From 8a1c0b97d737e70cd5729565cd788d91b29cd9e4 Mon Sep 17 00:00:00 2001 From: criyle Date: Wed, 12 Feb 2020 00:28:56 -0500 Subject: [PATCH] update README --- README.md | 57 +++++++++++++++++++++++++++++++++++++++++++++++-------- go.mod | 2 +- go.sum | 4 ++-- 3 files changed, 52 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 73c6824..ac78c58 100644 --- a/README.md +++ b/README.md @@ -2,13 +2,17 @@ [![GoDoc](https://godoc.org/github.com/criyle/go-sandbox?status.svg)](https://godoc.org/github.com/criyle/go-sandbox) -Original goal was to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/pkg/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace and cgroup. +Original goal was to replica [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/pkg/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace and cgroup. -## Install +The idea of rootfs and interval CPU usage checking comes from [syzoj/judge-v3](https://github.com/syzoj/judge-v3) and the pooled pre-forked container comes from [vijos/jd4](https://github.com/vijos/jd4). -- install go compiler: `apt install golang-go` -- install libseccomp-dev: `apt install libseccomp-dev` -- install: `go install github.com/criyle/go-sandbox/...` +Notice: Only works on Linux since ptrace, unshare, cgroup are available only on Linux + +## Build & Install + +- install latest go compiler from [golang/download](https://golang.org/dl/) +- install libseccomp library: (for Ubuntu) `apt install libseccomp-dev` +- build & install: `go install github.com/criyle/go-sandbox/...` ## Technologies @@ -39,7 +43,44 @@ Default file access syscall check: 2. Use Linux Control Groups to limit & acct CPU & memory (elimilate wait4.rusage) 3. Container tech with execveat memfd, sethostname, setdomainname -### pre-forked container +## Design (in progress) + +### Result Status + +- Normal (no error) +- Program Error + - Resource Limit Exceeded + - Time + - Memory + - Output + - Unauthorized Access + - Disallowed Syscall + - Runtime Error + - Signaled + - `SIGXCPU` / `SIGKILL` are treated as TimeLimitExceeded by rlimit or caller kill + - `SIGXFSZ` is treated as OutputLimitExceeded by rlimit + - `SIGSYS` is treaded as Disallowed Syscall by seccomp + - Potential Runtime error are: `SIGSEGV` (segment fault) + - Nonzero Exit Code +- Program Runner Error + +### Result Structure + +``` go +type Result struct { + Status // result status + ExitStatus int // exit status (signal number if signalled) + Error string // potential detailed error message (for program runner error) + + Time time.Duration // used user CPU time (underlying type int64 in ns) + Memory Size // used user memory (underlying type uint64 in bytes) + // metrics for the program runner + SetUpTime time.Duration + RunningTime time.Duration +} +``` + +### Pre-forked Container Protocol 1. Pre-fork container daemons to run programs inside 2. Unix socket to pass fd inside / outside @@ -89,7 +130,7 @@ Any socket related error will cause the daemon exit (with all process inside con - daemon: creates pre-forked container to run programs inside - runner: interface to run program - ptrace: wrapper to call forkexec and ptracer - - filehandler: an implementation of UOJ file set + - filehandler: an example implementation of UOJ file set - unshare: wrapper to call forkexec and unshared namespaces - ptracer: ptrace tracer and provides syscall trap filter context - types: provides general res / result data structures @@ -102,7 +143,7 @@ Any socket related error will cause the daemon exit (with all process inside con - config/config.go: all configs toward running specs (similar to UOJ) -## Benchmarks (docker desktop amd64 / native arm64) +## Benchmarks (MacOS docker amd64 / native arm64) - 1ms / 2ms: fork, unshare pid / user / cgroup - 4ms / 8ms: run inside pre-forked container diff --git a/go.mod b/go.mod index 200efba..acc55cb 100644 --- a/go.mod +++ b/go.mod @@ -4,5 +4,5 @@ go 1.13 require ( github.com/seccomp/libseccomp-golang v0.9.1 - golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c + golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 ) diff --git a/go.sum b/go.sum index f7d62ff..1cb83cb 100644 --- a/go.sum +++ b/go.sum @@ -1,4 +1,4 @@ github.com/seccomp/libseccomp-golang v0.9.1 h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo= github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo= -golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c h1:S/FtSvpNLtFBgjTqcKsRpsa6aVsI6iztaz1bQd9BJwE= -golang.org/x/sys v0.0.0-20191029155521-f43be2a4598c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5 h1:LfCXLvNmTYH9kEmVgqbnsWfruoXZIrh4YBgqVHtDvw0= +golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=