Euri-Linux/horizon-packages
2
1
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

nsjail: update to 3.6.

Browse Source
This commit is contained in:
Duncaen
2026-08-04 00:03:35 +02:00
parent c631949943
commit 96b2d86a79
6 changed files with 151 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
srcpkgs/nsjail/patches/0001-Fix-inherited-rlimit-handling-for-CLI-options.patch
+141
View File
@@ -0,0 +1,141 @@
Patch-Source: https://github.com/google/nsjail/commits/dc5338c63708a8984839fe96a90cc074c877b25d
From dc5338c63708a8984839fe96a90cc074c877b25d Mon Sep 17 00:00:00 2001
From: n-agi <akanagi95@gmail.com>
Date: Thu, 19 Mar 2026 11:17:29 +0000
Subject: [PATCH] Fix inherited rlimit handling for CLI options
---
cmdline.cc | 79 ++++++++++++++++++++++++++++++++++++++++--------------
cmdline.h | 1 +
2 files changed, 60 insertions(+), 20 deletions(-)
diff --git a/cmdline.cc b/cmdline.cc
index bb903ec..17f1b6c 100644
--- a/cmdline.cc
+++ b/cmdline.cc
@@ -327,6 +327,25 @@ void logParams(nsj_t* nsj) {
}
}
+nsjail::RLimit parseRLimitType(int res, const char* optarg) {
+ if (strcasecmp(optarg, "def") == 0 || strcasecmp(optarg, "soft") == 0) {
+ return nsjail::RLimit::SOFT;
+ }
+ if (strcasecmp(optarg, "max") == 0 || strcasecmp(optarg, "hard") == 0) {
+ return nsjail::RLimit::HARD;
+ }
+ if (strcasecmp(optarg, "inf") == 0) {
+ return nsjail::RLimit::INF;
+ }
+ if (util::isANumber(optarg)) {
+ return nsjail::RLimit::VALUE;
+ }
+ LOG_F("RLIMIT %s (%d) needs a numeric value or 'max'/'hard'/'def'/'soft'/'inf' "
+ "value (%s provided)",
+ util::rLimName(res).c_str(), res, QC(optarg));
+ abort();
+}
+
uint64_t parseRLimit(int res, const char* optarg, unsigned long mul) {
if (strcasecmp(optarg, "inf") == 0) {
return RLIM64_INFINITY;
@@ -550,44 +569,64 @@ std::unique_ptr<nsj_t> parseArgs(int argc, char* argv[]) {
exit(0);
break;
case 0x0201:
- nsj->njc.set_rlimit_as(parseRLimit(RLIMIT_AS, optarg, 1));
- nsj->njc.set_rlimit_as_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_as_type(parseRLimitType(RLIMIT_AS, optarg));
+ if (nsj->njc.rlimit_as_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_as(parseRLimit(RLIMIT_AS, optarg, 1));
+ }
break;
case 0x0202:
- nsj->njc.set_rlimit_core(parseRLimit(RLIMIT_CORE, optarg, 1));
- nsj->njc.set_rlimit_core_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_core_type(parseRLimitType(RLIMIT_CORE, optarg));
+ if (nsj->njc.rlimit_core_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_core(parseRLimit(RLIMIT_CORE, optarg, 1));
+ }
break;
case 0x0203:
- nsj->njc.set_rlimit_cpu(parseRLimit(RLIMIT_CPU, optarg, 1));
- nsj->njc.set_rlimit_cpu_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_cpu_type(parseRLimitType(RLIMIT_CPU, optarg));
+ if (nsj->njc.rlimit_cpu_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_cpu(parseRLimit(RLIMIT_CPU, optarg, 1));
+ }
break;
case 0x0204:
- nsj->njc.set_rlimit_fsize(parseRLimit(RLIMIT_FSIZE, optarg, 1));
- nsj->njc.set_rlimit_fsize_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_fsize_type(parseRLimitType(RLIMIT_FSIZE, optarg));
+ if (nsj->njc.rlimit_fsize_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_fsize(parseRLimit(RLIMIT_FSIZE, optarg, 1));
+ }
break;
case 0x0205:
- nsj->njc.set_rlimit_nofile(parseRLimit(RLIMIT_NOFILE, optarg, 1));
- nsj->njc.set_rlimit_nofile_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_nofile_type(parseRLimitType(RLIMIT_NOFILE, optarg));
+ if (nsj->njc.rlimit_nofile_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_nofile(parseRLimit(RLIMIT_NOFILE, optarg, 1));
