blob: a5b916674f2903d89f69f64e9b1ff46971ca5219 [file] [log] [blame]
# Copyright 2017 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
description "Universal addresses to RPC program number mapper"
author "chromium-os-dev@chromium.org"
# The server will be invoked when a container is launched.
# It should not run automatically.
stop on stopping ui
respawn
pre-start script
mkdir -m 0710 -p "/run/rpcbind"
chown -R ganesha:ganesha "/run/rpcbind"
iptables -A INPUT -p tcp -s 100.115.92.0/24 --dport 111 \
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -i vmtap+
end script
# Allow CAP_NET_BIND_SERVICE(10)
exec minijail0 -nplrvt -L \
-S /usr/share/policy/rpcbind-seccomp.policy \
--uts \
-c 0x400 \
-u ganesha -g ganesha \
-P /mnt/empty \
-b /,/ \
-b /proc,/proc \
-b /run/rpcbind,/run,1 \
-- /sbin/rpcbind -f
post-stop script
iptables -D INPUT -p tcp -s 100.115.92.0/24 --dport 111 \
-m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT -i vmtap+
end script