Source: minijail
Section: admin
Priority: optional
Maintainer: Yunseong Kim <ysk@kzalloc.com>
Build-Depends:
 debhelper-compat (= 13),
 libcap-dev,
 pkgconf,
Build-Depends-Indep:
 dh-sequence-python3,
 help2man,
 pybuild-plugin-pyproject,
 python3-all,
 python3-setuptools,
Standards-Version: 4.7.4
Homepage: https://google.github.io/minijail/
Vcs-Browser: https://salsa.debian.org/ysk/minijail
Vcs-Git: https://salsa.debian.org/ysk/minijail.git

Package: minijail
Architecture: linux-any
Depends:
 ${misc:Depends},
 ${shlibs:Depends},
Description: utility to run a program inside a sandbox
 Minijail is a sandboxing and containment tool used in ChromeOS and Android.
 It launches a program with a restricted view of the system: it can enter new
 namespaces (mount, PID, network, user, IPC), pivot_root into a chosen
 filesystem, drop capabilities and switch user, and apply a seccomp-bpf filter
 that limits the program to a declared set of system calls.
 .
 Minijail is intended for sandboxing known binaries, to reduce the damage a
 compromised service can do. It is not designed to safely run malicious code.
 .
 This package contains the minijail0 command line tool.

Package: libminijail1
Section: libs
Architecture: linux-any
Multi-Arch: same
Depends:
 ${misc:Depends},
 ${shlibs:Depends},
Description: sandboxing and containment library
 Minijail is a sandboxing and containment tool used in ChromeOS and Android.
 The library lets a program sandbox itself: enter new namespaces, drop
 capabilities, change user, and install a seccomp-bpf filter, either
 programmatically or from a policy file.
 .
 This package contains the shared library.

Package: libminijail-dev
Section: libdevel
Architecture: linux-any
Multi-Arch: same
Depends:
 libminijail1 (= ${binary:Version}),
 ${misc:Depends},
Description: sandboxing and containment library - development files
 Minijail is a sandboxing and containment tool used in ChromeOS and Android.
 The library lets a program sandbox itself: enter new namespaces, drop
 capabilities, change user, and install a seccomp-bpf filter, either
 programmatically or from a policy file.
 .
 This package contains the headers and the pkg-config file needed to build
 programs against libminijail.

Package: librust-minijail-sys-dev
Section: rust
Architecture: linux-any
Multi-Arch: same
Depends:
 libminijail-dev (= ${binary:Version}),
 librust-bindgen-0.72+default-dev,
 librust-libc-0.2+default-dev (>= 0.2.44),
 librust-pkg-config-0.3+default-dev,
 pkgconf,
 ${misc:Depends},
Provides:
 ${rust:Provides},
Description: raw Rust bindings to libminijail - Rust source code
 Minijail is a sandboxing and containment tool used in ChromeOS and Android.
 .
 This package contains the source of the minijail-sys Rust crate, the
 bindgen-generated FFI bindings to the system libminijail, for use with
 Debian's packaging of Rust crates. It is built from the minijail source
 rather than crates.io, where the crate is not published.

Package: librust-minijail-dev
Section: rust
Architecture: linux-any
Multi-Arch: same
Depends:
 librust-libc-0.2+default-dev (>= 0.2.44),
 librust-minijail-sys-dev (= ${binary:Version}),
 ${misc:Depends},
Provides:
 ${rust:Provides},
Description: safe Rust interface to libminijail - Rust source code
 Minijail is a sandboxing and containment tool used in ChromeOS and Android.
 .
 This package contains the source of the minijail Rust crate, a safe wrapper
 around libminijail used by crosvm, for use with Debian's packaging of Rust
 crates. It is built from the minijail source rather than crates.io, where
 the crate is not published.

Package: python3-minijail
Section: python
Architecture: all
Depends:
 ${misc:Depends},
 ${python3:Depends},
Description: seccomp policy tools for minijail
 Minijail is a sandboxing and containment tool used in ChromeOS and Android.
 .
 This package contains the Python seccomp policy tools and the minijail
 Python module they are built on:
  - compile_seccomp_policy compiles a minijail .policy file into a BPF
    program, as crosvm does at build time for its device sandboxes;
  - generate_seccomp_policy drafts a policy from strace or audit logs;
  - generate_constants_json produces the per-architecture syscall and
    constant tables that the compiler takes as input.