+ }
break;
case 0x0206:
- nsj->njc.set_rlimit_nproc(parseRLimit(RLIMIT_NPROC, optarg, 1));
- nsj->njc.set_rlimit_nproc_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_nproc_type(parseRLimitType(RLIMIT_NPROC, optarg));
+ if (nsj->njc.rlimit_nproc_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_nproc(parseRLimit(RLIMIT_NPROC, optarg, 1));
+ }
break;
case 0x0207:
- nsj->njc.set_rlimit_stack(parseRLimit(RLIMIT_STACK, optarg, 1));
- nsj->njc.set_rlimit_stack_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_stack_type(parseRLimitType(RLIMIT_STACK, optarg));
+ if (nsj->njc.rlimit_stack_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_stack(parseRLimit(RLIMIT_STACK, optarg, 1));
+ }
break;
case 0x0209:
- nsj->njc.set_rlimit_memlock(parseRLimit(RLIMIT_MEMLOCK, optarg, 1));
- nsj->njc.set_rlimit_memlock_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_memlock_type(parseRLimitType(RLIMIT_MEMLOCK, optarg));
+ if (nsj->njc.rlimit_memlock_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_memlock(parseRLimit(RLIMIT_MEMLOCK, optarg, 1));
+ }
break;
case 0x0210:
- nsj->njc.set_rlimit_rtprio(parseRLimit(RLIMIT_RTPRIO, optarg, 1));
- nsj->njc.set_rlimit_rtprio_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_rtprio_type(parseRLimitType(RLIMIT_RTPRIO, optarg));
+ if (nsj->njc.rlimit_rtprio_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_rtprio(parseRLimit(RLIMIT_RTPRIO, optarg, 1));
+ }
break;
case 0x0211:
- nsj->njc.set_rlimit_msgqueue(parseRLimit(RLIMIT_MSGQUEUE, optarg, 1));
- nsj->njc.set_rlimit_msgqueue_type(nsjail::RLimit::VALUE);
+ nsj->njc.set_rlimit_msgqueue_type(parseRLimitType(RLIMIT_MSGQUEUE, optarg));
+ if (nsj->njc.rlimit_msgqueue_type() == nsjail::RLimit::VALUE) {
+ nsj->njc.set_rlimit_msgqueue(parseRLimit(RLIMIT_MSGQUEUE, optarg, 1));
+ }
break;
case 0x0208:
nsj->njc.set_disable_rl(true);
diff --git a/cmdline.h b/cmdline.h
index 74b9e5f..6a8611e 100644
--- a/cmdline.h
+++ b/cmdline.h
@@ -31,6 +31,7 @@
namespace cmdline {
+nsjail::RLimit parseRLimitType(int res, const char* optarg);
uint64_t parseRLimit(int res, const char* optarg, unsigned long mul);
void logParams(nsj_t* nsj);
void addEnv(nsj_t* nsj, const std::string& env);
--
2.53.0
srcpkgs/nsjail/patches/32bitint.patch
-10
View File
@@ -1,10 +0,0 @@
--- a/macros.h 2022-11-22 22:25:15.000000000 +0100
+++ - 2023-07-14 21:21:14.506361610 +0200
@@ -65,6 +65,6 @@
#endif
#define NS_VALSTR_STRUCT(x) \
- { (uint64_t) x, #x }
+ { (long unsigned int) x, #x }
#endif /* NS_COMMON_H */
srcpkgs/nsjail/patches/cpp17.patch
-11
View File
@@ -1,11 +0,0 @@
--- a/Makefile 2022-11-22 22:25:15.000000000 +0100
+++ - 2023-07-08 16:35:16.308351723 +0200
@@ -32,7 +32,7 @@
-Ikafel/include
CXXFLAGS += $(USER_DEFINES) $(COMMON_FLAGS) $(shell pkg-config --cflags protobuf) \
- -std=c++14 -fno-exceptions -Wno-unused -Wno-unused-parameter
+ -std=c++17 -fno-exceptions -Wno-unused -Wno-unused-parameter
LDFLAGS += -pie -Wl,-z,noexecstack -lpthread $(shell pkg-config --libs protobuf)
BIN = nsjail
srcpkgs/nsjail/patches/lfs64.patch
-144
View File
@@ -1,144 +0,0 @@
diff --git a/cmdline.cc b/cmdline.cc
index 46365cf..1419412 100644
--- a/cmdline.cc
+++ b/cmdline.cc
@@ -332,7 +332,7 @@ uint64_t parseRLimit(int res, const char *optarg, unsigned long mul) {
return RLIM64_INFINITY;
}
struct rlimit64 cur;
- if (getrlimit64(res, &cur) == -1) {
+ if (util::getrlimit(res, &cur) == -1) {
PLOG_F("getrlimit(%d)", res);
}
if (strcasecmp(optarg, "def") == 0 || strcasecmp(optarg, "soft") == 0) {
