mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
fix: allow more essential syscalls
This commit is contained in:
parent
d58b2485a2
commit
369229e0d5
@ -2,5 +2,6 @@ FROM golang
|
|||||||
|
|
||||||
COPY . /app
|
COPY . /app
|
||||||
WORKDIR /app/cmd/runprog
|
WORKDIR /app/cmd/runprog
|
||||||
|
RUN apt update && apt install -y gcc libstdc++6 libseccomp-dev
|
||||||
|
|
||||||
RUN go build
|
RUN go build
|
||||||
|
|||||||
@ -16,6 +16,10 @@ var (
|
|||||||
"/dev/urandom",
|
"/dev/urandom",
|
||||||
"/proc/meminfo",
|
"/proc/meminfo",
|
||||||
"/etc/localtime",
|
"/etc/localtime",
|
||||||
|
"/usr/lib/libstdc++.so.6",
|
||||||
|
"/usr/lib/libc.so.6",
|
||||||
|
"/usr/lib/libm.so.6",
|
||||||
|
"/usr/lib/libgcc_s.so.1",
|
||||||
}
|
}
|
||||||
|
|
||||||
// default write permission files
|
// default write permission files
|
||||||
@ -75,6 +79,17 @@ var (
|
|||||||
"clock_gettime",
|
"clock_gettime",
|
||||||
|
|
||||||
"restart_syscall",
|
"restart_syscall",
|
||||||
|
|
||||||
|
|
||||||
|
"futex",
|
||||||
|
"gettid",
|
||||||
|
"getpid",
|
||||||
|
"prlimit64",
|
||||||
|
"getrandom",
|
||||||
|
"set_tid_address",
|
||||||
|
"set_robust_list",
|
||||||
|
"rseq",
|
||||||
|
"newfstatat",
|
||||||
}
|
}
|
||||||
|
|
||||||
// default syscalls to trace
|
// default syscalls to trace
|
||||||
@ -108,71 +123,11 @@ var (
|
|||||||
// config for different type of program
|
// config for different type of program
|
||||||
// workpath and arg0 have additional read / stat permission
|
// workpath and arg0 have additional read / stat permission
|
||||||
runptraceConfig = map[string]ProgramConfig{
|
runptraceConfig = map[string]ProgramConfig{
|
||||||
"python2.7": {
|
|
||||||
Syscall: SyscallConfig{
|
|
||||||
ExtraAllow: []string{
|
|
||||||
"futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo",
|
|
||||||
},
|
|
||||||
ExtraCount: map[string]int{
|
|
||||||
"set_tid_address": 1,
|
|
||||||
"set_robust_list": 1,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
FileAccess: FileAccessConfig{
|
|
||||||
ExtraRead: []string{
|
|
||||||
"/usr/bin/python2.7",
|
|
||||||
"/usr/lib/python2.7/",
|
|
||||||
"/usr/bin/lib/python2.7/",
|
|
||||||
"/usr/local/lib/python2.7/",
|
|
||||||
"/usr/lib/pymodules/python2.7/",
|
|
||||||
"/usr/bin/Modules/",
|
|
||||||
"/usr/bin/pybuilddir.txt",
|
|
||||||
"/usr/lib/locale/",
|
|
||||||
"./answer.code",
|
|
||||||
},
|
|
||||||
ExtraStat: []string{
|
|
||||||
"/usr", "/usr/bin",
|
|
||||||
},
|
|
||||||
},
|
|
||||||
RunCommand: []string{"/usr/bin/python2.7", "-E", "-s", "-B"},
|
|
||||||
},
|
|
||||||
"python3": {
|
|
||||||
Syscall: SyscallConfig{
|
|
||||||
ExtraAllow: []string{
|
|
||||||
"futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo", "getrandom",
|
|
||||||
},
|
|
||||||
ExtraCount: map[string]int{
|
|
||||||
"set_tid_address": 1,
|
|
||||||
"set_robust_list": 1,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
FileAccess: FileAccessConfig{
|
|
||||||
ExtraRead: []string{
|
|
||||||
"/usr/bin/python3",
|
|
||||||
"/usr/lib/python3/",
|
|
||||||
"/usr/bin/python3.6",
|
|
||||||
"/usr/lib/python3.6/",
|
|
||||||
"/usr/bin/lib/python3.6/",
|
|
||||||
"/usr/local/lib/python3.6/",
|
|
||||||
"/usr/bin/pyvenv.cfg",
|
|
||||||
"/usr/pyvenv.cfg",
|
|
||||||
"/usr/bin/Modules",
|
|
||||||
"/usr/bin/pybuilddir.txt",
|
|
||||||
"/usr/lib/dist-python",
|
|
||||||
"/usr/lib/locale/",
|
|
||||||
"./answer.code",
|
|
||||||
},
|
|
||||||
ExtraStat: []string{
|
|
||||||
"/usr", "/usr/bin", "/usr/lib", "/usr/lib/python36.zip",
|
|
||||||
},
|
|
||||||
},
|
|
||||||
RunCommand: []string{"/usr/bin/python3", "-I", "-B"},
|
|
||||||
},
|
|
||||||
"compiler": {
|
"compiler": {
|
||||||
Syscall: SyscallConfig{
|
Syscall: SyscallConfig{
|
||||||
ExtraAllow: []string{
|
ExtraAllow: []string{
|
||||||
"gettid", "set_tid_address", "set_robust_list", "futex",
|
"set_tid_address", "set_robust_list", "futex",
|
||||||
"getpid", "vfork", "fork", "clone", "execve", "wait4",
|
"vfork", "fork", "clone", "execve", "wait4",
|
||||||
"clock_gettime", "clock_getres",
|
"clock_gettime", "clock_getres",
|
||||||
"setrlimit", "pipe",
|
"setrlimit", "pipe",
|
||||||
"getdents64", "getdents",
|
"getdents64", "getdents",
|
||||||
|
|||||||
@ -1,10 +1,10 @@
|
|||||||
all: helloworld/main.test nonzeroexit/main.test
|
all: helloworld/main.test nonzeroexit/main.test
|
||||||
|
|
||||||
helloworld/main.test: helloworld/main.cpp
|
helloworld/main.test: helloworld/main.cpp
|
||||||
g++ helloworld/main.cpp -o helloworld/main.test
|
g++ helloworld/main.cpp -o helloworld/main.test -DNDEBUG -O3
|
||||||
|
|
||||||
nonzeroexit/main.test: nonzeroexit/main.cpp
|
nonzeroexit/main.test: nonzeroexit/main.cpp
|
||||||
g++ nonzeroexit/main.cpp -o nonzeroexit/main.test
|
g++ nonzeroexit/main.cpp -o nonzeroexit/main.test -DNDEBUG -O3
|
||||||
|
|
||||||
clean:
|
clean:
|
||||||
rm -rf helloworld/*.test nonzeroexit/*.test
|
rm -rf helloworld/*.test nonzeroexit/*.test
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user