mirror of
https://github.com/criyle/go-judge.git
synced 2025-09-26 22:39:12 +08:00
container: add ability to mask path
This commit is contained in:
parent
5a79fa24f7
commit
96ad6f979b
27
env/env_linux.go
vendored
27
env/env_linux.go
vendored
@ -31,8 +31,9 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
|
||||
c.Info("Created tmp dir for container root at:", root)
|
||||
|
||||
var (
|
||||
mb *mount.Builder
|
||||
sym []container.SymbolicLink
|
||||
mountBuilder *mount.Builder
|
||||
symbolicLinks []container.SymbolicLink
|
||||
maskPaths []string
|
||||
)
|
||||
mc, err := readMountConfig(c.MountConf)
|
||||
if err != nil {
|
||||
@ -40,23 +41,28 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
|
||||
return nil, err
|
||||
}
|
||||
c.Info("Mount.yaml(", c.MountConf, ") does not exists, use the default container mount")
|
||||
mb = getDefaultMount(c.TmpFsParam)
|
||||
mountBuilder = getDefaultMount(c.TmpFsParam)
|
||||
} else {
|
||||
mb, err = parseMountConfig(mc)
|
||||
mountBuilder, err = parseMountConfig(mc)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
if mc != nil && len(mc.SymLinks) > 0 {
|
||||
sym = make([]container.SymbolicLink, 0, len(mc.SymLinks))
|
||||
symbolicLinks = make([]container.SymbolicLink, 0, len(mc.SymLinks))
|
||||
for _, l := range mc.SymLinks {
|
||||
sym = append(sym, container.SymbolicLink{LinkPath: l.LinkPath, Target: l.Target})
|
||||
symbolicLinks = append(symbolicLinks, container.SymbolicLink{LinkPath: l.LinkPath, Target: l.Target})
|
||||
}
|
||||
} else {
|
||||
sym = defaultSymLinks
|
||||
symbolicLinks = defaultSymLinks
|
||||
}
|
||||
m := mb.FilterNotExist().Mounts
|
||||
c.Info("Created container mount at:", mb)
|
||||
if mc != nil && len(mc.MaskPaths) > 0 {
|
||||
maskPaths = mc.MaskPaths
|
||||
} else {
|
||||
maskPaths = defaultMaskPaths
|
||||
}
|
||||
m := mountBuilder.FilterNotExist().Mounts
|
||||
c.Info("Created container mount at:", mountBuilder)
|
||||
|
||||
seccomp, err := readSeccompConf(c.SeccompConf)
|
||||
if err != nil {
|
||||
@ -99,7 +105,8 @@ func NewBuilder(c Config) (pool.EnvBuilder, error) {
|
||||
b := &container.Builder{
|
||||
Root: root,
|
||||
Mounts: m,
|
||||
SymbolicLinks: sym,
|
||||
SymbolicLinks: symbolicLinks,
|
||||
MaskPaths: maskPaths,
|
||||
CredGenerator: credGen,
|
||||
Stderr: os.Stderr,
|
||||
CloneFlags: unshareFlags,
|
||||
|
31
env/mount_linux.go
vendored
31
env/mount_linux.go
vendored
@ -28,14 +28,15 @@ type Link struct {
|
||||
|
||||
// Mounts defines mount points for the container.
|
||||
type Mounts struct {
|
||||
Mount []Mount `yaml:"mount"`
|
||||
SymLinks []Link `yaml:"symLink"`
|
||||
WorkDir string `yaml:"workDir"`
|
||||
HostName string `yaml:"hostName"`
|
||||
DomainName string `yaml:"domainName"`
|
||||
UID int `yaml:"uid"`
|
||||
GID int `yaml:"gid"`
|
||||
Proc bool `yaml:"proc"`
|
||||
Mount []Mount `yaml:"mount"`
|
||||
SymLinks []Link `yaml:"symLink"`
|
||||
MaskPaths []string `yaml:"maskPath"`
|
||||
WorkDir string `yaml:"workDir"`
|
||||
HostName string `yaml:"hostName"`
|
||||
DomainName string `yaml:"domainName"`
|
||||
UID int `yaml:"uid"`
|
||||
GID int `yaml:"gid"`
|
||||
Proc bool `yaml:"proc"`
|
||||
}
|
||||
|
||||
func readMountConfig(p string) (*Mounts, error) {
|
||||
@ -121,3 +122,17 @@ var defaultSymLinks = []container.SymbolicLink{
|
||||
{LinkPath: "/dev/stdout", Target: "/proc/self/fd/1"},
|
||||
{LinkPath: "/dev/stderr", Target: "/proc/self/fd/2"},
|
||||
}
|
||||
|
||||
var defaultMaskPaths = []string{
|
||||
"/proc/acpi",
|
||||
"/proc/asound",
|
||||
"/proc/kcore",
|
||||
"/proc/keys",
|
||||
"/proc/latency_stats",
|
||||
"/proc/timer_list",
|
||||
"/proc/timer_stats",
|
||||
"/proc/sched_debug",
|
||||
"/proc/scsi",
|
||||
"/usr/lib/wsl/drivers",
|
||||
"/usr/lib/wsl/lib",
|
||||
}
|
||||
|
8
go.mod
8
go.mod
@ -4,12 +4,12 @@ go 1.17
|
||||
|
||||
require (
|
||||
github.com/creack/pty v1.1.17
|
||||
github.com/criyle/go-sandbox v0.8.10
|
||||
github.com/criyle/go-sandbox v0.8.11
|
||||
github.com/elastic/go-seccomp-bpf v1.2.0
|
||||
github.com/elastic/go-ucfg v0.8.4
|
||||
github.com/gin-contrib/pprof v1.3.0
|
||||
github.com/gin-contrib/zap v0.0.1
|
||||
github.com/gin-gonic/gin v1.7.4
|
||||