diff --git a/contain.cc b/contain.cc
index bac5152..f0c8581 100644
--- a/contain.cc
+++ b/contain.cc
@@ -141,53 +141,53 @@ static bool containSetLimits(nsjconf_t* nsjconf) {
struct rlimit64 rl;
rl.rlim_cur = rl.rlim_max = nsjconf->rl_as;
- if (setrlimit64(RLIMIT_AS, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_AS, %" PRIu64 ")", nsjconf->rl_as);
+ if (util::setrlimit(RLIMIT_AS, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_AS, %" PRIu64 ")", nsjconf->rl_as);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_core;
- if (setrlimit64(RLIMIT_CORE, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_CORE, %" PRIu64 ")", nsjconf->rl_core);
+ if (util::setrlimit(RLIMIT_CORE, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_CORE, %" PRIu64 ")", nsjconf->rl_core);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_cpu;
- if (setrlimit64(RLIMIT_CPU, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_CPU, %" PRIu64 ")", nsjconf->rl_cpu);
+ if (util::setrlimit(RLIMIT_CPU, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_CPU, %" PRIu64 ")", nsjconf->rl_cpu);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_fsize;
- if (setrlimit64(RLIMIT_FSIZE, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_FSIZE, %" PRIu64 ")", nsjconf->rl_fsize);
+ if (util::setrlimit(RLIMIT_FSIZE, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_FSIZE, %" PRIu64 ")", nsjconf->rl_fsize);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_nofile;
- if (setrlimit64(RLIMIT_NOFILE, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_NOFILE, %" PRIu64 ")", nsjconf->rl_nofile);
+ if (util::setrlimit(RLIMIT_NOFILE, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_NOFILE, %" PRIu64 ")", nsjconf->rl_nofile);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_nproc;
- if (setrlimit64(RLIMIT_NPROC, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_NPROC, %" PRIu64 ")", nsjconf->rl_nproc);
+ if (util::setrlimit(RLIMIT_NPROC, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_NPROC, %" PRIu64 ")", nsjconf->rl_nproc);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_stack;
- if (setrlimit64(RLIMIT_STACK, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_STACK, %" PRIu64 ")", nsjconf->rl_stack);
+ if (util::setrlimit(RLIMIT_STACK, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_STACK, %" PRIu64 ")", nsjconf->rl_stack);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_mlock;
- if (setrlimit64(RLIMIT_MEMLOCK, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_MEMLOCK, %" PRIu64 ")", nsjconf->rl_mlock);
+ if (util::setrlimit(RLIMIT_MEMLOCK, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_MEMLOCK, %" PRIu64 ")", nsjconf->rl_mlock);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_rtpr;
- if (setrlimit64(RLIMIT_RTPRIO, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_RTPRIO, %" PRIu64 ")", nsjconf->rl_rtpr);
+ if (util::setrlimit(RLIMIT_RTPRIO, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_RTPRIO, %" PRIu64 ")", nsjconf->rl_rtpr);
return false;
}
rl.rlim_cur = rl.rlim_max = nsjconf->rl_msgq;
- if (setrlimit64(RLIMIT_MSGQUEUE, &rl) == -1) {
- PLOG_E("setrlimit64(0, RLIMIT_MSGQUEUE , %" PRIu64 ")", nsjconf->rl_msgq);
+ if (util::setrlimit(RLIMIT_MSGQUEUE, rl) == -1) {
+ PLOG_E("util::setrlimit(0, RLIMIT_MSGQUEUE , %" PRIu64 ")", nsjconf->rl_msgq);
return false;
}
return true;
diff --git a/util.cc b/util.cc
index c05cb50..7f9d1fc 100644
--- a/util.cc
+++ b/util.cc
@@ -337,4 +337,12 @@ long syscall(long sysno, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3,
