Merge branch 'master' of https://github.com/google/nsjail

Author: github-actions[bot]

cmdline.cc

@@ -140,7 +140,7 @@ static const struct custom_option custom_opts[] = {
     { { "disable_proc", no_argument, nullptr, 0x0603 }, "Disable mounting procfs in the jail" },
     { { "proc_path", required_argument, nullptr, 0x0605 }, "Path used to mount procfs (default: '/proc')" },
     { { "proc_rw", no_argument, nullptr, 0x0606 }, "Is procfs mounted as R/W (default: R/O)" },
-    { { "experimental_mnt", required_argument, nullptr, 0x0609 }, "Mount API to use: 'new' (fsopen/fsmount), 'old' (mount syscall), or 'default' (auto-detect based on kernel version)" },
+    { { "experimental_mnt", required_argument, nullptr, 0x0609 }, "Mount API to use: 'new' (fsopen/fsmount), 'old' (mount syscall), or 'default' (auto-detect based on kernel version). Default: 'old'" },
     { { "seccomp_policy", required_argument, nullptr, 'P' }, "Path to file containing seccomp-bpf policy (see kafel/)" },
     { { "seccomp_string", required_argument, nullptr, 0x0901 }, "String with kafel seccomp-bpf policy (see kafel/)" },
     { { "seccomp_log", no_argument, nullptr, 0x0902 }, "Use SECCOMP_FILTER_FLAG_LOG. Log all actions except SECCOMP_RET_ALLOW). Supported since kernel version 4.14" },
@@ -462,7 +462,7 @@ std::unique_ptr<nsj_t> parseArgs(int argc, char* argv[]) {
 	nsj->orig_euid = geteuid();
 	nsj->seccomp_fprog.filter = NULL;
 	nsj->seccomp_fprog.len = 0;
-	nsj->mnt_newapi = mnt::newapi::isAvailable();
+	nsj->mnt_newapi = false; /* Make more tests before switching it to new or default */
 
 	nsj->openfds.push_back(STDIN_FILENO);
 	nsj->openfds.push_back(STDOUT_FILENO);
@@ -683,7 +683,9 @@ std::unique_ptr<nsj_t> parseArgs(int argc, char* argv[]) {
 				nsj->mnt_newapi = true;
 			} else if (strcasecmp(optarg, "old") == 0) {
 				nsj->mnt_newapi = false;
-			} else if (strcasecmp(optarg, "default") != 0) {
+			} else if (strcasecmp(optarg, "default") == 0) {
+				nsj->mnt_newapi = mnt::newapi::isAvailable();
+			} else {
 				LOG_E("--experimental_mnt must be 'new', 'old', or 'default'");
 				return nullptr;
 			}

mnt_newapi.cc

@@ -22,6 +22,10 @@
 #include "mnt_newapi.h"
 
 #include <fcntl.h>
+// clang-format off
+/* https://github.com/google/nsjail/issues/250 */
+#include <sys/mount.h>
+// clang-format on
 #include <linux/mount.h>
 #include <sys/syscall.h>
 
@@ -66,7 +70,6 @@ std::unique_ptr<std::string> buildMountTree(nsj_t*, std::vector<mnt::mount_t>*)
 #include <dirent.h>
 #include <errno.h>
 #include <inttypes.h>
-#include <sys/mount.h>
 #include <sys/stat.h>
 #include <unistd.h>
 

subproc.h

@@ -34,7 +34,7 @@
 namespace subproc {
 
 /* 0 - network connection limit reached, -1 - error */
-pid_t runChild(nsj_t* nsj, int listen_fd, int fd_in, int fd_out, int fd_err);
+pid_t runChild(nsj_t* nsj, int netfd, int fd_in, int fd_out, int fd_err);
 int countProc(nsj_t* nsj);
 void displayProc(nsj_t* nsj);
 void killAndReapAll(nsj_t* nsj, int signal);