From b480bca277f87e8d960adf78ba21e0f03bd6e329 Mon Sep 17 00:00:00 2001 From: criyle Date: Tue, 19 May 2020 16:51:13 -0400 Subject: [PATCH] Add rlimit restriction --- pkg/macsandbox/environment_darwin.go | 11 +++++++++++ pkg/pool/environment_linux.go | 12 ++++++++++++ 2 files changed, 23 insertions(+) diff --git a/pkg/macsandbox/environment_darwin.go b/pkg/macsandbox/environment_darwin.go index 24eeb04..17a2a72 100644 --- a/pkg/macsandbox/environment_darwin.go +++ b/pkg/macsandbox/environment_darwin.go @@ -10,10 +10,13 @@ import ( "github.com/criyle/go-judge/pkg/envexec" "github.com/criyle/go-judge/pkg/pool" "github.com/criyle/go-sandbox/pkg/forkexec" + "github.com/criyle/go-sandbox/pkg/rlimit" "github.com/criyle/go-sandbox/runner" "golang.org/x/sys/unix" ) +const outputLimit = 256 << 20 // 256M + var _ pool.Environment = &environment{} type environment struct { @@ -23,11 +26,19 @@ type environment struct { } func (e *environment) Execve(c context.Context, param envexec.ExecveParam) (envexec.Process, error) { + rLimits := rlimit.RLimits{ + CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1, + Data: param.Limit.Memory.Byte(), + FileSize: outputLimit, + Stack: param.Limit.Stack.Byte(), + } + ch := &forkexec.Runner{ Args: param.Args, Env: param.Env, Files: param.Files, WorkDir: e.wdPath, + RLimits: rLimits.PrepareRLimit(), SandboxProfile: e.profile, } diff --git a/pkg/pool/environment_linux.go b/pkg/pool/environment_linux.go index edc43e0..48751dd 100644 --- a/pkg/pool/environment_linux.go +++ b/pkg/pool/environment_linux.go @@ -5,11 +5,15 @@ import ( "fmt" "os" "syscall" + "time" "github.com/criyle/go-judge/pkg/envexec" "github.com/criyle/go-sandbox/container" + "github.com/criyle/go-sandbox/pkg/rlimit" ) +const outputLimit = 256 << 20 // 256M + var _ envexec.Environment = &environ{} // environ defines interface to access container resources @@ -37,11 +41,19 @@ func (c *environ) Execve(ctx context.Context, param envexec.ExecveParam) (envexe cg.SetMemoryLimit(param.Limit.Memory) cg.SetProcLimit(param.Limit.Proc) + rLimits := rlimit.RLimits{ + CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1, + Data: param.Limit.Memory.Byte(), + FileSize: outputLimit, + Stack: param.Limit.Stack.Byte(), + } + p := container.ExecveParam{ Args: param.Args, Env: param.Env, Files: param.Files, ExecFile: param.ExecFile, + RLimits: rLimits.PrepareRLimit(), SyncFunc: cg.AddProc, } rt := c.Environment.Execve(ctx, p)