MO-P: Contestants can have multiple first names

[moe.git] / isolate / isolate.1.txt

diff --git a/isolate/isolate.1.txt b/isolate/isolate.1.txt
index 0e7952a31a61771886ce52e44093006fb9266985..8fd8f24cd2164b873c446d85ce834300f72efcff 100644 (file)
--- a/isolate/isolate.1.txt
+++ b/isolate/isolate.1.txt
@@ -67,6 +67,11 @@ OPTIONS
        is reported, even though it slightly exceeds the limit. Fractional
        numbers are again allowed.
 
        is reported, even though it slightly exceeds the limit. Fractional
        numbers are again allowed.
 

+*-b, --box-id=*'id'::
+       When you run multiple sandboxes in parallel, you have to assign each unique
+       IDs to them by this option. See the discussion on UIDs in the INSTALLATION
+       section. The ID defaults to 0.
+

 *-k, --stack=*'size'::
        Limit process stack to 'size' kilobytes. By default, the whole address
        space is available for the stack, but it is subject to the *--mem* limit.
 *-k, --stack=*'size'::
        Limit process stack to 'size' kilobytes. By default, the whole address
        space is available for the stack, but it is subject to the *--mem* limit.


@@ -87,6 +92,10 @@ OPTIONS
        Redirect standard error output to 'file'. The 'file' has to be accessible
        inside the sandbox.
 
        Redirect standard error output to 'file'. The 'file' has to be accessible
        inside the sandbox.
 

+*-c, --chdir=*'dir'::
+       Change directory to 'dir' before executing the program. This path must be
+       relative to the root of the sandbox.
+

 *-p, --processes*[*=*'max']::
        Permit the program to create up to 'max' processes and/or threads. Please
        keep in mind that time and memory limit do not work with multiple processes
 *-p, --processes*[*=*'max']::
        Permit the program to create up to 'max' processes and/or threads. Please
        keep in mind that time and memory limit do not work with multiple processes


@@ -164,7 +173,7 @@ to constrain programs consisting of multiple processes. Please note
 that this feature needs special system setup described in the REQUIREMENTS
 section.
 
 that this feature needs special system setup described in the REQUIREMENTS
 section.
 

-*-c, --cg*::
+*--cg*::

        Enable use of control groups.
 
 *--cg-mem=*'size'::
        Enable use of control groups.
 
 *--cg-mem=*'size'::


@@ -217,7 +226,7 @@ When the program inside the sandbox finishes correctly, the sandbox returns 0.
 If it finishes incorrectly, it returns 1.
 All other return codes signal an internal error.
 
 If it finishes incorrectly, it returns 1.
 All other return codes signal an internal error.
 

-REQUIREMENTS
+INSTALLATION

 ------------
 Isolate depends on several advanced features of the Linux kernel. Please
 make sure that your kernel supports
 ------------
 Isolate depends on several advanced features of the Linux kernel. Please
 make sure that your kernel supports


@@ -229,6 +238,19 @@ the cpusets (+CONFIG_CPUSETS+),
 CPU accounting controller (+CONFIG_CGROUP_CPUACCT+), and
 memory resource controller (+CONFIG_CGROUP_MEM_RES_CTLR+).
 
 CPU accounting controller (+CONFIG_CGROUP_CPUACCT+), and
 memory resource controller (+CONFIG_CGROUP_MEM_RES_CTLR+).
 

+Isolate is designed to run setuid to root. The sub-process inside the sandbox
+then switches to a non-privileged user ID (different for each *--box-id*).
+The range of UIDs available and several filesystem paths are embedded in the
+isolate's binary during compilation; please see +default.cfg+ in the source
+tree for description.
+
+Before you run isolate with control groups, you have to mount the control group
+filesystem. Most modern Linux distributions use libcgroup, which mounts a tmpfs
+at /sys/fs/cgroup, with individual controllers mounted within subdirectories.
+It is recommended to use your distribution's cgroup configuration support.
+Debian-based distributions have a choice of the cgroup-lite or cgroup-bin
+packages; Red Hat-based distributions provide the libcgroup package.
+

 LICENSE
 -------
 Isolate was written by Martin Mares and Bernard Blackham.
 LICENSE
 -------
 Isolate was written by Martin Mares and Bernard Blackham.