mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-09-26 23:19:11 +08:00
change package naming
This commit is contained in:
parent
1ccd9f13f8
commit
ebab7514d1
17
README.md
17
README.md
@ -1,6 +1,6 @@
|
||||
# go-sandbox
|
||||
|
||||
Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace & cgroup.
|
||||
Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/pkg/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace & cgroup.
|
||||
|
||||
## Install
|
||||
|
||||
@ -42,21 +42,24 @@ Default file access syscall check:
|
||||
1. Pre-fork container deamons to run programs inside
|
||||
2. Unix socket to pass fd inside / outside
|
||||
|
||||
## Packages
|
||||
## Packages (/pkg)
|
||||
|
||||
- seccomp: provides utility function that wrappers libseccomp
|
||||
- forkexec: fork-exec provides mount, unshare, ptrace, seccomp, capset before exec
|
||||
- memfd: read regular file and creates a seaed memfd for its contents
|
||||
- unixsocket: send / recv oob msg from a unix socket
|
||||
- cgroup: creates cgroup directories and collects resource usage / limits
|
||||
- deamon: creates pre-forked container to run programs inside
|
||||
- mount: provides utility function that wrappers mount syscall
|
||||
- rlimit: provides utility function that defines rlimit syscall
|
||||
|
||||
## Packages
|
||||
|
||||
- tracer: ptrace tracer and provides syscall trap filter context
|
||||
- deamon: creates pre-forked container to run programs inside
|
||||
- runprogram: wrapper to call forkexec and trecer
|
||||
- rununshared: wrapper to call forkexec and unshared namespaces
|
||||
- runconfig: defines arch & language specified trace condition for seccomp and ptrace
|
||||
- types: general runtime specs
|
||||
- mount: provides utility function that wrappers mount syscall
|
||||
- rlimit: provides utility function that defines rlimit syscall
|
||||
- specs: provides general res / result data structures
|
||||
|
||||
## Executable
|
||||
@ -84,7 +87,7 @@ Pre-forked container also saves time for container creation / cleanup.
|
||||
$ go test -bench . -benchtime 10s
|
||||
goos: linux
|
||||
goarch: amd64
|
||||
pkg: github.com/criyle/go-sandbox/forkexec
|
||||
pkg: github.com/criyle/go-sandbox/pkg/forkexec
|
||||
BenchmarkSimpleFork-4 10000 1106064 ns/op
|
||||
BenchmarkUnsharePid-4 10000 1367824 ns/op
|
||||
BenchmarkUnshareUser-4 10000 1311523 ns/op
|
||||
@ -97,7 +100,7 @@ BenchmarkFastUnshareMountPivot-4 100 114364585 ns/op
|
||||
BenchmarkUnshareAll-4 100 851014031 ns/op
|
||||
BenchmarkUnshareMountPivot-4 20 901204445 ns/op
|
||||
PASS
|
||||
ok github.com/criyle/go-sandbox/forkexec 262.112s
|
||||
ok github.com/criyle/go-sandbox/pkg/forkexec 262.112s
|
||||
```
|
||||
|
||||
## TODO
|
||||
|
@ -8,13 +8,13 @@ import (
|
||||
"os/signal"
|
||||
"time"
|
||||
|
||||
"github.com/criyle/go-sandbox/cgroup"
|
||||
"github.com/criyle/go-sandbox/deamon"
|
||||
"github.com/criyle/go-sandbox/memfd"
|
||||
"github.com/criyle/go-sandbox/pkg/cgroup"
|
||||
"github.com/criyle/go-sandbox/pkg/memfd"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/runconfig"
|
||||
"github.com/criyle/go-sandbox/runprogram"
|
||||
"github.com/criyle/go-sandbox/rununshared"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
|
@ -8,9 +8,9 @@ import (
|
||||
"os"
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/pkg/forkexec"
|
||||
"github.com/criyle/go-sandbox/pkg/unixsocket"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
)
|
||||
|
||||
// ContainerInit is called for container init process
|
||||
|
@ -34,7 +34,7 @@ Any socket related error will cause the deamon exit (with all process inside con
|
||||
*/
|
||||
|
||||
import (
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
|
@ -3,7 +3,7 @@ package deamon
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
@ -4,9 +4,9 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/memfd"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
"github.com/criyle/go-sandbox/pkg/forkexec"
|
||||
