RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-28 15:17:46 +00:00
Code Issues Activity Actions

Kernel: Allow configuring a Jail to not impose PID isolation restriction

Browse source 
This is quite useful for userspace applications that can't cope with the
restriction, but it's still useful to impose other non-configurable
restrictions by using jails.
This commit is contained in:
Liav A 2023-01-12 22:47:09 +02:00 • committed by Jelle Raaijmakers
parent cf8875426d
commit 8289759f1d
11 changed files with 62 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Utilities/jail-attach.cpp
View file

@ -31,7 +31,9 @@ ErrorOr<int> serenity_main(Main::Arguments arguments)
if (existing_jail_index.has_value()) {
TRY(Core::System::join_jail(existing_jail_index.value()));
} else {
u64 new_jail_index = TRY(Core::System::create_jail(new_jail_name.is_null() ? ""sv : new_jail_name));
// NOTE: We create a jail with "default" isolation options (as we define them in this program)
JailIsolationFlags default_flags = (JailIsolationFlags::PIDIsolation);
u64 new_jail_index = TRY(Core::System::create_jail(new_jail_name.is_null() ? ""sv : new_jail_name, default_flags));
TRY(Core::System::join_jail(new_jail_index));
}
TRY(Core::System::exec_command(command, preserve_env));

14
Userland/Utilities/jail-create.cpp
View file

@ -13,15 +13,19 @@ ErrorOr<int> serenity_main(Main::Arguments arguments)
{
StringView new_jail_name;
Core::ArgsParser args_parser;
bool pid_isolation = false;
args_parser.add_positional_argument(new_jail_name, "New jail name", "jail name");
args_parser.add_option(pid_isolation, "Use PID-isolation (as a custom isolation option)", "pid-isolation", 'p');
args_parser.parse(arguments);
TRY(Core::System::pledge("stdio jail"));
if (!new_jail_name.is_null() && !new_jail_name.is_empty()) {
TRY(Core::System::create_jail(new_jail_name));
return 0;
}
if (new_jail_name.is_null() || new_jail_name.is_empty())
return Error::from_string_view("Can't create a jail with empty name."sv);
return Error::from_string_view("Can't create a jail with empty name."sv);
JailIsolationFlags flags = JailIsolationFlags::None;
if (pid_isolation)
flags |= JailIsolationFlags::PIDIsolation;
TRY(Core::System::create_jail(new_jail_name, flags));
return 0;
}