procd/jail, branch master

service: add workdir support for daemon instances

2026-11-03T11:39:51Z

Allow instances to select a working directory with the workdir option. Change directory after setting the process identity and fail startup if the directory cannot be entered. Preserve the existing behavior when workdir is omitted. Pass the directory to ujail through a new -B option, reusing its existing directory switch after jail setup. Track workdir changes, include the value in instance dumps, and release owned strings. For OCI bundle instances, process.cwd from the bundle takes precedence over workdir because the bundle is parsed after the command-line options. Signed-off-by: Tianling Shen

jail: fix typo in usage output

2026-11-02T15:59:26Z

'remont' should be 'remount'. Fixes: a4505284b4d2 ("jail: reworks & cleanups") Signed-off-by: Daniel Golle

jail: share the live resolv.conf with host-network jails

2026-11-02T15:59:26Z

A jail without its own network namespace gets the host's /etc/resolv.conf bind-mounted, which pins the inode the symlink chain resolves to at start, /tmp/resolv.conf.d/resolv.conf.auto. netifd replaces that file by rename, so a jail started before the uplink had DNS keeps the empty boot-time file for good, and a jailed sysntpd never resolves its servers. Bind /tmp/resolv.conf.d read-only to /dev/resolv.conf.d in such jails and make /etc/resolv.conf a relative symlink into it, set up as for containers with a private netifd. The mount point lives in the /dev ujail builds itself, so read-only and overlay roots work alike. The link targets resolv.conf in that directory when present, else the host's resolved path when it lies there. Otherwise, or when the bundle mounts /etc/resolv.conf itself, the file bind stays. Fixes: 77a6782d6e4e ("jail: mount-bind /etc/resolv.conf for non-netns jails") Signed-off-by: Daniel Golle

jail: warn when the jailed process can undo read-only mounts

2026-11-01T20:16:38Z

Mount flags alone do not keep a jail's read-only mounts read-only: a process that holds CAP_SYS_ADMIN in the jail's user namespace can remount them read-write, unmount them or mount over them, and the kernel locks the flags only of mounts inherited from a more privileged namespace, which ujail's own mounts are not. Jailed services prevent this by dropping CAP_SYS_ADMIN or by a seccomp filter that denies the mount syscalls; nothing tells when a jail has neither. The child decides with prctl() alone, after the capability and identity changes and before exec, whether CAP_SYS_ADMIN survives the exec: it is ambient, or the process runs as uid 0 without SECBIT_NOROOT and the bounding set still holds it. The parent logs a warning when that is the case and no enforcing seccomp filter denies every syscall of the mount family on all paths. seccomp_nr_allows() gains the "allowed on some path" mode this needs; anything it cannot follow counts as allowed there, as do log, trace and user-notification returns. Signed-off-by: Daniel Golle

jail: do not lock SECBIT_KEEP_CAPS

2026-11-01T20:00:24Z

With a capability set to apply, ujail locks SECBIT_KEEP_CAPS off before the exec. prctl(PR_SET_KEEPCAPS) then fails with EPERM, so a service that drops to its own user and keeps part of its capabilities across setuid(), as dnsmasq does, cannot start under a capabilities file ("setting capabilities failed: Operation not permitted"). Leave the bit unlocked. It only lets a process keep capabilities it already holds, within the bounding set, and execve() clears it. The OCI runtime specification does not mention securebits, and runc and crun set and clear PR_SET_KEEPCAPS themselves without locking it. Fixes: acf36f2777ae ("jail: seteuid before clone(CLONE_NEWUSER)") Signed-off-by: Daniel Golle

jail: fs: apply the mount flags to path bind clones

2026-11-01T17:43:55Z

add_2paths_and_deps() and add_2paths_nodeps() clone each bind source with open_tree() in the parent, and mount_one() moves such a clone into the jail with do_mount_fd(), which never applies the mount's flags. The clone keeps the flags of the host mount it was taken from, so every -r, -b and non-idmapped -k path, the jailed program and its ELF interpreter are writable from inside the jail when the host mount is, e.g. the overlay root or /tmp: a jailed uid 0 process can rewrite a staged host file such as /etc/hosts. Set the mount's flags on the detached clone with mount_setattr() right after open_tree(), while still running as real root. Should that fail the clone is dropped and do_mount() binds by path and remounts the target with the requested flags. Fixes: 0d1c1d45a1fa ("jail: provision per-instance files via idmapped credential binds") Signed-off-by: Daniel Golle

jail: seccomp: skip a mapped path that does not fit

2026-10-25T08:47:02Z

find_libc_init() builds /proc//root for each mapped file with an unchecked snprintf(). gcc 14 cannot bound the length of the entry in seen[] and warns, and -Werror turns that into a build failure where _FORTIFY_SOURCE is not set: jail/seccomp-inject.c:1201:64: error: '%s' directive output may be truncated writing up to 12287 bytes into a region of size between 4138 and 4148 [-Werror=format-truncation=] Skip a mapped file whose rooted path does not fit, so that no symbol is looked up in a truncated path. Fixes: f15d0c407c09 ("jail: apply OCI seccomp filters via ptrace syscall injection") Signed-off-by: Felix Fietkau

jail: fail a too long resolv.conf path for a private netifd

2026-10-25T08:43:34Z

The host side of a private netifd jail builds /tmp/resolv.conf-.d and its resolv.conf.auto with unchecked snprintf() calls. A long jail name truncates both paths, so ujail creates and binds a directory with another name. gcc 14 also warns at the second call, and the -Werror of CMakeLists.txt turns that into a build failure wherever _FORTIFY_SOURCE is not set, for example with a host gcc: jail/jail.c:7490:75: error: '/resolv.conf.auto' directive output may be truncated writing 17 bytes into a region of size between 1 and 4096 [-Werror=format-truncation=] Fail the jail when either path does not fit, as for a failed mkdir() of the directory. Fixes: 24495d92cc4f ("jail: provide resolv.conf to containers with a private netifd") Signed-off-by: Felix Fietkau

jail: fs: terminate the script interpreter path

2026-10-25T08:43:34Z

add_script_interp() copies the interpreter path from the shebang line with strncpy() without terminating the destination, so add_path_and_deps() operates on the path followed by uninitialised stack bytes. Depending on the stack contents the interpreter of a staged script is then not found and its dependencies are not mounted into the jail. Terminate the buffer and reject interpreter paths that no longer fit including the terminator. Fixes: 9211278a18da ("ujail: automatically add script (#!) interpreter") Signed-off-by: Felix Fietkau

jail: cgroups: avoid truncating the cpu.max value

2026-10-25T08:43:34Z

The buffer that holds the converted cpu.max value is 32 bytes. Quota and period are 64-bit values, and together they can need 40 characters plus the terminator. snprintf() then truncates the value and nothing reports the error, so cgroups_set() writes a wrong limit. Enlarge the buffer. Fixes: 16159bb1f70f ("jail: parse OCI cgroups resources") Signed-off-by: Felix Fietkau