Baseline minijail with a commandline switch driven main.

src/platform/minijail/env.h

+// Copyright (c) 2009 The Chromium OS Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Provide a interfacefor supplying system interface functionality at a
+// behavioral level.
+//
+// TODO(wad) Support LinuxSUIDSandox, net namespaces, jail profiles, etc.
+
+#ifndef __CHROMEOS_MINIJAIL_ENV_H
+#define __CHROMEOS_MINIJAIL_ENV_H
+
+#include <base/basictypes.h>
+#include <base/scoped_ptr.h>
+
+namespace chromeos {
+namespace minijail {
+
+class Env {
+ public:
+  Env() { }
+  virtual ~Env() { }
+  virtual bool ChangeUser(uid_t uid, gid_t gid) const;
+  virtual bool DisableDefaultRootPrivileges() const;
+  virtual bool DisableTracing() const;
+  virtual bool EnterNamespace(int namespaces) const;
+  virtual bool FilterSyscallsBenchmarkOnly() const;
+  virtual bool FilterSyscallsBySource() const;
+  // virtual bool ExportXAuthority(int appgroup, bool trusted) const;
+  virtual bool KeepRootCapabilities() const;
+  // bool do_delayed_chroot;
+  // bool enter_net_namespace();
+  // TODO(wad) add flags: ro_proc, custom /dev, ...
+  virtual bool Mount() const;
+  virtual bool SanitizeBoundingSet(uint64 capmask) const;
+  // /dev/input/*
+  // /dev/video*
+  // /dev/*audio*
+  // bool ShimUserDevices();
+  //bool add_to_cgroup(const char *cgroup_name);
+  virtual bool SanitizeCapabilities(uint64 eff_capmask) const;
+
+  virtual bool Run(const char *path,
+                   char * const *argv,
+                   char * const *envp) const;
+ private:
+  DISALLOW_COPY_AND_ASSIGN(Env);
+};
+
+}  // namespace minijail
+}  // namespace chromeos
+
+#endif  // __CHROMEOS_MINIJAIL_ENV_H