What is /sbin/ujail? What does it do exactly?

[Naftali]

Hi

{dnsmasq} /sbin/ujail -t 5 -n dnsmasq -u -l -r (..)
{ntpd} /sbin/ujail -t 5 -n ntpd -U ntp (..)
{wpa_supplicant} /sbin/ujail -t 5 -n wpa_supplicant -U network (..)

Is this the project site https://launchpad.net/ujail ?

ujail is intended to be a system for sandboxing processes in userspace. Its main purpose is to provide security through controlling the syscalls made by a process and possibly emulating some calls. Using this technique ujail provides means to do various security-related things, like creating a syscall-level firewall or containing a process in a single directory, but still allowing selective access to files outside this directory. ujail is being designed to provide a library which can be embedded in other programs.

I not find docs...

[pavelgl]

The article is quite outdated, but it will give you a general idea.

adding seccomp and service jailing to procd [LWN.net]

Instead of spawning the process directly, procd uses the /sbin/ujail
tool. This will do the following things

1. create the readonly tmpfs with all the files inside
2. call the clone() syscall which spawns the namespaces and executes the
   ujail stub running inside the container
3. the stub will then call pivot_root() and jump into the tmpfs
4. finally the actual service is spawned