nsjail.cfg

name: 'nsjail default profile for HOJ'

# naive mount uses bind mount to have access to /
mount {
    src: '/'
    dst: '/'
    is_bind: true
}

# uncomment to enable debug mode
# log_level: DEBUG

# employ our own time limiter
time_limit: 0
cgroup_mem_parent: 'sandbox'

# need at least ~256KiB even for an empty main()
cgroup_mem_max: 262144

# disable CLONE_NEWIPC, CLONE_NEWNS to prevent overhead (~40ms)
# when reaping children, and yield more stable time measurements
clone_newipc: false
# this still has some issue :(
# clone_newns: false

# set allowed system calls
seccomp_string:
  'ALLOW {'
  '  write,'
  '  execve,'
  '  brk,'
  '  access,'
  '  mmap,'
  '  open,'
  '  openat,'
  '  newfstat,'
  '  close,'
  '  read,'
  '  mprotect,'
  '  arch_prctl,'
  '  munmap,'
  '  getuid,'
  '  getgid,'
  '  getpid,'
  '  rt_sigaction,'
  '  geteuid,'
  '  getppid,'
  '  getcwd,'
  '  getegid,'
  '  ioctl,'
  '  fcntl,'
  '  newstat,'
  '  clone,'
  '  wait4,'
  '  rt_sigreturn,'
  '  exit_group,'
  '  lseek,'
  '  fadvise64'
  '} DEFAULT KILL'