Add rlimit restriction

This commit is contained in:
criyle 2020-05-19 16:51:13 -04:00
parent 411d74a087
commit b480bca277
2 changed files with 23 additions and 0 deletions

View File

@ -10,10 +10,13 @@ import (
"github.com/criyle/go-judge/pkg/envexec" "github.com/criyle/go-judge/pkg/envexec"
"github.com/criyle/go-judge/pkg/pool" "github.com/criyle/go-judge/pkg/pool"
"github.com/criyle/go-sandbox/pkg/forkexec" "github.com/criyle/go-sandbox/pkg/forkexec"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/runner" "github.com/criyle/go-sandbox/runner"
"golang.org/x/sys/unix" "golang.org/x/sys/unix"
) )
const outputLimit = 256 << 20 // 256M
var _ pool.Environment = &environment{} var _ pool.Environment = &environment{}
type environment struct { type environment struct {
@ -23,11 +26,19 @@ type environment struct {
} }
func (e *environment) Execve(c context.Context, param envexec.ExecveParam) (envexec.Process, error) { func (e *environment) Execve(c context.Context, param envexec.ExecveParam) (envexec.Process, error) {
rLimits := rlimit.RLimits{
CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1,
Data: param.Limit.Memory.Byte(),
FileSize: outputLimit,
Stack: param.Limit.Stack.Byte(),
}
ch := &forkexec.Runner{ ch := &forkexec.Runner{
Args: param.Args, Args: param.Args,
Env: param.Env, Env: param.Env,
Files: param.Files, Files: param.Files,
WorkDir: e.wdPath, WorkDir: e.wdPath,
RLimits: rLimits.PrepareRLimit(),
SandboxProfile: e.profile, SandboxProfile: e.profile,
} }

View File

@ -5,11 +5,15 @@ import (
"fmt" "fmt"
"os" "os"
"syscall" "syscall"
"time"
"github.com/criyle/go-judge/pkg/envexec" "github.com/criyle/go-judge/pkg/envexec"
"github.com/criyle/go-sandbox/container" "github.com/criyle/go-sandbox/container"
"github.com/criyle/go-sandbox/pkg/rlimit"
) )
const outputLimit = 256 << 20 // 256M
var _ envexec.Environment = &environ{} var _ envexec.Environment = &environ{}
// environ defines interface to access container resources // environ defines interface to access container resources
@ -37,11 +41,19 @@ func (c *environ) Execve(ctx context.Context, param envexec.ExecveParam) (envexe
cg.SetMemoryLimit(param.Limit.Memory) cg.SetMemoryLimit(param.Limit.Memory)
cg.SetProcLimit(param.Limit.Proc) cg.SetProcLimit(param.Limit.Proc)
rLimits := rlimit.RLimits{
CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1,
Data: param.Limit.Memory.Byte(),
FileSize: outputLimit,
Stack: param.Limit.Stack.Byte(),
}
p := container.ExecveParam{ p := container.ExecveParam{
Args: param.Args, Args: param.Args,
Env: param.Env, Env: param.Env,
Files: param.Files, Files: param.Files,
ExecFile: param.ExecFile, ExecFile: param.ExecFile,
RLimits: rLimits.PrepareRLimit(),
SyncFunc: cg.AddProc, SyncFunc: cg.AddProc,
} }
rt := c.Environment.Execve(ctx, p) rt := c.Environment.Execve(ctx, p)