From 96b2d86a79b6c255ccb22b96b033ba494d83dedd Mon Sep 17 00:00:00 2001 From: Duncaen Date: Mon, 3 Aug 2026 23:53:18 +0200 Subject: [PATCH] nsjail: update to 3.6. --- ...ited-rlimit-handling-for-CLI-options.patch | 141 +++++++++++++++++ srcpkgs/nsjail/patches/32bitint.patch | 10 -- srcpkgs/nsjail/patches/cpp17.patch | 11 -- srcpkgs/nsjail/patches/lfs64.patch | 144 ------------------ srcpkgs/nsjail/patches/log.patch | 24 --- srcpkgs/nsjail/template | 21 ++- 6 files changed, 151 insertions(+), 200 deletions(-) create mode 100644 srcpkgs/nsjail/patches/0001-Fix-inherited-rlimit-handling-for-CLI-options.patch delete mode 100644 srcpkgs/nsjail/patches/32bitint.patch delete mode 100644 srcpkgs/nsjail/patches/cpp17.patch delete mode 100644 srcpkgs/nsjail/patches/lfs64.patch delete mode 100644 srcpkgs/nsjail/patches/log.patch diff --git a/srcpkgs/nsjail/patches/0001-Fix-inherited-rlimit-handling-for-CLI-options.patch b/srcpkgs/nsjail/patches/0001-Fix-inherited-rlimit-handling-for-CLI-options.patch new file mode 100644 index 00000000000..31ca5f78305 --- /dev/null +++ b/srcpkgs/nsjail/patches/0001-Fix-inherited-rlimit-handling-for-CLI-options.patch @@ -0,0 +1,141 @@ +Patch-Source: https://github.com/google/nsjail/commits/dc5338c63708a8984839fe96a90cc074c877b25d +From dc5338c63708a8984839fe96a90cc074c877b25d Mon Sep 17 00:00:00 2001 +From: n-agi +Date: Thu, 19 Mar 2026 11:17:29 +0000 +Subject: [PATCH] Fix inherited rlimit handling for CLI options + +--- + cmdline.cc | 79 ++++++++++++++++++++++++++++++++++++++++-------------- + cmdline.h | 1 + + 2 files changed, 60 insertions(+), 20 deletions(-) + +diff --git a/cmdline.cc b/cmdline.cc +index bb903ec..17f1b6c 100644 +--- a/cmdline.cc ++++ b/cmdline.cc +@@ -327,6 +327,25 @@ void logParams(nsj_t* nsj) { + } + } + ++nsjail::RLimit parseRLimitType(int res, const char* optarg) { ++ if (strcasecmp(optarg, "def") == 0 || strcasecmp(optarg, "soft") == 0) { ++ return nsjail::RLimit::SOFT; ++ } ++ if (strcasecmp(optarg, "max") == 0 || strcasecmp(optarg, "hard") == 0) { ++ return nsjail::RLimit::HARD; ++ } ++ if (strcasecmp(optarg, "inf") == 0) { ++ return nsjail::RLimit::INF; ++ } ++ if (util::isANumber(optarg)) { ++ return nsjail::RLimit::VALUE; ++ } ++ LOG_F("RLIMIT %s (%d) needs a numeric value or 'max'/'hard'/'def'/'soft'/'inf' " ++ "value (%s provided)", ++ util::rLimName(res).c_str(), res, QC(optarg)); ++ abort(); ++} ++ + uint64_t parseRLimit(int res, const char* optarg, unsigned long mul) { + if (strcasecmp(optarg, "inf") == 0) { + return RLIM64_INFINITY; +@@ -550,44 +569,64 @@ std::unique_ptr parseArgs(int argc, char* argv[]) { + exit(0); + break; + case 0x0201: +- nsj->njc.set_rlimit_as(parseRLimit(RLIMIT_AS, optarg, 1)); +- nsj->njc.set_rlimit_as_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_as_type(parseRLimitType(RLIMIT_AS, optarg)); ++ if (nsj->njc.rlimit_as_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_as(parseRLimit(RLIMIT_AS, optarg, 1)); ++ } + break; + case 0x0202: +- nsj->njc.set_rlimit_core(parseRLimit(RLIMIT_CORE, optarg, 1)); +- nsj->njc.set_rlimit_core_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_core_type(parseRLimitType(RLIMIT_CORE, optarg)); ++ if (nsj->njc.rlimit_core_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_core(parseRLimit(RLIMIT_CORE, optarg, 1)); ++ } + break; + case 0x0203: +- nsj->njc.set_rlimit_cpu(parseRLimit(RLIMIT_CPU, optarg, 1)); +- nsj->njc.set_rlimit_cpu_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_cpu_type(parseRLimitType(RLIMIT_CPU, optarg)); ++ if (nsj->njc.rlimit_cpu_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_cpu(parseRLimit(RLIMIT_CPU, optarg, 1)); ++ } + break; + case 0x0204: +- nsj->njc.set_rlimit_fsize(parseRLimit(RLIMIT_FSIZE, optarg, 1)); +- nsj->njc.set_rlimit_fsize_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_fsize_type(parseRLimitType(RLIMIT_FSIZE, optarg)); ++ if (nsj->njc.rlimit_fsize_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_fsize(parseRLimit(RLIMIT_FSIZE, optarg, 1)); ++ } + break; + case 0x0205: +- nsj->njc.set_rlimit_nofile(parseRLimit(RLIMIT_NOFILE, optarg, 1)); +- nsj->njc.set_rlimit_nofile_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_nofile_type(parseRLimitType(RLIMIT_NOFILE, optarg)); ++ if (nsj->njc.rlimit_nofile_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_nofile(parseRLimit(RLIMIT_NOFILE, optarg, 1)); ++ } + break; + case 0x0206: +- nsj->njc.set_rlimit_nproc(parseRLimit(RLIMIT_NPROC, optarg, 1)); +- nsj->njc.set_rlimit_nproc_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_nproc_type(parseRLimitType(RLIMIT_NPROC, optarg)); ++ if (nsj->njc.rlimit_nproc_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_nproc(parseRLimit(RLIMIT_NPROC, optarg, 1)); ++ } + break; + case 0x0207: +- nsj->njc.set_rlimit_stack(parseRLimit(RLIMIT_STACK, optarg, 1)); +- nsj->njc.set_rlimit_stack_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_stack_type(parseRLimitType(RLIMIT_STACK, optarg)); ++ if (nsj->njc.rlimit_stack_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_stack(parseRLimit(RLIMIT_STACK, optarg, 1)); ++ } + break; + case 0x0209: +- nsj->njc.set_rlimit_memlock(parseRLimit(RLIMIT_MEMLOCK, optarg, 1)); +- nsj->njc.set_rlimit_memlock_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_memlock_type(parseRLimitType(RLIMIT_MEMLOCK, optarg)); ++ if (nsj->njc.rlimit_memlock_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_memlock(parseRLimit(RLIMIT_MEMLOCK, optarg, 1)); ++ } + break; + case 0x0210: +- nsj->njc.set_rlimit_rtprio(parseRLimit(RLIMIT_RTPRIO, optarg, 1)); +- nsj->njc.set_rlimit_rtprio_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_rtprio_type(parseRLimitType(RLIMIT_RTPRIO, optarg)); ++ if (nsj->njc.rlimit_rtprio_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_rtprio(parseRLimit(RLIMIT_RTPRIO, optarg, 1)); ++ } + break; + case 0x0211: +- nsj->njc.set_rlimit_msgqueue(parseRLimit(RLIMIT_MSGQUEUE, optarg, 1)); +- nsj->njc.set_rlimit_msgqueue_type(nsjail::RLimit::VALUE); ++ nsj->njc.set_rlimit_msgqueue_type(parseRLimitType(RLIMIT_MSGQUEUE, optarg)); ++ if (nsj->njc.rlimit_msgqueue_type() == nsjail::RLimit::VALUE) { ++ nsj->njc.set_rlimit_msgqueue(parseRLimit(RLIMIT_MSGQUEUE, optarg, 1)); ++ } + break; + case 0x0208: + nsj->njc.set_disable_rl(true); +diff --git a/cmdline.h b/cmdline.h +index 