diff --git a/src/bin/izoli.rs b/src/bin/izoli.rs index b86b598..b260bd5 100644 --- a/src/bin/izoli.rs +++ b/src/bin/izoli.rs @@ -29,9 +29,12 @@ fn main() { max: CGroupLimitValue::Max, period: 100000, }), + ..Default::default() }), + new_net: true, }, ); + let pid = izolibox .enter(Box::new(|| { IzoliBox::prelude(1).unwrap(); diff --git a/src/izolibox.rs b/src/izolibox.rs index 5409937..c94e3af 100644 --- a/src/izolibox.rs +++ b/src/izolibox.rs @@ -20,6 +20,7 @@ pub struct IzoliBox { #[derive(Debug, Clone, Default)] pub struct IzoliBoxOptions { pub cgroup_option: Option, + pub new_net: bool, } impl IzoliBox { @@ -30,11 +31,14 @@ impl IzoliBox { pub fn enter(&self, callback: CloneCb<'_>) -> Result { info!("box enter"); let mut stack = [0u8; STACK_SIZE]; - let flags = CloneFlags::CLONE_NEWNS + let mut flags = CloneFlags::CLONE_NEWNS | CloneFlags::CLONE_NEWUTS | CloneFlags::CLONE_NEWIPC - | CloneFlags::CLONE_NEWPID - | CloneFlags::CLONE_NEWNET; + | CloneFlags::CLONE_NEWPID; + + if self.options.new_net { + flags = flags | CloneFlags::CLONE_NEWNET; + } if let Some(cgroup_option) = &self.options.cgroup_option { let cgroup = CGroup::new(&format!("izoli/box_{}", self.id)).unwrap();