Exit if unable to dlopen() libminijailpreload.so.

BUG=chromium:204504
TEST=Unit tests, Minijail autotests.
TEST=Rename libminijailpreload.so, run 'minijail0 -- /usr/bin/id', see error.

Change-Id: I3978775662a7710b89f274e7ed7c265d9b923ca2
Reviewed-on: https://chromium-review.googlesource.com/182103
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
Fix minijail_change_{user|group} with invalid users/groups.

BUG=chromium:356736
TEST='minijail0 -u <invalid> -- /usr/bin/id' fails.
TEST='minijail0 -g <invalid> -- /usr/bin/id' fails.

Change-Id: I0e1a35f5c582060bade53edb7cfda3eb1892d83c
Reviewed-on: https://chromium-review.googlesource.com/191701
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Nam Nguyen <namnguyen@chromium.org>
Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
Add 'set noparent' to Minijail OWNERS file.

BUG=None
TEST=None

Change-Id: I217a42b453e7ee389be1c20cb74264fb1bc2ad10
Reviewed-on: https://chromium-review.googlesource.com/191900
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Vadim Shtayura <vadimsh@chromium.org>
minijail: Fix issues when compiling for mipsel-o32.

BUG=chromium:358432
TEST=Tested the following:
1. Verify that syslog() uses 'connect' and 'send' syscalls as follows:

    echo 'main() { syslog(0, "test"); }' \
      | mipsel-cros-linux-gnu-gcc -static -o main -xc -
    qemu-mipsel -strace main

2. `emerge-mipsel-o32-geneirc chromeos-minijail`
3. `FEATURES=test emerge-{x86,amd64,arm}-geneirc chromeos-minijail`

Change-Id: I5084f1b8c19d2173bf133fa44210f0637f1d0cc4
Reviewed-on: https://chromium-review.googlesource.com/192603
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Tested-by: Ben Chan <benchan@chromium.org>
Commit-Queue: Ben Chan <benchan@chromium.org>
Clarify comments around minijail_pre{enter|exec}().

I was investigating Minijail behaviour with static binaries and
it took me a while to figure out what was happening where.

Document preenter/preexec functions better and move them closer
to the flags they track. This way if we add a new flag in the future
we'll also track it in minijail_pre{enter|exec}().

BUG=None
TEST=unit, security_{Minijail0|Minijail_seccomp} on leon.

Change-Id: I67e1e233b0fa0df2dcd97ad397187a7dc791a0c3
Reviewed-on: https://chromium-review.googlesource.com/194200
Reviewed-by: Kees Cook <keescook@chromium.org>
Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Fix error reporting when sandboxed process is signaled.

BUG=None
TEST=Unittests pass.
TEST=security_Minijail_seccomp passes on leon.
TEST=/usr/bin/yes; killall yes; echo $? prints 143.
TEST=minijail0 -- /usr/bin/yes; killall yes; echo $? prints 143 (not 253).
TEST=minijail0 -S /dev/null -- /usr/bin/yes; echo $? prints 253.

Change-Id: I62f779da9b5b3a61f6aff4c9855e5b73669c9efe
Reviewed-on: https://chromium-review.googlesource.com/195627
Reviewed-by: Nam Nguyen <namnguyen@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
Allow mounting of a tmpfs /tmp in the chroot

Added the -t option to minijail so a tmpfs can be used
in the chroot

BUG=chromium:356246
TEST=Tested with autotest security_Minijail0
CQ-DEPEND=CL:201147

Change-Id: I660629a8b8fa1c2bf4fc59d2499ff806aa280449
Reviewed-on: https://chromium-review.googlesource.com/201133
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Lee Campbell <leecam@chromium.org>
Commit-Queue: Lee Campbell <leecam@chromium.org>
Allow minijail to run statically linked targets

minijail will now detect static targets and sandbox them

BUG:chromium:355109
TEST=Tested with autotest security_Minijail0 on arm and x64

Change-Id: I4c38f652207c5c50158449f952b14e9402e17751
Reviewed-on: https://chromium-review.googlesource.com/203013
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Tested-by: Lee Campbell <leecam@chromium.org>
Commit-Queue: Lee Campbell <leecam@chromium.org>
Add PRESUBMIT.cfg file to the repo.

BUG=None
TEST=This CL is proof.

Change-Id: I83ef482e01ddc181b4b7f9651f795297c8863005
Reviewed-on: https://chromium-review.googlesource.com/203762
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Lee Campbell <leecam@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
Fix coding style issues.

BUG=None
TEST=Compile

Change-Id: Ic4515367a4b05be8410596c5159e4c6ddab8e798
Reviewed-on: https://chromium-review.googlesource.com/203719
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Reviewed-by: Lee Campbell <leecam@chromium.org>
Commit-Queue: Jorge Lucangeli Obes <jorgelo@chromium.org>
Fix more style issues.

BUG=None
TEST=unit

Change-Id: I89f7288e9b3226273232d99f1c0176b69ce3b300
Reviewed-on: https://chromium-review.googlesource.com/203971
Reviewed-by: Lee Campbell <leecam@chromium.org>
Tested-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
Some small changes:

* Accept named constants in the seccomp scripts.
* Chroot before execve, so that the binary's metadata in the
  /proc fs is correct.
* Fix some issues with the Makefile and libsyscall.gen.c
Create README.md
Support for programming contests.

Several new options added:
* (User) time limit
* Address space limit
* Output file size limit
* stdin/stdout/stderr redirect
* Output process stats to a file
* Clear the environment to minimize exposure.
Support for Haskell

* Added resource.h constants.
* Moved the child into its own process group.
* Add the LANG environment variable.
Added overrided signals and wall time measurement.

Overrided signals are useful if we have to kill the child process
(because it ignored previous attempts to kill it).
Delay the SIGKILL on time limit exceeded
Report used memory in bytes rather than kB
Added -lrt.

This is needed due to the introduction of clock_gettime.
Fix one very dumb memory leak