nsjail

Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability Separately, for a merged upstream patch : up to $15,000 Google Patch Rewards pays on the Tier 1 row, where nsjail is a named Tier 1 project added in 7/2026 under 'Other essential libraries', for a patch you get accepted upstream and that stays merged, without reverts, for one month, not for the report. The Tier 1 column runs from a $500 published floor to $15,000 for a complicated, high-impact improvement that almost certainly prevents major vulnerabilities. A 2× memory-safety multiplier applies at Tier 1, 3× for core infrastructure data parsers, but it expires on 2026-12-31. The patch must be at least one month and under twelve months old, it is rate-limited to three submissions a person a month, the maintainers hold a veto, the panel may split the award with them, and sanctions and territory exclusions apply. Latest advisories Loading the feed Overview nsjail is Google's Linux process-isolation tool. It confines a program using namespaces, Kafel seccomp-bpf syscall policies, cgroup resource limits, capability dropping and chroot or pivot_root filesystem constraints, all driven from a protobuf configuration file. One of its four modes stands up a TCP server and forks a process per inbound connection, so nsjail is a standard way to expose untrusted code execution to the internet: CTF services, judge systems, build sandboxes. When it is doing its job it is the only thing between attacker-controlled code and the host, so a confinement failure is a full sandbox escape. Google added nsjail to Patch Rewards Tier 1 in July 2026. The project itself pays nothing for a report, so sorona.xyz pays you directly on a qualified, reproduced finding. In scope Reports go privately through the project's SECURITY.md and Google Bug Hunters, against upstream google/nsjail . The whole supervisor and the whole confinement mechanism are the target; a policy the operator deliberately loosened is not The complete namespace setup path across UTS, mount, PID, IPC, network, user, cgroup and time, including anything that leaves a namespace incompletely applied, escapable, or joinable from inside Kafel in full: the policy language, its compiler, and the seccomp-bpf syscall filter it installs, where a policy that does not enforce what its author believed is a silent hole in the sandbox Filesystem confinement as a whole: chroot() and pivot_root() handling, the mount plan, read-only and tmpfs mounts, and the custom /proc, where a mount-ordering or symlink defect reaches the host filesystem Capability handling through --cap and --keep_caps, together with the user-namespace UID and GID mapping that decides what the confined process is actually permitted to do The protobuf configuration parser (config.proto) and the command-line override path, the point at which an operator's intended policy becomes the enforced one All four execution modes, LISTEN mode included, which runs a TCP server and forks a process per connection so the supervisor itself is reachable from the network cgroup v1 and v2 resource governance across memory, PID, CPU and net_cls limits, where a bypass turns one confined process into a host-wide denial of service The supervisor process itself: argument handling, logging, file-descriptor and environment passing, and everything that runs before any confinement is established Out of scope Defects that actually live in the Linux kernel's namespace, seccomp or cgroup implementation: a kernel privilege escalation reached from inside a jail is a kernel bug rather than an nsjail bug Configurations the operator deliberately weakened: a policy that grants a capability, mounts a writable host path or permits a syscall is doing exactly what it was told Findings that belong to a separate upstream project nsjail depends on rather than to its own tree, since the Patch Rewards scope row covers this project by repository URL One-line fixes for non-exploitable crashes, which the Patch Rewards rules will not reward, and resource-exhaustion denial of service, which is excluded by name Patches the maintainers decline, patches under one month or over twelve months old, and anything past three submissions a person a month Most-valued findings A full sandbox escape: attacker-controlled code inside the jail reaching execution on the host. That is the one thing nsjail exists to prevent, code execution is 43% of the expected distribution here, and a whole-class fix for it is precisely what the top of the Tier 1 scale is priced for. A seccomp policy or Kafel compilation defect that lets a syscall through a filter the operator believed was blocking it, since the operator has no practical way to notice the gap Memory corruption in the supervisor process, especially on the LISTEN path where the supervisor handles input from network peers before any confinement is even established; memory safety is 24% here and carries the Tier 1 multiplier until it expires Namespace or mount-confinement failures that expose a host path, a host PID or the host network to the jailed process. Access control is 19% here, and this is the quiet way a sandbox stops being one Configuration-parsing bugs where the enforced policy ends up narrower or wider than the written one, because the whole security model rests on the config file meaning what it says Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Send a detailed, reproducible report with a working escape or bypass; a claim that a confinement 'looks weak' without a demonstration is not a finding Show the bug against upstream google/nsjail, and state the kernel version you reproduced on. Namespace and seccomp behaviour is kernel-dependent A policy the operator deliberately loosened is not a vulnerability; demonstrate the bypass against a configuration that was meant to hold Give the maintainers room to ship a fix before any public writeup The Google patch money is a separate pathway: you land the fix upstream yourself and keep it merged, without reverts, for one month. Tier 1 carries a 2× memory-safety multiplier, 3× for core infrastructure data parsers, but it expires on 2026-12-31 and the published ceiling is the un-multiplied number. Google cannot pay anyone on a sanctions list, in a sanctioned territory (Cuba, Iran, North Korea, Syria, Crimea, DNR and LNR), or located in Russia or Belarus, and the researcher bears the tax liability Disclosure Coordinated privately through the project's SECURITY.md and Google Bug Hunters. Hold the detail until a fix is out: nsjail is deployed as the last boundary in front of deliberately hostile code, so a public escape is immediately weaponisable against every service using it. Nothing in the Patch Rewards rules restricts who may help you prepare or route the report. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability