u2fd/minijail/u2fd.conf

% minijail-config-file v0

# -e creates Network namespace.
# -N creates cgroup namespace.
# -p creates PID namespace.
# -l creates IPC namespace.
# -r remounts /proc read-only.
# -v enters new mount namespace (allows to change mounts inside jail).
# -n prevents that execve gains privileges.
# --uts creates a new UTS namespace.
# -c 0 don't need any capability.
# -P creates a pivot_root at the target folder.
# -b /,/ mounts / read-only.
# -b /run,/run mount read-only, required for D-Bus.
# -b /dev,/dev required to access /dev/uhid.
# -b ...,/var to read device policies from /var/lib/devicesettings/policy.
# -b /mnt/stateful_partition/... are required for writing profraw files.
# -b /sys/class/tpm required to access the TPM version file for
#    runtime TPM detection.
# -u u2f change user.
# -G inherit u2f supplementary groups (ie policy-readers)
# -g bluetooth change group to access /dev/uhid.

e
I
N
p
l
r
ns-mount
n
uts
c = 0
K = slave
profile = minimalistic-mountns
mount = tmpfs,/run,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC
mount = tmpfs,/var,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC
mount = tmpfs,/sys,tmpfs,MS_NOSUID|MS_NODEV|MS_NOEXEC
mount = /run/daemon-store/u2f,/run/daemon-store/u2f,none,MS_BIND|MS_REC
bind-mount = /dev/uhid
bind-mount = /run/dbus
bind-mount = /var/lib/devicesettings
bind-mount = /var/lib/metrics,,1
mount = /mnt,/mnt,tmpfs,MS_NODEV|MS_NOEXEC|MS_NOSUID,mode=755,size=10M
bind-mount = /sys/
bind-mount = /sys/class/
bind-mount = /sys/class/tpm/
u = u2f
G
g = bluetooth