minijail0: add chroot support.
Support a -C commandline option to chroot(), and a -b commandline option to
bind-mount paths into the chroot from outside.
BUG=chromium-os:21165
TESTED_ON=kaen
TEST=None yet
Change-Id: Ia6a7a4498968a4bc6a12f8274fdb8c4be9d23ca4
Signed-off-by: Elly Jones <ellyjones@chromium.org>
Reviewed-on: http://gerrit.chromium.org/gerrit/8661
Reviewed-by: Kees Cook <keescook@chromium.org>
diff --git a/minijail0.1 b/minijail0.1
index 6aedb81..72f569c 100644
--- a/minijail0.1
+++ b/minijail0.1
@@ -8,8 +8,15 @@
.PP
Runs PROGRAM inside a sandbox.
.TP
+\fB-b <src>,<dest>[,<writeable>]
+Bind-mount <src> into the chroot directory at <dest>, optionally writeable.
+.TP
\fB-c <caps>\fR
Restrict capabilities to \fIcaps\fR. When used in conjunction with \fB-u\fR and
+.TP
+\fB-C <dir>\fR
+Change root (using chroot(2)) to <dir>.
+.TP
\fB-g\fR, this allows a program to have access to only certain parts of root's
default privileges while running as another user and group ID altogether. Note
that these capabilities are not inherited by subprocesses of the process given