74b9e5f..6a8611e 100644 +--- a/cmdline.h ++++ b/cmdline.h +@@ -31,6 +31,7 @@ + + namespace cmdline { + ++nsjail::RLimit parseRLimitType(int res, const char* optarg); + uint64_t parseRLimit(int res, const char* optarg, unsigned long mul); + void logParams(nsj_t* nsj); + void addEnv(nsj_t* nsj, const std::string& env); +-- +2.53.0 + diff --git a/srcpkgs/nsjail/patches/32bitint.patch b/srcpkgs/nsjail/patches/32bitint.patch deleted file mode 100644 index 055caa909e3..00000000000 --- a/srcpkgs/nsjail/patches/32bitint.patch +++ /dev/null @@ -1,10 +0,0 @@ ---- a/macros.h 2022-11-22 22:25:15.000000000 +0100 -+++ - 2023-07-14 21:21:14.506361610 +0200 -@@ -65,6 +65,6 @@ - #endif - - #define NS_VALSTR_STRUCT(x) \ -- { (uint64_t) x, #x } -+ { (long unsigned int) x, #x } - - #endif /* NS_COMMON_H */ diff --git a/srcpkgs/nsjail/patches/cpp17.patch b/srcpkgs/nsjail/patches/cpp17.patch deleted file mode 100644 index 384ff7b5125..00000000000 --- a/srcpkgs/nsjail/patches/cpp17.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/Makefile 2022-11-22 22:25:15.000000000 +0100 -+++ - 2023-07-08 16:35:16.308351723 +0200 -@@ -32,7 +32,7 @@ - -Ikafel/include - - CXXFLAGS += $(USER_DEFINES) $(COMMON_FLAGS) $(shell pkg-config --cflags protobuf) \ -- -std=c++14 -fno-exceptions -Wno-unused -Wno-unused-parameter -+ -std=c++17 -fno-exceptions -Wno-unused -Wno-unused-parameter - LDFLAGS += -pie -Wl,-z,noexecstack -lpthread $(shell pkg-config --libs protobuf) - - BIN = nsjail diff --git a/srcpkgs/nsjail/patches/lfs64.patch b/srcpkgs/nsjail/patches/lfs64.patch deleted file mode 100644 index 8bc7c2e399e..00000000000 --- a/srcpkgs/nsjail/patches/lfs64.patch +++ /dev/null @@ -1,144 +0,0 @@ -diff --git a/cmdline.cc b/cmdline.cc -index 46365cf..1419412 100644 ---- a/cmdline.cc -+++ b/cmdline.cc -@@ -332,7 +332,7 @@ uint64_t parseRLimit(int res, const char *optarg, unsigned long mul) { - return RLIM64_INFINITY; - } - struct rlimit64 cur; -- if (getrlimit64(res, &cur) == -1) { -+ if (util::getrlimit(res, &cur) == -1) { - PLOG_F("getrlimit(%d)", res); - } - if (strcasecmp(optarg, "def") == 0 || strcasecmp(optarg, "soft") == 0) { -diff --git a/contain.cc b/contain.cc -index bac5152..f0c8581 100644 ---- a/contain.cc -+++ b/contain.cc -@@ -141,53 +141,53 @@ static bool containSetLimits(nsjconf_t* nsjconf) { - - struct rlimit64 rl; - rl.rlim_cur = rl.rlim_max = nsjconf->rl_as; -- if (setrlimit64(RLIMIT_AS, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_AS, %" PRIu64 ")", nsjconf->rl_as); -+ if (util::setrlimit(RLIMIT_AS, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_AS, %" PRIu64 ")", nsjconf->rl_as); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_core; -- if (setrlimit64(RLIMIT_CORE, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_CORE, %" PRIu64 ")", nsjconf->rl_core); -+ if (util::setrlimit(RLIMIT_CORE, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_CORE, %" PRIu64 ")", nsjconf->rl_core); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_cpu; -- if (setrlimit64(RLIMIT_CPU, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_CPU, %" PRIu64 ")", nsjconf->rl_cpu); -+ if (util::setrlimit(RLIMIT_CPU, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_CPU, %" PRIu64 ")", nsjconf->rl_cpu); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_fsize; -- if (setrlimit64(RLIMIT_FSIZE, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_FSIZE, %" PRIu64 ")", nsjconf->rl_fsize); -+ if (util::setrlimit(RLIMIT_FSIZE, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_FSIZE, %" PRIu64 ")", nsjconf->rl_fsize); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_nofile; -- if (setrlimit64(RLIMIT_NOFILE, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_NOFILE, %" PRIu64 ")", nsjconf->rl_nofile); -+ if (util::setrlimit(RLIMIT_NOFILE, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_NOFILE, %" PRIu64 ")", nsjconf->rl_nofile); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_nproc; -- if (setrlimit64(RLIMIT_NPROC, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_NPROC, %" PRIu64 ")", nsjconf->rl_nproc); -+ if (util::setrlimit(RLIMIT_NPROC, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_NPROC, %" PRIu64 ")", nsjconf->rl_nproc); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_stack; -- if (setrlimit64(RLIMIT_STACK, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_STACK, %" PRIu64 ")", nsjconf->rl_stack); -+ if (util::setrlimit(RLIMIT_STACK, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_STACK, %" PRIu64 ")", nsjconf->rl_stack); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_mlock; -- if (setrlimit64(RLIMIT_MEMLOCK, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_MEMLOCK, %" PRIu64 ")", nsjconf->rl_mlock); -+ if (util::setrlimit(RLIMIT_MEMLOCK, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_MEMLOCK, %" PRIu64 ")", nsjconf->rl_mlock); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_rtpr; -- if (setrlimit64(RLIMIT_RTPRIO, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_RTPRIO, %" PRIu64 ")", nsjconf->rl_rtpr); -+ if (util::setrlimit(RLIMIT_RTPRIO, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_RTPRIO, %" PRIu64 ")", nsjconf->rl_rtpr); - return false; - } - rl.rlim_cur = rl.rlim_max = nsjconf->rl_msgq; -- if (setrlimit64(RLIMIT_MSGQUEUE, &rl) == -1) { -- PLOG_E("setrlimit64(0, RLIMIT_MSGQUEUE , %" PRIu64 ")", nsjconf->rl_msgq); -+ if (util::setrlimit(RLIMIT_MSGQUEUE, rl) == -1) { -+ PLOG_E("util::setrlimit(0, RLIMIT_MSGQUEUE , %" PRIu64 ")", nsjconf->rl_msgq); - return false; - } - return true; -diff --git a/util.cc b/util.cc -index c05cb50..7f9d1fc 100644 ---- a/util.cc -+++ b/util.cc -@@ -337,4 +337,12 @@ long syscall(long sysno, uintptr_t a0, uintptr_t a1, uintptr_t a2, uintptr_t a3, - return ::syscall(sysno, a0, a1, a2, a3, a4, a5); - } - -+long setrlimit(int res, const struct rlimit64& newlim) { -+ return util::syscall(__NR_prlimit64, 0, res, (uintptr_t)&newlim, (uintptr_t) nullptr); -+} -+ -+long getrlimit(int res, struct rlimit64* curlim) { -+ return util::syscall(__NR_prlimit64, 0, res, (uintptr_t) nullptr, (uintptr_t)curlim); -+} -+ - } // namespace util -diff --git a/util.h b/util.h -index b0f401a..d2ebd16 100644 ---- a/util.h -+++ b/util.h -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -41,6 +42,14 @@ - - #define QC(x) (util::StrQuote(x).c_str()) - -+#if !defined(RLIM64_INFINITY) -+#define RLIM64_INFINITY (~0ULL) -+struct rlimit64 { -+ uint64_t rlim_cur; -+ uint64_t rlim_max; -+}; -+#endif /* !defined(RLIM64_INFINITY) */ -+ - namespace util { - - ssize_t readFromFd(int fd, void* buf, size_t len); -@@ -60,6 +69,8 @@ const std::string timeToStr(time_t t); - std::vector strSplit(const std::string str, char delim); - long syscall(long sysno, uintptr_t a0 = 0, uintptr_t a1 = 0, uintptr_t a2 = 0, uintptr_t a3 = 0, - uintptr_t a4 = 0, uintptr_t a5 = 0); -+long setrlimit(int res, const struct rlimit64& newlim); -+long getrlimit(int res, struct rlimit64* curlim); - - } // namespace util - diff --git a/srcpkgs/nsjail/patches/log.patch b/srcpkgs/nsjail/patches/log.patch deleted file mode 100644 index 9e7f1236807..00000000000 --- a/srcpkgs/nsjail/patches/log.patch +++ /dev/null @@ -1,24 +0,0 @@ -diff --git a/config.cc b/config.cc -index 5242ba4..bbb2b6d 100644 ---- a/config.cc -+++ b/config.cc -@@ -302,11 +302,6 @@ static bool configParseInternal(nsjconf_t* nsjconf, const nsjail::NsJailConfig& - return true; - } - --static void LogHandler( -- google::protobuf::LogLevel level, const char* filename, int line, const std::string& message) { -- LOG_W("config.cc: '%s'", message.c_str()); --} -- - bool parseFile(nsjconf_t* nsjconf, const char* file) { - LOG_D("Parsing configuration from '%s'", file); - -@@ -316,7 +311,6 @@ bool parseFile(nsjconf_t* nsjconf, const char* file) { - return false; - } - -- SetLogHandler(LogHandler); - google::protobuf::io::FileInputStream input(fd); - input.SetCloseOnDelete(true); - diff --git a/srcpkgs/nsjail/template b/srcpkgs/nsjail/template index ec25953dc32..efee5fb7396 100644 --- a/srcpkgs/nsjail/template +++ b/srcpkgs/nsjail/template @@ -1,8 +1,9 @@ # Template file for 'nsjail' pkgname=nsjail -version=3.3 -revision=4 -create_wrksrc=yes +version=3.6 +revision=1 +_kafel_rev=76d0f41bf3eb5c4008713d64b9767b461a9129a3 +archs="aarch64* armv5tel* armv6l* armv7l* i686* riscv64* x86_64*" build_style=gnu-makefile hostmakedepends="bison flex pkg-config protobuf which" makedepends="libnl3-devel protobuf-devel" @@ -11,20 +12,18 @@ maintainer="Orphaned " license="Apache-2.0" homepage="http://nsjail.com" distfiles="https://github.com/google/nsjail/archive/${version}.tar.gz - https://github.com/google/kafel/archive/1af0975af45ca4404f357b9a4e1636f53a01bfd3.tar.gz" -checksum="9c247d0cba565b4e3f91cc76e827ddf7f3ad499f54ba611edd25d4d7be4890c3 - e8c195a2a08daa70c7712adae3eaa01656b039dcc8cc1e5e8210006716761ad5" + https://github.com/google/kafel/archive/${_kafel_rev}.tar.gz>kafel-${_kafel_rev}.tar.gz" +checksum="9731a07dc9f019b01b67292a96a4dd879873f6456e0ef6d51b1cdb553aa7e1cd + b9a99b91af7abc84664803709072ee7f6a787dd3f39686484503154d93ef8f33" -archs="aarch64* armv5tel* armv6l* armv7l* x86_64*" +skip_extraction="kafel-${_kafel_rev}.tar.gz" if [ "$XBPS_TARGET_LIBC" = "musl" ]; then makedepends+=" musl-legacy-compat" fi post_extract() { - mv nsjail-$version/* . - rmdir kafel - mv kafel-* kafel + vsrcextract -C kafel "kafel-${_kafel_rev}.tar.gz" } post_patch() { @@ -33,6 +32,6 @@ post_patch() { } do_install() { - vbin ${pkgname} + vbin nsjail vman nsjail.1 }