diff options
| author | Jorge Lucangeli Obes <jorgelo@google.com> | 2016-09-02 11:27:29 -0400 |
|---|---|---|
| committer | Jorge Lucangeli Obes <jorgelo@google.com> | 2016-09-09 14:27:21 -0400 |
| commit | 13650616ba6faa3ad84c69816e80a2f65bce6331 (patch) | |
| tree | 8c4e3fef63687340f81a0918b43b000edfd801f2 /minijail0.1 | |
| parent | a32e8393f2864625038eb355b479a5263fb3d363 (diff) | |
| download | minijail-13650616ba6faa3ad84c69816e80a2f65bce6331.tar.gz | |
Add support for SECCOMP_FILTER_FLAG_TSYNC.
This allows synchronizing all threads in a thread group to the same
seccomp filter tree.
Some processes only receive control over their execution after
threads have already been created in their thread group. This happens
for example with apps forked from the Android zygote.
Thread sync (TSYNC) allows these processes to safely apply seccomp
filters to all threads in their thread group, therefore preventing
a thread running with seccomp filters from being able to circumvent
the filter by exploiting an unconfined thread in the same thread
group.
Bug: 31267783
Test: Manual, with multithreaded program calling libminijail.
Change-Id: I902428abf2e4d7fb3e2200ebfe9d5e640a1b10e0
Diffstat (limited to 'minijail0.1')
| -rw-r--r-- | minijail0.1 | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/minijail0.1 b/minijail0.1 index 3e077c1..41e27ff 100644 --- a/minijail0.1 +++ b/minijail0.1 @@ -3,7 +3,7 @@ minijail0 \- sandbox a process .SH SYNOPSIS .B minijail0 -[\fIOPTION\fR]... <\fIprogram\fR> [\fIargs\fR]... +[\fIOPTION\fR]... <\fIPROGRAM\fR> [\fIargs\fR]... .SH DESCRIPTION .PP Runs PROGRAM inside a sandbox. @@ -134,6 +134,9 @@ independent of the rest of the system's. .TP \fB-V <file>\fR Enter the VFS namespace specified by \fIfile\fR. +.TP +\fB-Y\fR +Synchronize seccomp filters across thread group. .SH IMPLEMENTATION This program is broken up into two parts: \fBminijail0\fR (the frontend) and a helper library called \fBlibminijailpreload\fR. Some jailings can only be achieved from |