arc/mount-passthrough/mount-passthrough-jailed

#!/bin/sh
# Copyright 2016 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Run mount-passthrough with minijail0.

set -e

SOURCE_IN_CONTAINER=/mnt/source
DEST_IN_CONTAINER=/mnt/dest

main() {
  if [ $# -ne 6 ]; then
    echo "Usage: $0 source dest umask uid gid android_app_access_type"
    exit 1
  fi

  local source="$1"
  local dest="$2"
  local umask="$3"
  local uid="$4"
  local gid="$5"
  local android_app_access_type="$6"

  # Set large enough open file limit since this process handles many open files.
  ulimit -n 8192

  # Start constructing minijail0 args...
  set --

  # Use minimalistic-mountns profile.
  set -- "$@" --profile=minimalistic-mountns

  # Enter a new UTS namespace.
  set -- "$@" --uts

  # Enter a new VFS namespace and remount /proc read-only.
  set -- "$@" -v -r

  # Enter a new network namespace.
  set -- "$@" -e

  # Exit minijail after forking mount-passthrough. Upstart will expect this
  # fork and track the mount-passthrough process directly.
  set -- "$@" -i

  # Enter a new IPC namespace.
  set -- "$@" -l

  # Forbid all caps except for CAP_SYS_ADMIN needed to mount fuse filesystem.
  set -- "$@" -c 0x200000

  # Run as chronos/chronos.
  set -- "$@" -u chronos -g chronos -G

  # Allow sharing mounts between CrOS and Android.
  # WARNING: BE CAREFUL not to unexpectedly expose shared mounts in following
  # bind mounts! Always remount them with MS_REC|MS_PRIVATE unless you want to
  # share those mounts explicitly.
  set -- "$@" -K

  # Mount tmpfs on /mnt.
  set -- "$@" -k "tmpfs,/mnt,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC"

  # Bind /dev/fuse to mount FUSE file systems.
  set -- "$@" -b /dev/fuse

  # Mark PRIVATE recursively under (pivot) root, in order not to expose shared
  # mount points accidentally.
  set -- "$@" -k "none,/,none,0x44000"  # private,rec

  # Mount source/dest directories.
  # Note that those directories might be shared mountpoints and we allow them.
  # 0x5000 = bind,rec
  set -- "$@" -k "${source},${SOURCE_IN_CONTAINER},none,0x5000"
  # 0x84000 = slave,rec
  set -- "$@" -k "${source},${SOURCE_IN_CONTAINER},none,0x84000"
  # 0x102e = bind,remount,noexec,nodev,nosuid
  set -- "$@" -k "${source},${SOURCE_IN_CONTAINER},none,0x102e"

  # 0x1000 = bind
  set -- "$@" -k "${dest},${DEST_IN_CONTAINER},none,0x1000"
  # 0x102e = bind,remount,noexec,nodev,nosuid
  set -- "$@" -k "${dest},${DEST_IN_CONTAINER},none,0x102e"

  # Finally, specify command line arguments.
  set -- "$@" -- /usr/bin/mount-passthrough
  set -- "$@" "${SOURCE_IN_CONTAINER}" "${DEST_IN_CONTAINER}" "${umask}" \
      "${uid}" "${gid}" "${android_app_access_type}"

  exec minijail0 "$@"
}

main "$@"