minijail: Add option to enter a new IPC namespace
Export this feature through the '-l' option to minijail0.
TEST=run minijail0 with the -l option, check that the executed program
is in a different ipc namesspace with /proc/self/ns/ipc.
BUG=b/25770648
Change-Id: Ia8f72cc59160fc736c8a58cb68d9894f9c92281c
Signed-off-by: Dylan Reid <dgreid@chromium.org>
diff --git a/minijail0.1 b/minijail0.1
index 1f3b126..122ecc5 100644
--- a/minijail0.1
+++ b/minijail0.1
@@ -49,6 +49,10 @@
(Other direct numbers may be specified if minijail0 is not in sync with the
host kernel or something like 32/64-bit compatibility issues exist.)
.TP
+\fB-l\fR
+Run inside a new IPC namespace. This option makes the program's System V IPC
+namespace independent.
+.TP
\fB-p\fR
Run inside a new PID namespace. This option will make it impossible for the
program to see or affect processes that are not its descendants. This implies