| % minijail-config-file v0 | |
| profile=minimalistic-mountns | |
| # Enable VFS/mount namespace. | |
| ns-mount | |
| # For logging. | |
| bind-mount=/dev/log | |
| # Mount tmpfs on /run to allow for subsequent bind mounts. | |
| mount=tmpfs,/run,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M | |
| # For communication over dbus. | |
| bind-mount=/run/dbus | |
| # For receiving udev events. | |
| bind-mount=/run/udev | |
| # Mount tmpfs on /sys to allow for subsequent bind mounts. | |
| mount=tmpfs,/sys,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M | |
| # /sys/devices : needed because devices under /sys/bus/pci/devices | |
| # are symlinks to here. | |
| bind-mount=/sys/devices,,1 | |
| # /sys/bus/pci : to manage the allowlist and the devices. | |
| bind-mount=/sys/bus/pci,,1 | |
| # /sys/bus/thunderbolt: to auth / deauth thunderbolt devices. | |
| bind-mount=/sys/bus/thunderbolt/devices,,1 |