mirror of
https://github.com/criyle/go-judge.git
synced 2025-11-04 14:50:02 +08:00
Add rlimit restriction
This commit is contained in:
parent
411d74a087
commit
b480bca277
@ -10,10 +10,13 @@ import (
|
|||||||
"github.com/criyle/go-judge/pkg/envexec"
|
"github.com/criyle/go-judge/pkg/envexec"
|
||||||
"github.com/criyle/go-judge/pkg/pool"
|
"github.com/criyle/go-judge/pkg/pool"
|
||||||
"github.com/criyle/go-sandbox/pkg/forkexec"
|
"github.com/criyle/go-sandbox/pkg/forkexec"
|
||||||
|
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||||
"github.com/criyle/go-sandbox/runner"
|
"github.com/criyle/go-sandbox/runner"
|
||||||
"golang.org/x/sys/unix"
|
"golang.org/x/sys/unix"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
const outputLimit = 256 << 20 // 256M
|
||||||
|
|
||||||
var _ pool.Environment = &environment{}
|
var _ pool.Environment = &environment{}
|
||||||
|
|
||||||
type environment struct {
|
type environment struct {
|
||||||
@ -23,11 +26,19 @@ type environment struct {
|
|||||||
}
|
}
|
||||||
|
|
||||||
func (e *environment) Execve(c context.Context, param envexec.ExecveParam) (envexec.Process, error) {
|
func (e *environment) Execve(c context.Context, param envexec.ExecveParam) (envexec.Process, error) {
|
||||||
|
rLimits := rlimit.RLimits{
|
||||||
|
CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1,
|
||||||
|
Data: param.Limit.Memory.Byte(),
|
||||||
|
FileSize: outputLimit,
|
||||||
|
Stack: param.Limit.Stack.Byte(),
|
||||||
|
}
|
||||||
|
|
||||||
ch := &forkexec.Runner{
|
ch := &forkexec.Runner{
|
||||||
Args: param.Args,
|
Args: param.Args,
|
||||||
Env: param.Env,
|
Env: param.Env,
|
||||||
Files: param.Files,
|
Files: param.Files,
|
||||||
WorkDir: e.wdPath,
|
WorkDir: e.wdPath,
|
||||||
|
RLimits: rLimits.PrepareRLimit(),
|
||||||
SandboxProfile: e.profile,
|
SandboxProfile: e.profile,
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@ -5,11 +5,15 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"os"
|
"os"
|
||||||
"syscall"
|
"syscall"
|
||||||
|
"time"
|
||||||
|
|
||||||
"github.com/criyle/go-judge/pkg/envexec"
|
"github.com/criyle/go-judge/pkg/envexec"
|
||||||
"github.com/criyle/go-sandbox/container"
|
"github.com/criyle/go-sandbox/container"
|
||||||
|
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
const outputLimit = 256 << 20 // 256M
|
||||||
|
|
||||||
var _ envexec.Environment = &environ{}
|
var _ envexec.Environment = &environ{}
|
||||||
|
|
||||||
// environ defines interface to access container resources
|
// environ defines interface to access container resources
|
||||||
@ -37,11 +41,19 @@ func (c *environ) Execve(ctx context.Context, param envexec.ExecveParam) (envexe
|
|||||||
cg.SetMemoryLimit(param.Limit.Memory)
|
cg.SetMemoryLimit(param.Limit.Memory)
|
||||||
cg.SetProcLimit(param.Limit.Proc)
|
cg.SetProcLimit(param.Limit.Proc)
|
||||||
|
|
||||||
|
rLimits := rlimit.RLimits{
|
||||||
|
CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1,
|
||||||
|
Data: param.Limit.Memory.Byte(),
|
||||||
|
FileSize: outputLimit,
|
||||||
|
Stack: param.Limit.Stack.Byte(),
|
||||||
|
}
|
||||||
|
|
||||||
p := container.ExecveParam{
|
p := container.ExecveParam{
|
||||||
Args: param.Args,
|
Args: param.Args,
|
||||||
Env: param.Env,
|
Env: param.Env,
|
||||||
Files: param.Files,
|
Files: param.Files,
|
||||||
ExecFile: param.ExecFile,
|
ExecFile: param.ExecFile,
|
||||||
|
RLimits: rLimits.PrepareRLimit(),
|
||||||
SyncFunc: cg.AddProc,
|
SyncFunc: cg.AddProc,
|
||||||
}
|
}
|
||||||
rt := c.Environment.Execve(ctx, p)
|
rt := c.Environment.Execve(ctx, p)
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user