MO-P: Contestants can have multiple first names

[moe.git] / isolate / isolate.1.txt

diff --git a/isolate/isolate.1.txt b/isolate/isolate.1.txt
index 0e7952a31a61771886ce52e44093006fb9266985..8fd8f24cd2164b873c446d85ce834300f72efcff 100644 (file)
--- a/isolate/isolate.1.txt
+++ b/isolate/isolate.1.txt
@@ -67,6 +67,11 @@ OPTIONS
        is reported, even though it slightly exceeds the limit. Fractional
        numbers are again allowed.
 
+*-b, --box-id=*'id'::
+       When you run multiple sandboxes in parallel, you have to assign each unique
+       IDs to them by this option. See the discussion on UIDs in the INSTALLATION
+       section. The ID defaults to 0.
+
 *-k, --stack=*'size'::
        Limit process stack to 'size' kilobytes. By default, the whole address
        space is available for the stack, but it is subject to the *--mem* limit.
@@ -87,6 +92,10 @@ OPTIONS
        Redirect standard error output to 'file'. The 'file' has to be accessible
        inside the sandbox.
 
+*-c, --chdir=*'dir'::
+       Change directory to 'dir' before executing the program. This path must be
+       relative to the root of the sandbox.
+
 *-p, --processes*[*=*'max']::
        Permit the program to create up to 'max' processes and/or threads. Please
        keep in mind that time and memory limit do not work with multiple processes
@@ -164,7 +173,7 @@ to constrain programs consisting of multiple processes. Please note
 that this feature needs special system setup described in the REQUIREMENTS
 section.
 
-*-c, --cg*::
+*--cg*::
        Enable use of control groups.
 
 *--cg-mem=*'size'::
@@ -217,7 +226,7 @@ When the program inside the sandbox finishes correctly, the sandbox returns 0.
 If it finishes incorrectly, it returns 1.
 All other return codes signal an internal error.
 
-REQUIREMENTS
+INSTALLATION
 ------------
 Isolate depends on several advanced features of the Linux kernel. Please
 make sure that your kernel supports
@@ -229,6 +238,19 @@ the cpusets (+CONFIG_CPUSETS+),
 CPU accounting controller (+CONFIG_CGROUP_CPUACCT+), and
 memory resource controller (+CONFIG_CGROUP_MEM_RES_CTLR+).
 
+Isolate is designed to run setuid to root. The sub-process inside the sandbox
+then switches to a non-privileged user ID (different for each *--box-id*).
+The range of UIDs available and several filesystem paths are embedded in the
+isolate's binary during compilation; please see +default.cfg+ in the source
+tree for description.
+
+Before you run isolate with control groups, you have to mount the control group
+filesystem. Most modern Linux distributions use libcgroup, which mounts a tmpfs
+at /sys/fs/cgroup, with individual controllers mounted within subdirectories.
+It is recommended to use your distribution's cgroup configuration support.
+Debian-based distributions have a choice of the cgroup-lite or cgroup-bin
+packages; Red Hat-based distributions provide the libcgroup package.
+
 LICENSE
 -------
 Isolate was written by Martin Mares and Bernard Blackham.