"github.com/criyle/go-sandbox/pkg/memfd"
|
||||
"github.com/criyle/go-sandbox/pkg/unixsocket"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
@ -6,7 +6,7 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
"github.com/criyle/go-sandbox/pkg/unixsocket"
|
||||
)
|
||||
|
||||
// Ping send ping message to container
|
||||
|
@ -3,9 +3,9 @@ package deamon
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
"github.com/criyle/go-sandbox/unixsocket"
|
||||
"github.com/criyle/go-sandbox/pkg/unixsocket"
|
||||
)
|
||||
|
||||
// ExecveParam is parameters to run process inside container
|
||||
|
2
go.mod
2
go.mod
@ -4,5 +4,5 @@ go 1.12
|
||||
|
||||
require (
|
||||
github.com/seccomp/libseccomp-golang v0.9.1
|
||||
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a
|
||||
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456
|
||||
)
|
||||
|
4
go.sum
4
go.sum
@ -1,4 +1,4 @@
|
||||
github.com/seccomp/libseccomp-golang v0.9.1 h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo=
|
||||
github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
|
||||
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a h1:aYOabOQFp6Vj6W1F80affTUvO9UxmJRx8K0gsfABByQ=
|
||||
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456 h1:ng0gs1AKnRRuEMZoTLLlbOd+C17zUDepwGQBb/n+JVg=
|
||||
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
|
@ -2,6 +2,6 @@ package cgroup
|
||||
|
||||
const (
|
||||
// systemd mounted cgroups
|
||||
basePath = "/sys/fs/cgroup"
|
||||
basePath = "/sys/fs/pkg/cgroup"
|
||||
cgroupProcs = "cgroup.procs"
|
||||
)
|
@ -6,7 +6,7 @@ import (
|
||||
"syscall"
|
||||
"testing"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
@ -3,7 +3,7 @@ package forkexec
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
)
|
||||
|
||||
// prepareExec prepares execve parameters
|
@ -5,8 +5,8 @@ package forkexec
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
)
|
||||
|
||||
// Runner is the RunProgramConfig including the exec path, argv
|
@ -3,7 +3,7 @@ package seccomp
|
||||
import (
|
||||
"testing"
|
||||
|
||||
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||
libseccomp "github.com/pkg/seccomp/libseccomp-golang"
|
||||
)
|
||||
|
||||
var (
|
@ -3,7 +3,7 @@ package runprogram
|
||||
import (
|
||||
"syscall"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
|
@ -3,8 +3,8 @@ package runprogram
|
||||
import (
|
||||
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/seccomp"
|
||||
"github.com/criyle/go-sandbox/pkg/forkexec"
|
||||
"github.com/criyle/go-sandbox/pkg/seccomp"
|
||||
"github.com/criyle/go-sandbox/tracer"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
@ -3,7 +3,7 @@ package rununshared
|
||||
import (
|
||||
"os"
|
||||
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
"golang.org/x/sys/unix"
|
||||
)
|
||||
|
||||
|
@ -5,8 +5,8 @@ import (
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"github.com/criyle/go-sandbox/forkexec"
|
||||
"github.com/criyle/go-sandbox/seccomp"
|
||||
"github.com/criyle/go-sandbox/pkg/forkexec"
|
||||
"github.com/criyle/go-sandbox/pkg/seccomp"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
libseccomp "github.com/seccomp/libseccomp-golang"
|
||||
"golang.org/x/sys/unix"
|
||||
|
@ -1,8 +1,8 @@
|
||||
package rununshared
|
||||
|
||||
import (
|
||||
"github.com/criyle/go-sandbox/types/mount"
|
||||
"github.com/criyle/go-sandbox/types/rlimit"
|
||||
"github.com/criyle/go-sandbox/pkg/mount"
|
||||
"github.com/criyle/go-sandbox/pkg/rlimit"
|
||||
"github.com/criyle/go-sandbox/types/specs"
|
||||
)
|
||||
|
||||
|
@ -268,7 +268,7 @@ func handleTrap(handler Handler, pid int) error {
|
||||
switch act {
|
||||
case TraceBan:
|
||||
// Set the syscallno to -1 and return value into register to skip syscall.
|
||||
// https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
|
||||
// https://www.kernel.org/doc/Documentation/prctl/pkg/seccomp_filter.txt
|
||||
return ctx.skipSyscall()
|
||||
|
||||
case TraceKill:
|
||||
|
Loading…
Reference in New Issue
Block a user