commit | 255a8e2879edb49f395f819e2f8590b40a8284ed | [log] [tgz] |
---|---|---|
author | Jorge Lucangeli Obes <jorgelo@google.com> | Thu Apr 11 14:34:41 2019 -0400 |
committer | Jorge Lucangeli Obes <jorgelo@google.com> | Fri Apr 12 15:37:22 2019 -0400 |
tree | 8ff3055e46497cb15887286b112ef4ac49d411b8 | |
parent | eb42bb786a78ae7c54bb891d80cde55020fc32a7 [diff] |
Make pidfile writing "more" atomic. We were seeing races in tests where the pidfile was being opened before the actual writing had taken place. Fix this by using the classic writing to a temp file and renaming. Bug: chromium:949357 Test: Existing unit tests. Change-Id: Ib218f75731eaa22f348fd8eca6549ef638c255f7
The Minijail homepage and main repo is https://android.googlesource.com/platform/external/minijail/.
There might be other copies floating around, but this is the official one!
Minijail is a sandboxing and containment tool used in Chrome OS and Android. It provides an executable that can be used to launch and sandbox other programs, and a library that can be used by code to sandbox itself.
You're one git clone
away from happiness.
$ git clone https://android.googlesource.com/platform/external/minijail $ cd minijail
Releases are tagged as linux-vXX
: https://android.googlesource.com/platform/external/minijail/+refs
See the HACKING.md document for more details.
See the RELEASE.md document for more details.
We've got a couple of contact points.
The following talk serves as a good introduction to Minijail and how it can be used.
The Chromium OS project has a comprehensive sandboxing document that is largely based on Minijail.
After you play with the simple examples below, you should check that out.
# id uid=0(root) gid=0(root) groups=0(root),128(pkcs11) # minijail0 -u jorgelo -g 5000 /usr/bin/id uid=72178(jorgelo) gid=5000(eng) groups=5000(eng)
# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status Name: cat ... CapInh: 0000000000003000 CapPrm: 0000000000003000 CapEff: 0000000000003000 CapBnd: 0000000000003000