1// Copyright 2019 Google LLC 2// 3// Licensed under the Apache License, Version 2.0 (the "License"); 4// you may not use this file except in compliance with the License. 5// You may obtain a copy of the License at 6// 7// https://www.apache.org/licenses/LICENSE-2.0 8// 9// Unless required by applicable law or agreed to in writing, software 10// distributed under the License is distributed on an "AS IS" BASIS, 11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12// See the License for the specific language governing permissions and 13// limitations under the License. 14 15// A proto for the sandbox2::Forkserver class 16 17syntax = "proto3"; 18 19package sandbox2; 20 21import "sandboxed_api/sandbox2/mount_tree.proto"; 22 23enum Mode { 24 // Default value 25 FORKSERVER_FORK_UNSPECIFIED = 0; 26 // Fork, execve and sandbox 27 FORKSERVER_FORK_EXECVE_SANDBOX = 1; 28 // Fork and execve, but no sandboxing 29 FORKSERVER_FORK_EXECVE = 2; 30 // Just fork 31 FORKSERVER_FORK = 3; 32 reserved 4; 33} 34 35enum MonitorType { 36 // Default value 37 FORKSERVER_MONITOR_UNSPECIFIED = 0; 38 // Ptrace based monitor 39 FORKSERVER_MONITOR_PTRACE = 1; 40 // Seccomp_unotify based monitor 41 FORKSERVER_MONITOR_UNOTIFY = 2; 42} 43 44// Enum representing the net_ns mode, used by policybuilder, forkserver, and 45// executor. 46enum NetNsMode { 47 NETNS_MODE_UNSPECIFIED = 0; 48 49 // Create a new netns for each sandbox (default). 50 NETNS_MODE_PER_SANDBOXEE = 1; 51 52 // Do not create a netns. 53 // This will disable the network namespace isolation 54 // from the host and expose its network interfaces to the sandboxee (generally 55 // granting internet access). 56 // Networking syscalls must be allowed in the policy in order to use the 57 // network. 58 NETNS_MODE_NONE = 2; 59 60 // Create a netns shared by all sandboxees started by a forkserver. 61 NETNS_MODE_SHARED_PER_FORKSERVER = 3; 62} 63 64message ForkRequest { 65 // List of arguments, starting with argv[0] 66 repeated bytes args = 1; 67 // List of environment variables which will be passed to the child 68 repeated bytes envs = 2; 69 70 // How to interpret the request 71 optional Mode mode = 3; 72 73 // Clone flags for the new process 74 optional int32 clone_flags = 4; 75 76 reserved 5; 77 78 // The mount tree used for namespace initialization 79 optional MountTree mount_tree = 6; 80 81 // Hostname in the network namespace 82 optional bytes hostname = 7; 83 84 // Changes mount propagation from MS_PRIVATE to MS_SLAVE if set 85 optional bool allow_mount_propagation = 8; 86 87 // Monitor type used by the sandbox 88 optional MonitorType monitor_type = 9; 89 90 // Whether to allow speculative execution inside the sandboxee 91 optional bool allow_speculation = 10; 92 93 // Net namespace mode 94 optional NetNsMode netns_mode = 11; 95} 96