Skip to content

Commit e65aeff

Browse files
robertswieckirobertswiecki
committed
net/pasta - more config options in config.proto
1 parent e51b894 commit e65aeff

12 files changed

+160
-46
lines changed

‎cmdline.cc‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -536,14 +536,25 @@ std::unique_ptr<nsjconf_t> parseArgs(int argc, char* argv[]) {
536536
nsjconf->disable_tsc = false;
537537
nsjconf->forward_signals = false;
538538
nsjconf->user_net.use_pasta = false;
539-
nsjconf->user_net.inbound = false;
540-
nsjconf->user_net.ip = "10.0.0.2";
539+
nsjconf->user_net.ip = "10.255.255.2";
541540
nsjconf->user_net.mask = "255.255.255.0";
542-
nsjconf->user_net.gw = "10.0.0.1";
541+
nsjconf->user_net.gw = "10.255.255.1";
543542
nsjconf->user_net.ip6 = "fc00::2";
544543
nsjconf->user_net.mask6 = "64";
545544
nsjconf->user_net.gw6 = "fc00::1";
546545
nsjconf->user_net.nsiface = "eth0";
546+
nsjconf->user_net.tcp_ports = "none";
547+
nsjconf->user_net.udp_ports = "none";
548+
nsjconf->user_net.enable_ipv4_dhcp = false;
549+
nsjconf->user_net.enable_dns = false;
550+
nsjconf->user_net.dns_forward = "";
551+
nsjconf->user_net.enable_tcp = true;
552+
nsjconf->user_net.enable_udp = true;
553+
nsjconf->user_net.enable_icmp = true;
554+
nsjconf->user_net.enable_icmp = true;
555+
nsjconf->user_net.no_map_gw = false;
556+
nsjconf->user_net.enable_ipv6_dhcp = false;
557+
nsjconf->user_net.enable_ipv6_ra = false;
547558
nsjconf->orig_uid = getuid();
548559
nsjconf->orig_euid = geteuid();
549560
nsjconf->seccomp_fprog.filter = NULL;

‎config.cc‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -286,14 +286,24 @@ static bool parseInternal(nsjconf_t* nsjconf, const nsjail::NsJailConfig& njc) {
286286

287287
if (njc.has_user_net()) {
288288
nsjconf->user_net.use_pasta = njc.user_net().enable();
289-
nsjconf->user_net.inbound = njc.user_net().inbound();
290289
nsjconf->user_net.ip = njc.user_net().ip();
291290
nsjconf->user_net.mask = njc.user_net().mask();
292291
nsjconf->user_net.gw = njc.user_net().gw();
293292
nsjconf->user_net.ip6 = njc.user_net().ip6();
294293
nsjconf->user_net.mask6 = njc.user_net().mask6();
295294
nsjconf->user_net.gw6 = njc.user_net().gw6();
296295
nsjconf->user_net.nsiface = njc.user_net().ns_iface();
296+
nsjconf->user_net.tcp_ports = njc.user_net().tcp_ports();
297+
nsjconf->user_net.udp_ports = njc.user_net().udp_ports();
298+
nsjconf->user_net.enable_ipv4_dhcp = njc.user_net().enable_ipv4_dhcp();
299+
nsjconf->user_net.enable_dns = njc.user_net().enable_dns();
300+
nsjconf->user_net.dns_forward = njc.user_net().dns_forward();
301+
nsjconf->user_net.enable_tcp = njc.user_net().enable_tcp();
302+
nsjconf->user_net.enable_udp = njc.user_net().enable_udp();
303+
nsjconf->user_net.enable_icmp = njc.user_net().enable_icmp();
304+
nsjconf->user_net.no_map_gw = njc.user_net().no_map_gw();
305+
nsjconf->user_net.enable_ipv6_dhcp = njc.user_net().enable_ipv6_dhcp();
306+
nsjconf->user_net.enable_ipv6_ra = njc.user_net().enable_ipv6_ra();
297307
}
298308

299309
if (njc.has_exec_bin()) {

‎config.proto‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -277,14 +277,24 @@ message NsJailConfig {
277277

278278
message UserNet {
279279
optional bool enable = 1 [default = false];
280-
optional bool inbound = 2 [default = false];
281-
optional string ip = 3 [default = "10.0.0.2"];
282-
optional string mask = 4 [default = "255.255.255.0"];
283-
optional string gw = 5 [default = "10.0.0.1"];
284-
optional string ip6 = 6 [default = "fc00::2"];
285-
optional string mask6 = 7 [default = "64"];
286-
optional string gw6 = 8 [default = "fc00::1"];
287-
optional string ns_iface = 9 [default = "eth0"];
280+
optional string ip = 2 [default = "10.255.255.2"];
281+
optional string mask = 3 [default = "255.255.255.0"];
282+
optional string gw = 4 [default = "10.255.255.1"];
283+
optional string ip6 = 5 [default = "fc00::2"];
284+
optional string mask6 = 6 [default = "64"];
285+
optional string gw6 = 7 [default = "fc00::1"];
286+
optional string ns_iface = 8 [default = "eth0"];
287+
optional string tcp_ports = 9 [default = "none"];
288+
optional string udp_ports = 10 [default = "none"];
289+
optional bool enable_ipv4_dhcp = 11 [default = false];
290+
optional bool enable_dns = 12 [default = false];
291+
optional string dns_forward = 13 [default = ""];
292+
optional bool enable_tcp = 14 [default = true];
293+
optional bool enable_udp = 15 [default = true];
294+
optional bool enable_icmp = 16 [default = true];
295+
optional bool no_map_gw = 17 [default = false];
296+
optional bool enable_ipv6_dhcp = 18 [default = false];
297+
optional bool enable_ipv6_ra = 19 [default = false];
288298
}
289299
optional UserNet user_net = 96;
290300
}

