| commit | 739186d45e3f5c6a7979d1cb8c3c0309d83684df | [log] [tgz] |
|---|---|---|
| author | Kostya Kortchinsky <[email protected]> | Fri Nov 07 05:40:16 2025 |
| committer | Chromeos LUCI <[email protected]> | Tue Nov 18 17:50:40 2025 |
| tree | 74b0ec95f1cbcaa95569b7bf10379d1bc8b179fa | |
| parent | 97c1e32e07681096cfd826f045a8bc7dd93188b7 [diff] |
Fix `--logging=stderr` This PR aims to fix `--logging=stderr`. Currently: - the `logging` option is *not* passed to the preload library, so it logs to syslog no matter what. - extra syscalls are allowed even if not logging to `syslog`, while really `do_log` only calls `vsyslog` if the `logger` is `LOG_TO_SYSLOG`. So when we do not have access to `/dev/log` (ie: in some containers or due to privileges), we are losing `minijail0` output in dynamic mode, which is not ideal for monitoring purposes. To address this: - with `--logging=stderr`, the CLI will pass a new environment variable to the preload library in order for it to call `init_logging` appropriately (note: only supporting `stderr`); - the preload no longer invariably calls `syslog` (replaced by `do_log`); - extra syscalls are no longer allowed if not logging to syslog: `allow_syscalls_for_logging` is now conditional to `LOG_TO_SYSLOG`. I feel like this is how this should work, but this could potentially break some usage of `minijail0` if someone is expecting syslog logs with `--logging=stderr` (which sounds wrong to start with). And it has the extra benefit of avoiding the additional allowed syscalls. Those changes do not impact the default behavior. Add some tests as well (I didn't find an obvious way to do an e2e test for this). Change-Id: Ia4fa3edcb7101c3ffd8c72b40580105d7c86b86c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/minijail/+/7129870 Commit-Queue: Kostya Kortchinsky <[email protected]> Reviewed-by: Jorge Lucangeli Obes <[email protected]> Tested-by: Jorge Lucangeli Obes <[email protected]> Reviewed-by: Ben Scarlato <[email protected]>
The Minijail homepage is https://google.github.io/minijail/.
The main source repo is https://chromium.googlesource.com/chromiumos/platform/minijail.
There might be other copies floating around, but this is the official one!
Minijail is a sandboxing and containment tool used in ChromeOS and Android. It provides an executable that can be used to launch and sandbox other programs, and a library that can be used by code to sandbox itself.
You're one git clone away from happiness.
$ git clone https://chromium.googlesource.com/chromiumos/platform/minijail $ cd minijail
Releases are tagged as linux-vXX: https://chromium.googlesource.com/chromiumos/platform/minijail/+refs
See the HACKING.md document for more details.
See the RELEASE.md document for more details.
See the tools/README.md document for more details.
We've got a couple of contact points.
The https://google.github.io/minijail/ homepage is maintained in the gh-pages branch, not in the main branch. Changes to it can be sent via Gerrit, but requires a little extra work.
# Make sure you have all the branches, and not only the "main" one. $ git fetch # Create a new local branch tracking the remote "gh-pages". # Git should automatically detect the remote and track it for you. $ git checkout gh-pages # If git can't auto-detect the remote, try one of these. $ git checkout -b gh-pages origin/gh-pages $ git checkout -b gh-pages cros/gh-pages # Make your changes like normal, then push them to Gerrit for review. # Here's a couple of different ways to post changes; you only need one! $ repo upload -D gh-pages $ git push origin HEAD:refs/for/gh-pages $ git push cros HEAD:refs/for/gh-pages # Now review your changes via Gerrit like normal.
Once a change merges into the gh-pages branch, there is no additional work for you other than waiting -- GitHub periodically syncs with our host, and then it will automatically regenerate the homepage when the gh-pages branch updates.
The following talk serves as a good introduction to Minijail and how it can be used.
The ChromiumOS project has a comprehensive sandboxing document that is largely based on Minijail.
After you play with the simple examples below, you should check that out.
# id uid=0(root) gid=0(root) groups=0(root),128(pkcs11) # minijail0 -u jorgelo -g 5000 /usr/bin/id uid=72178(jorgelo) gid=5000(eng) groups=5000(eng)
# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status Name: cat ... CapInh: 0000000000003000 CapPrm: 0000000000003000 CapEff: 0000000000003000 CapBnd: 0000000000003000
Q. “Why is it called minijail0?”
A. It is minijail0 because it was a rewrite of an earlier program named minijail, which was considerably less mini, and in particular had a dependency on libchrome (the ChromeOS packaged version of Chromium's //base). We needed a new name to not collide with the deprecated one.
We didn‘t want to call it minijail2 or something that would make people start using it before we were ready, and it was also concretely less since it dropped libbase, etc. Technically, we needed to be able to fork/preload with minimal extra syscall noise which was too hard with libbase at the time (onexit handlers, etc that called syscalls we didn’t want to allow). Also, Elly made a strong case that C would be the right choice for this for linking and ease of controlled surprise system call use.
https://crrev.com/c/4585/ added the original implementation.
Source: Conversations with original authors, ellyjones@ and wad@.