resourced/minijail/resourced.conf

% minijail-config-file v0

# Copyright 2023 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Exit immediately after fork. The jailed process will run in the background.
i

# Create and enter new UTS namespace (hostname/NIS domain name).
uts

# Create and enter new cgroup namespace.
N

# Create and enter new VFS namespace.
ns-mount

# Disables path-based filesystem restrictions.
no-fs-restrictions

# Set /mnt/empty as the root fs using pivot_root.
P = /mnt/empty

# Create a new /dev mount with a minimal set of nodes.
mount-dev

# Mounts:
# Need read access to /.
bind-mount = /

# Need read access to /dev/log for syslog.
bind-mount = /dev/log

# Need write access to /proc for PSI monitor.
mount = proc,/proc,proc,MS_NOSUID|MS_NODEV|MS_NOEXEC

# Get a writeable and empty /run tmpfs path.
mount = tmpfs,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC

# Need read access to /run/chromeos-config for reading configuration.
bind-mount = /run/chromeos-config/v1

# Need read access to /run/dbus for DBus communications.
bind-mount = /run/dbus

# Need write access to /run/resourced for resourced configs.
bind-mount = /run/resourced,,1

# Need read access to containers.pid file.
bind-mount = /run/containers

# Get a writeable and empty /sys tmpfs path.
mount = tmpfs,/sys,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M

# Need write access to /sys/bus/cpu/devices for Dynamic cgroups.
bind-mount = /sys/bus/cpu/devices

# Need write access to gpu sysfs entries.
bind-mount = /sys/class/drm,,1

# Need read access to power_supply sysfs entries.
bind-mount = /sys/class/power_supply

# Need read access to devices to follow power_supply symlinks.
#
# Need write access to /sys/class/drm/card0 for GPU tuning and
# /sys/class/drm/card0 is a soft link to /sys/devices/pci*/*/drm/card0.
#
# Need write access to the following sysfs cpu entries:
#   /sys/devices/system/cpu/cpu*/online
#   /sys/devices/system/cpu/cpufreq/policy*/scaling_governor
#   /sys/devices/system/cpu/cpufreq/policy*/energy_performance_preference
#   /sys/devices/system/cpu/cpufreq/boost
#   /sys/devices/system/cpu/smt/control
bind-mount = /sys/devices,,1

# Need write access to /sys/fs/cgroup/cpuset for Dynamic cgroups.
bind-mount = /sys/fs/cgroup/cpuset,,1

# Need write access to /sys/fs/cgroup/cpu for SetProcessState.
bind-mount = /sys/fs/cgroup/cpu,,1

# Get a writeable and empty /var tmpfs path.
mount = tmpfs,/var,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC

# Need write access to /var/lib/metrics for reporting UMA metrics.
bind-mount = /var/lib/metrics,,1

# User.
u = resourced

# Group.
g = resourced

# Inherit supplementary groups from user resourced.
G

# Add capabilities CAP_SYS_RESOURCE, CAP_SYS_NICE, and CAP_SYS_PTRACE (only
# the effective capability mask will be considered by minijail0).
#
# CAP_SYS_PTRACE is needed to read various parts of sysfs. process_vm_read
# and other more dangerous syscalls are blocked by seccomp.
c = cap_sys_resource,cap_sys_nice,cap_sys_ptrace=e

# No new privileges (no_new_privs).
n

# NOTE: We don't add "-e" since we want to receive udev events.