return ::syscall(sysno, a0, a1, a2, a3, a4, a5);
}
+long setrlimit(int res, const struct rlimit64& newlim) {
+ return util::syscall(__NR_prlimit64, 0, res, (uintptr_t)&newlim, (uintptr_t) nullptr);
+}
+
+long getrlimit(int res, struct rlimit64* curlim) {
+ return util::syscall(__NR_prlimit64, 0, res, (uintptr_t) nullptr, (uintptr_t)curlim);
+}
+
} // namespace util
diff --git a/util.h b/util.h
index b0f401a..d2ebd16 100644
--- a/util.h
+++ b/util.h
@@ -26,6 +26,7 @@
#include <stdbool.h>
#include <stdint.h>
#include <stdlib.h>
+#include <sys/resource.h>
#include <string>
#include <vector>
@@ -41,6 +42,14 @@
#define QC(x) (util::StrQuote(x).c_str())
+#if !defined(RLIM64_INFINITY)
+#define RLIM64_INFINITY (~0ULL)
+struct rlimit64 {
+ uint64_t rlim_cur;
+ uint64_t rlim_max;
+};
+#endif /* !defined(RLIM64_INFINITY) */
+
namespace util {
ssize_t readFromFd(int fd, void* buf, size_t len);
@@ -60,6 +69,8 @@ const std::string timeToStr(time_t t);
std::vector<std::string> strSplit(const std::string str, char delim);
long syscall(long sysno, uintptr_t a0 = 0, uintptr_t a1 = 0, uintptr_t a2 = 0, uintptr_t a3 = 0,
uintptr_t a4 = 0, uintptr_t a5 = 0);
+long setrlimit(int res, const struct rlimit64& newlim);
+long getrlimit(int res, struct rlimit64* curlim);
} // namespace util
srcpkgs/nsjail/patches/log.patch
-24
View File
@@ -1,24 +0,0 @@
diff --git a/config.cc b/config.cc
index 5242ba4..bbb2b6d 100644
--- a/config.cc
+++ b/config.cc
@@ -302,11 +302,6 @@ static bool configParseInternal(nsjconf_t* nsjconf, const nsjail::NsJailConfig&
return true;
}
-static void LogHandler(
- google::protobuf::LogLevel level, const char* filename, int line, const std::string& message) {
- LOG_W("config.cc: '%s'", message.c_str());
-}
-
bool parseFile(nsjconf_t* nsjconf, const char* file) {
LOG_D("Parsing configuration from '%s'", file);
@@ -316,7 +311,6 @@ bool parseFile(nsjconf_t* nsjconf, const char* file) {
return false;
}
- SetLogHandler(LogHandler);
google::protobuf::io::FileInputStream input(fd);
input.SetCloseOnDelete(true);
srcpkgs/nsjail/template
+10 -11
View File
@@ -1,8 +1,9 @@
# Template file for 'nsjail'
pkgname=nsjail
version=3.3
revision=4
create_wrksrc=yes
version=3.6
revision=1
_kafel_rev=76d0f41bf3eb5c4008713d64b9767b461a9129a3
archs="aarch64* armv5tel* armv6l* armv7l* i686* riscv64* x86_64*"
build_style=gnu-makefile
hostmakedepends="bison flex pkg-config protobuf which"
makedepends="libnl3-devel protobuf-devel"
@@ -11,20 +12,18 @@ maintainer="Orphaned <orphan@voidlinux.org>"
license="Apache-2.0"
homepage="http://nsjail.com"
distfiles="https://github.com/google/nsjail/archive/${version}.tar.gz
https://github.com/google/kafel/archive/1af0975af45ca4404f357b9a4e1636f53a01bfd3.tar.gz"
checksum="9c247d0cba565b4e3f91cc76e827ddf7f3ad499f54ba611edd25d4d7be4890c3
e8c195a2a08daa70c7712adae3eaa01656b039dcc8cc1e5e8210006716761ad5"
https://github.com/google/kafel/archive/${_kafel_rev}.tar.gz>kafel-${_kafel_rev}.tar.gz"
checksum="9731a07dc9f019b01b67292a96a4dd879873f6456e0ef6d51b1cdb553aa7e1cd
b9a99b91af7abc84664803709072ee7f6a787dd3f39686484503154d93ef8f33"
archs="aarch64* armv5tel* armv6l* armv7l* x86_64*"
skip_extraction="kafel-${_kafel_rev}.tar.gz"
if [ "$XBPS_TARGET_LIBC" = "musl" ]; then
makedepends+=" musl-legacy-compat"
fi
post_extract() {
mv nsjail-$version/* .
rmdir kafel
mv kafel-* kafel
vsrcextract -C kafel "kafel-${_kafel_rev}.tar.gz"
}
post_patch() {
@@ -33,6 +32,6 @@ post_patch() {
}
do_install() {
vbin ${pkgname}
vbin nsjail
vman nsjail.1
}