Add rlimit restriction

This commit is contained in:
criyle 2020-05-19 16:51:13 -04:00
parent 411d74a087
commit b480bca277
2 changed files with 23 additions and 0 deletions

View File

@ -10,10 +10,13 @@ import (
"github.com/criyle/go-judge/pkg/envexec"
"github.com/criyle/go-judge/pkg/pool"
"github.com/criyle/go-sandbox/pkg/forkexec"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/runner"
"golang.org/x/sys/unix"
)
const outputLimit = 256 << 20 // 256M
var _ pool.Environment = &environment{}
type environment struct {
@ -23,11 +26,19 @@ type environment struct {
}
func (e *environment) Execve(c context.Context, param envexec.ExecveParam) (envexec.Process, error) {
rLimits := rlimit.RLimits{
CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1,
Data: param.Limit.Memory.Byte(),
FileSize: outputLimit,
Stack: param.Limit.Stack.Byte(),
}
ch := &forkexec.Runner{
Args: param.Args,
Env: param.Env,
Files: param.Files,
WorkDir: e.wdPath,
RLimits: rLimits.PrepareRLimit(),
SandboxProfile: e.profile,
}

View File

@ -5,11 +5,15 @@ import (
"fmt"
"os"
"syscall"
"time"
"github.com/criyle/go-judge/pkg/envexec"
"github.com/criyle/go-sandbox/container"
"github.com/criyle/go-sandbox/pkg/rlimit"
)
const outputLimit = 256 << 20 // 256M
var _ envexec.Environment = &environ{}
// environ defines interface to access container resources
@ -37,11 +41,19 @@ func (c *environ) Execve(ctx context.Context, param envexec.ExecveParam) (envexe
cg.SetMemoryLimit(param.Limit.Memory)
cg.SetProcLimit(param.Limit.Proc)
rLimits := rlimit.RLimits{
CPU: uint64(param.Limit.Time.Truncate(time.Second)/time.Second) + 1,
Data: param.Limit.Memory.Byte(),
FileSize: outputLimit,
Stack: param.Limit.Stack.Byte(),
}
p := container.ExecveParam{
Args: param.Args,
Env: param.Env,
Files: param.Files,
ExecFile: param.ExecFile,
RLimits: rLimits.PrepareRLimit(),
SyncFunc: cg.AddProc,
}
rt := c.Environment.Execve(ctx, p)