‎configs/bash-with-fake-geteuid.cfg‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ clone_newcgroup: true
6363

6464
user_net {
6565
enable: true
66-
inbound: true
66+
tcp_ports: "auto"
67+
udp_ports: "auto"
6768
}
6869

6970
uidmap {

‎configs/bash-with-fake-geteuid.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,9 @@
5959
"cloneNewuts": true,
6060
"cloneNewcgroup": true,
6161
"userNet": {
62-
"enable": true
62+
"enable": true,
63+
"tcpPorts": "auto",
64+
"udpPorts": "auto"
6365
},
6466
"uidmap": [
6567
{

‎configs/chromium-with-net-wayland.cfg‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,11 @@ seccomp_string: " ptrace,"
178178
seccomp_string: " process_vm_readv,"
179179
seccomp_string: " process_vm_writev"
180180
seccomp_string: "}"
181+
seccomp_string: "ERRNO(38) {"
182+
seccomp_string: " io_uring_setup,"
183+
seccomp_string: " io_uring_enter,"
184+
seccomp_string: " io_uring_register"
185+
seccomp_string: "}"
181186
seccomp_string: "DEFAULT ALLOW"
182187

183188
exec_bin {

‎configs/firefox-with-net-X11.cfg‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,18 @@ mount {
177177
mandatory: false
178178
}
179179

180+
seccomp_string: "KILL_PROCESS {"
181+
seccomp_string: " ptrace,"
182+
seccomp_string: " process_vm_readv,"
183+
seccomp_string: " process_vm_writev"
184+
seccomp_string: "}"
185+
seccomp_string: "ERRNO(38) {"
186+
seccomp_string: " io_uring_setup,"
187+
seccomp_string: " io_uring_enter,"
188+
seccomp_string: " io_uring_register"
189+
seccomp_string: "}"
190+
seccomp_string: "DEFAULT ALLOW"
191+
180192
exec_bin {
181193
path: "/usr/lib/firefox/firefox"
182194
arg: "-private"

‎configs/firefox-with-net-wayland.cfg‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,18 @@ mount {
172172
mandatory: false
173173
}
174174

175+
seccomp_string: "KILL_PROCESS {"
176+
seccomp_string: " ptrace,"
177+
seccomp_string: " process_vm_readv,"
178+
seccomp_string: " process_vm_writev"
179+
seccomp_string: "}"
180+
seccomp_string: "ERRNO(38) {"
181+
seccomp_string: " io_uring_setup,"
182+
seccomp_string: " io_uring_enter,"
183+
seccomp_string: " io_uring_register"
184+
seccomp_string: "}"
185+
seccomp_string: "DEFAULT ALLOW"
186+
175187
exec_bin {
176188
path: "/usr/lib/firefox/firefox"
177189
arg: "-private"

‎configs/weechat-with-net.cfg‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -129,15 +129,17 @@ mount {
129129
mandatory: true
130130
}
131131

132-
seccomp_string: "KILL_PROCESS { "
133-
seccomp_string: " ptrace, "
134-
seccomp_string: " process_vm_readv, "
135-
seccomp_string: " process_vm_writev "
136-
seccomp_string: "}, "
137-
seccomp_string: "ERRNO(1) { "
138-
seccomp_string: " sched_setaffinity "
139-
seccomp_string: "} "
140-
seccomp_string: "DEFAULT ALLOW "
132+
seccomp_string: "KILL_PROCESS {"
133+
seccomp_string: " ptrace,"
134+
seccomp_string: " process_vm_readv,"
135+
seccomp_string: " process_vm_writev"
136+
seccomp_string: "}"
137+
seccomp_string: "ERRNO(38) {"
138+
seccomp_string: " io_uring_setup,"
139+
seccomp_string: " io_uring_enter,"
140+
seccomp_string: " io_uring_register"
141+
seccomp_string: "}"
142+
seccomp_string: "DEFAULT ALLOW"
141143

142144
exec_bin {
143145
path: "/usr/bin/weechat"

‎configs/znc-with-net.cfg‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ rlimit_nofile: 128
3030
clone_newnet: true
3131
user_net {
3232
enable: true
33-
inbound: true
33+
tcp_ports: "auto"
3434
}
3535

3636
mount {
@@ -125,15 +125,17 @@ mount {
125125
mandatory: true
126126
}
127127

128-
seccomp_string: "KILL_PROCESS { "
129-
seccomp_string: " ptrace, "
130-
seccomp_string: " process_vm_readv, "
131-
seccomp_string: " process_vm_writev "
132-
seccomp_string: "}, "
133-
seccomp_string: "ERRNO(1) { "
134-
seccomp_string: " sched_setaffinity "
135-
seccomp_string: "} "
136-
seccomp_string: "DEFAULT ALLOW "
128+
seccomp_string: "KILL_PROCESS {"
129+
seccomp_string: " ptrace,"
130+
seccomp_string: " process_vm_readv,"
131+
seccomp_string: " process_vm_writev"
132+
seccomp_string: "}"
133+
seccomp_string: "ERRNO(38) {"
134+
seccomp_string: " io_uring_setup,"
135+
seccomp_string: " io_uring_enter,"
136+
seccomp_string: " io_uring_register"
137+
seccomp_string: "}"
138+
seccomp_string: "DEFAULT ALLOW"
137139

138140
exec_bin {
139141
path: "/usr/bin/znc"

0 commit comments

Comments
 (0)