{"id":13822132,"url":"https://github.com/google/minijail","last_synced_at":"2025-05-16T15:32:59.647Z","repository":{"id":65981374,"uuid":"192603905","full_name":"google/minijail","owner":"google","description":"sandboxing and containment tool used in ChromeOS and Android","archived":false,"fork":false,"pushed_at":"2024-07-11T15:10:36.000Z","size":3275,"stargazers_count":250,"open_issues_count":0,"forks_count":28,"subscribers_count":15,"default_branch":"main","last_synced_at":"2024-07-11T17:32:01.777Z","etag":null,"topics":["linux","minijail","sandboxing","security-tools"],"latest_commit_sha":null,"homepage":"https://google.github.io/minijail/","language":"C","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":"https://chromium.googlesource.com/chromiumos/platform/minijail","source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/google.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-06-18T19:54:52.000Z","updated_at":"2024-07-11T15:10:40.000Z","dependencies_parsed_at":"2024-04-04T03:23:13.804Z","dependency_job_id":"2c3f9965-a158-483a-a3b7-e3719edf73a5","html_url":"https://github.com/google/minijail","commit_stats":null,"previous_names":[],"tags_count":118,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fminijail","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fminijail/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fminijail/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/google%2Fminijail/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/google","download_url":"https://codeload.github.com/google/minijail/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":213893315,"owners_count":15653524,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["linux","minijail","sandboxing","security-tools"],"created_at":"2024-08-04T08:01:44.410Z","updated_at":"2024-08-04T08:07:44.839Z","avatar_url":"https://github.com/google.png","language":"C","readme":"# Minijail\n\nThe Minijail homepage is\nhttps://google.github.io/minijail/.\n\nThe main source repo is\nhttps://chromium.googlesource.com/chromiumos/platform/minijail.\n\nThere might be other copies floating around, but this is the official one!\n\n[TOC]\n\n## What is it?\n\nMinijail is a sandboxing and containment tool used in ChromeOS and Android.\nIt provides an executable that can be used to launch and sandbox other programs,\nand a library that can be used by code to sandbox itself.\n\n## Getting the code\n\nYou're one `git clone` away from happiness.\n\n```\n$ git clone https://chromium.googlesource.com/chromiumos/platform/minijail\n$ cd minijail\n```\n\nReleases are tagged as `linux-vXX`:\nhttps://chromium.googlesource.com/chromiumos/platform/minijail/+refs\n\n## Building\n\nSee the [HACKING.md](./HACKING.md) document for more details.\n\n## Release process\n\nSee the [RELEASE.md](./RELEASE.md) document for more details.\n\n## Additional tools\n\nSee the [tools/README.md](./tools/README.md) document for more details.\n\n## Contact\n\nWe've got a couple of contact points.\n\n* [minijail@chromium.org]: Public user \u0026 developer mailing list.\n* [minijail-users@google.com]: Internal Google user mailing list.\n* [minijail-dev@google.com]: Internal Google developer mailing list.\n* [crbug.com/list]: Existing bug reports \u0026 feature requests.\n* [crbug.com/new]: File new bug reports \u0026 feature requests.\n* [Chromium Gerrit]: Code reviews.\n\n[minijail@chromium.org]: https://groups.google.com/a/chromium.org/forum/#!forum/minijail\n[minijail-users@google.com]: https://groups.google.com/a/google.com/forum/#!forum/minijail-users\n[minijail-dev@google.com]: https://groups.google.com/a/google.com/forum/#!forum/minijail-dev\n[crbug.com/list]: https://crbug.com/?q=component:OS\u003eSystems\u003eMinijail\n[crbug.com/new]: https://bugs.chromium.org/p/chromium/issues/entry?components=OS\u003eSystems\u003eMinijail\n[Chromium Gerrit]: https://chromium-review.googlesource.com/q/project:chromiumos/platform/minijail\n\n## GitHub Pages homepage\n\nThe https://google.github.io/minijail/ homepage is maintained in the `gh-pages`\nbranch, not in the `main` branch.\nChanges to it can be sent via Gerrit, but requires a little extra work.\n\n```shell\n# Make sure you have all the branches, and not only the \"main\" one.\n$ git fetch\n\n# Create a new local branch tracking the remote \"gh-pages\".\n# Git should automatically detect the remote and track it for you.\n$ git checkout gh-pages\n# If git can't auto-detect the remote, try one of these.\n$ git checkout -b gh-pages origin/gh-pages\n$ git checkout -b gh-pages cros/gh-pages\n\n# Make your changes like normal, then push them to Gerrit for review.\n# Here's a couple of different ways to post changes; you only need one!\n$ repo upload -D gh-pages\n$ git push origin HEAD:refs/for/gh-pages\n$ git push cros HEAD:refs/for/gh-pages\n\n# Now review your changes via Gerrit like normal.\n```\n\nOnce a change merges into the `gh-pages` branch, there is no additional work for\nyou other than waiting -- GitHub periodically syncs with our host, and then it\nwill automatically regenerate the homepage when the `gh-pages` branch updates.\n\n## Talks and presentations\n\nThe following talk serves as a good introduction to Minijail and how it can be used.\n\n[Video](https://drive.google.com/file/d/0BwPS_JpKyELWZTFBcTVsa1hhYjA/preview),\n[slides](https://docs.google.com/presentation/d/e/2PACX-1vRBqpin5xR9sng6lIBPjG0XQtu-uWWgr0ds-M3zW13XpDO-bTcMERLwoHUEB9078p1yqr9L-su9n5dk/pub).\n\n## Example usage\n\nThe ChromiumOS project has a comprehensive\n[sandboxing](https://www.chromium.org/chromium-os/developer-library/guides/development/sandboxing)\ndocument that is largely based on Minijail.\n\nAfter you play with the simple examples below, you should check that out.\n\n### Change root to any user\n\n```\n# id\nuid=0(root) gid=0(root) groups=0(root),128(pkcs11)\n# minijail0 -u jorgelo -g 5000 /usr/bin/id\nuid=72178(jorgelo) gid=5000(eng) groups=5000(eng)\n```\n\n### Drop root while keeping some capabilities\n\n```\n# minijail0 -u jorgelo -c 3000 -- /bin/cat /proc/self/status\nName: cat\n...\nCapInh: 0000000000003000\nCapPrm: 0000000000003000\nCapEff: 0000000000003000\nCapBnd: 0000000000003000\n```\n\n## Historical notes\n\nQ. \"Why is it called minijail0?\"\n\nA. It is minijail0 because it was a rewrite of an earlier program named\nminijail, which was considerably less mini, and in particular had a dependency\non libchrome (the ChromeOS packaged version of Chromium's //base).  We needed a\nnew name to not collide with the deprecated one.\n\nWe didn't want to call it minijail2 or something that would make people\nstart using it before we were ready, and it was also concretely _less_ since it\ndropped libbase, etc.  Technically, we needed to be able to fork/preload with\nminimal extra syscall noise which was too hard with libbase at the time (onexit\nhandlers, etc that called syscalls we didn't want to allow).  Also, Elly made a\nstrong case that C would be the right choice for this for linking and ease of\ncontrolled surprise system call use.\n\nhttps://crrev.com/c/4585/ added the original implementation.\n\nSource: Conversations with original authors, ellyjones@ and wad@.\n","funding_links":[],"categories":["Others"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fminijail","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgoogle%2Fminijail","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgoogle%2Fminijail/lists"}