sandbox(5) [centos man page]

sandbox.conf(5) 					    Linux System Administration 					   sandbox.conf(5)

NAME

       sandbox.conf - user config file for the SELinux sandbox

DESCRIPTION

       When  running sandbox with the -C argument, it will be confined using control groups and a system administrator can specify how the sandbox
       is confined.

       Everything after "#" is ignored, as are empty lines.  All arguments should be separated by and equals sign ("=").

       These keywords are allowed.

	      NAME   The name of the sandbox control group.  Default is "sandbox".

	      CPUAFFINITY
		     Which cpus to assign sandbox to.  The default is ALL, but users can specify a comma-separated list with dashes ("-") to  rep-
		     resent ranges.  Ex: 0-2,5

	      MEMUSAGE
		     How  much	memory to allow sandbox to use.  The default is 80%.  Users can specify either a percentage or a value in the form
		     of a number followed by one of the suffixes K, M, G to denote kilobytes, megabytes or gigabytes  respectively.   Ex:  50%	or
		     100M

	      CPUUSAGE
		     Percentage  of  cpu sandbox should be allowed to use.  The default is 80%.  Specify a value followed by a percent sign ("%").
		     Ex: 50%

SEE ALSO

       sandbox(8)

AUTHOR

       This manual page was written by Thomas Liu <tliu@fedoraproject.org>

sandbox.conf							     June 2010							   sandbox.conf(5)

SANDBOX_INIT(3) 					   BSD Library Functions Manual 					   SANDBOX_INIT(3)

NAME

     sandbox_init, sandbox_free_error -- set process sandbox (DEPRECATED)

SYNOPSIS

     #include <sandbox.h>

     int
     sandbox_init(const char *profile, uint64_t flags, char **errorbuf);

     void
     sandbox_free_error(char *errorbuf);

DESCRIPTION

     The sandbox_init() and sandbox_free_error() functions are DEPRECATED.  Developers who wish to sandbox an app should instead adopt the App
     Sandbox feature described in the App Sandbox Design Guide.

     The sandbox_init() function places the current process into a sandbox(7). The NUL-terminated string profile specifies the profile to be used
     to configure the sandbox.	The flags specified are formed by or'ing the following values:

     SANDBOX_NAMED	     The profile argument specifies a sandbox profile named by one of the constants given in the AVAILABLE PROFILES sec-
			     tion below.

     The out parameter *errorbuf will be set according to the error status.

RETURN VALUES

     Upon successful completion of sandbox_init(), a value of 0 is returned and *errorbuf is set to NULL.  In the event of an error, a value of -1
     is returned and *errorbuf is set to a pointer to a NUL-terminated string describing the error.  This string may contain embedded newlines.
     This error information is suitable for developers and is not intended for end users.  This pointer should be passed to sandbox_free_error(3)
     to release the allocated storage when it is no longer needed.

AVAILABLE PROFILES

     The following are brief descriptions of each available profile.  Keep in mind that sandbox(7) restrictions are typically enforced at resource
     acquisition time.

     kSBXProfileNoInternet		TCP/IP networking is prohibited.  DEPRECATED.

     kSBXProfileNoNetwork		All sockets-based networking is prohibited.  DEPRECATED.

     kSBXProfileNoWrite 		File system writes are prohibited.  DEPRECATED.

     kSBXProfileNoWriteExceptTemporary	File system writes are restricted to the temporary folder /var/tmp and the folder specified by the
					confstr(3) configuration variable _CS_DARWIN_USER_TEMP_DIR.  DEPRECATED.

     kSBXProfilePureComputation 	All operating system services are prohibited.  DEPRECATED.

SEE ALSO

     sandbox-exec(1), sandbox(7), sandboxd(8)

Mac OS X							   March 9, 2017							  Mac OS X