github.com/gin-gonic/gin v1.7.7
|
||||
github.com/golang/protobuf v1.5.2
|
||||
github.com/gorilla/websocket v1.4.2
|
||||
github.com/grpc-ecosystem/go-grpc-middleware v1.3.0
|
||||
@ -19,9 +19,9 @@ require (
|
||||
github.com/zsais/go-gin-prometheus v0.1.0
|
||||
go.uber.org/zap v1.19.1
|
||||
golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871
|
||||
golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4
|
||||
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9
|
||||
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
|
||||
golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1
|
||||
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881
|
||||
google.golang.org/grpc v1.42.0
|
||||
google.golang.org/protobuf v1.27.1
|
||||
gopkg.in/yaml.v2 v2.4.0
|
||||
|
16
go.sum
16
go.sum
@ -69,8 +69,8 @@ github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWH
|
||||
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
|
||||
github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI=
|
||||
github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
|
||||
github.com/criyle/go-sandbox v0.8.10 h1:iw5zI5YAEDlhBBDtJdiFoILMcuYQWnbj3CGA8ErWdVg=
|
||||
github.com/criyle/go-sandbox v0.8.10/go.mod h1:ficIk6tNwu96V8MdfJnGaM7GeXuU+PMILAkq7RPQPuQ=
|
||||
github.com/criyle/go-sandbox v0.8.11 h1:j37dLBCNRTCCBNPLerpOxgV1dFx4ioZdbFYArLghkas=
|
||||
github.com/criyle/go-sandbox v0.8.11/go.mod h1:Zo9IpOfqD5BpsZUcrGDjV7DedILcOkfcRL+diW9TYGo=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
|
||||
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
@ -99,8 +99,8 @@ github.com/gin-contrib/zap v0.0.1 h1:wsX/ahRftxPiXpiUw0YqyHj+TQTKtv+DAFWH84G1Uvg
|
||||
github.com/gin-contrib/zap v0.0.1/go.mod h1:vJJndZ8f44gsTHQrDPIB4YOZzwOwiEIdE0mMrZLOogk=
|
||||
github.com/gin-gonic/gin v1.5.0/go.mod h1:Nd6IXA8m5kNZdNEHMBd93KT+mdY3+bewLgRvmCsR2Do=
|
||||
github.com/gin-gonic/gin v1.6.2/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
|
||||
github.com/gin-gonic/gin v1.7.4 h1:QmUZXrvJ9qZ3GfWvQ+2wnW/1ePrTEJqPKMYEU3lD/DM=
|
||||
github.com/gin-gonic/gin v1.7.4/go.mod h1:jD2toBW3GZUr5UMcdrwQA10I7RuaFOl/SGeDjXkfUtY=
|
||||
github.com/gin-gonic/gin v1.7.7 h1:3DoBmSbJbZAWqXJC3SLjAPfutPJJRN1U5pALB7EeTTs=
|
||||
github.com/gin-gonic/gin v1.7.7/go.mod h1:axIBovoeJpVj8S3BwE0uPMTeReE4+AfFtqpqaZ1qq1U=
|
||||
github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
|
||||
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
|
||||
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
|
||||
@ -394,8 +394,8 @@ golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v
|
||||
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
|
||||
golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4 h1:DZshvxDdVoeKIbudAdFEKi+f70l51luSy/7b76ibTY0=
|
||||
golang.org/x/net v0.0.0-20211118161319-6a13c67c3ce4/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9 h1:0qxwC5n+ttVOINCBeRHO0nq9X7uy8SDsPoi5OaCdIEI=
|
||||
golang.org/x/net v0.0.0-20211123203042-d83791d6bcd9/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
|
||||
golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
|
||||
@ -460,8 +460,8 @@ golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBc
|
||||
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1 h1:kwrAHlwJ0DUBZwQ238v+Uod/3eZ8B2K5rYsUHBQvzmI=
|
||||
golang.org/x/sys v0.0.0-20211117180635-dee7805ff2e1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881 h1:TyHqChC80pFkXWraUUf6RuB5IqFdQieMLwwCJokV2pc=
|
||||
golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
|
||||
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
|
||||
|
13
mount.yaml
13
mount.yaml
@ -82,6 +82,19 @@ symLink:
|
||||
target: /proc/self/fd/1
|
||||
- linkPath: /dev/stderr
|
||||
target: /proc/self/fd/2
|
||||
# mask mounted paths with empty / null mount
|
||||
maskPath:
|
||||
- /proc/acpi
|
||||
- /proc/asound
|
||||
- /proc/kcore
|
||||
- /proc/keys
|
||||
- /proc/latency_stats
|
||||
- /proc/timer_list
|
||||
- /proc/timer_stats
|
||||
- /proc/sched_debug
|
||||
- /proc/scsi
|
||||
- /usr/lib/wsl/drivers
|
||||
- /usr/lib/wsl/lib
|
||||
# container work directory
|
||||
workDir: /w
|
||||
# container host name
|
||||
|
Loading…
Reference in New Issue
Block a user