Module helpers

Structs§

MAX_OPEN_FILES_DEFAULT: Most devices don’t need to open many fds. However, an implementation detail of minijail is that after applying this limit, it opens an additional file descriptor to scan the /proc/self/fd directory to choose which file descriptors to close in the child process. The open files limit therefore has to be higher than the number file descriptors that the parent thread holds open before the jail is started.
MAX_OPEN_FILES_FOR_GPU 🔒: The max open files for gpu processes.
MAX_OPEN_FILES_FOR_JAIL_WARDEN: The max open files for jail warden, matching FD_RAW_FAILURE.

add_current_user_to_jail 🔒: Set the uid/gid for the jailed process and give a basic id map. This is required for bind mounts to work.
create_base_minijail: Creates a [Minijail] instance which just changes the root using pivot_root(2) path and max_open_files using RLIMIT_NOFILE.
create_base_minijail_without_pivot_root: Creates a [Minijail] instance which just invokes a jail process and sets max_open_files using RLIMIT_NOFILE. This is helpful with crosvm process runs as a non-root user without SYS_ADMIN capabilities.
create_gpu_minijail: Creates [Minijail] for gpu processes.
create_sandbox_minijail: Creates a [Minijail] instance which creates a sandbox.
jail_mount_bind_drm: Selectively bind mount drm nodes into jail based on render_node_only
jail_mount_bind_if_exists: Mirror-mount all the directories in dirs into jail on a best-effort basis.
mount_proc: Mount proc in the sandbox.
set_embedded_bpf_program: Set the seccomp policy for a jail from embedded bpfs
simple_jail: Creates a basic [Minijail] if jail_config is present.