TRY(Core::System::exec_command(command, preserve_env));
|
||||
|
|
|
@ -13,15 +13,19 @@ ErrorOr<int> serenity_main(Main::Arguments arguments)
|
|||
{
|
||||
StringView new_jail_name;
|
||||
Core::ArgsParser args_parser;
|
||||
bool pid_isolation = false;
|
||||
args_parser.add_positional_argument(new_jail_name, "New jail name", "jail name");
|
||||
args_parser.add_option(pid_isolation, "Use PID-isolation (as a custom isolation option)", "pid-isolation", 'p');
|
||||
args_parser.parse(arguments);
|
||||
|
||||
TRY(Core::System::pledge("stdio jail"));
|
||||
|
||||
if (!new_jail_name.is_null() && !new_jail_name.is_empty()) {
|
||||
TRY(Core::System::create_jail(new_jail_name));
|
||||
return 0;
|
||||
}
|
||||
if (new_jail_name.is_null() || new_jail_name.is_empty())
|
||||
return Error::from_string_view("Can't create a jail with empty name."sv);
|
||||
|
||||
return Error::from_string_view("Can't create a jail with empty name."sv);
|
||||
JailIsolationFlags flags = JailIsolationFlags::None;
|
||||
if (pid_isolation)
|
||||
flags |= JailIsolationFlags::PIDIsolation;
|
||||
TRY(Core::System::create_jail(new_jail_name, flags));
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue