nsjail-23.cfg

name: 'nsjail default profile for HOJ'

# naive mount uses bind mount to have access to /
mount {
    src: '/'
    dst: '/'
    is_bind: true
}

# uncomment to enable debug mode
# log_level: DEBUG

# employ our own time limiter
time_limit: 0

# pid namespace's init process ignores SIGSTOP
clone_newpid: false

# for ptrace to trap the syscall
wait_for_debugger: true

# set allowed system calls
seccomp_string:
  'ALLOW {'
  '  write,'
  '  execve,'
  '  brk,'
  '  access,'
  '  mmap,'
  '  open,'
  '  openat,'
  '  newfstat,'
  '  close,'
  '  read,'
  '  mprotect,'
  '  arch_prctl,'
  '  munmap,'
  '  getuid,'
  '  getgid,'
  '  getpid,'
  '  rt_sigaction,'
  '  geteuid,'
  '  getppid,'
  '  getcwd,'
  '  getegid,'
  '  ioctl,'
  '  fcntl,'
  '  newstat,'
  '  clone,'
  '  wait4,'
  '  rt_sigreturn,'
  '  exit_group,'
  '  lseek,'
  '  fadvise64'
  '}'
  'TRACE(0) {'
  '  SYSCALL[999]'
  '}'
  'DEFAULT KILL'