mirror of
https://github.com/criyle/go-judge.git
synced 2025-09-26 22:39:12 +08:00
50 lines
955 B
Go
50 lines
955 B
Go
//go:build seccomp
|
|
|
|
package env
|
|
|
|
import (
|
|
"os"
|
|
"syscall"
|
|
|
|
"github.com/elastic/go-seccomp-bpf"
|
|
"github.com/elastic/go-ucfg/yaml"
|
|
"golang.org/x/net/bpf"
|
|
)
|
|
|
|
func readSeccompConf(name string) ([]syscall.SockFilter, error) {
|
|
conf, err := yaml.NewConfigWithFile(name)
|
|
if err != nil {
|
|
if os.IsNotExist(err) {
|
|
return nil, nil
|
|
}
|
|
return nil, err
|
|
}
|
|
|
|
var policy seccomp.Policy
|
|
if err := conf.Unpack(&policy); err != nil {
|
|
return nil, err
|
|
}
|
|
inst, err := policy.Assemble()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
rawInst, err := bpf.Assemble(inst)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
return toSockFilter(rawInst), nil
|
|
}
|
|
|
|
func toSockFilter(raw []bpf.RawInstruction) []syscall.SockFilter {
|
|
filter := make([]syscall.SockFilter, 0, len(raw))
|
|
for _, instruction := range raw {
|
|
filter = append(filter, syscall.SockFilter{
|
|
Code: instruction.Op,
|
|
Jt: instruction.Jt,
|
|
Jf: instruction.Jf,
|
|
K: instruction.K,
|
|
})
|
|
}
|
|
return filter
|
|
}
|