change package naming

This commit is contained in:
criyle 2019-08-29 00:27:49 -07:00
parent 1ccd9f13f8
commit ebab7514d1
33 changed files with 41 additions and 38 deletions

View File

@ -1,6 +1,6 @@
# go-sandbox
Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace & cgroup.
Original goal is to reimplement [uoj-judger/run_program](https://github.com/vfleaking/uoj) in GO language using [libseccomp](https://github.com/pkg/seccomp/libseccomp-golang). As technology grows, it also implements new technologies including Linux namespace & cgroup.
## Install
@ -42,21 +42,24 @@ Default file access syscall check:
1. Pre-fork container deamons to run programs inside
2. Unix socket to pass fd inside / outside
## Packages
## Packages (/pkg)
- seccomp: provides utility function that wrappers libseccomp
- forkexec: fork-exec provides mount, unshare, ptrace, seccomp, capset before exec
- memfd: read regular file and creates a seaed memfd for its contents
- unixsocket: send / recv oob msg from a unix socket
- cgroup: creates cgroup directories and collects resource usage / limits
- deamon: creates pre-forked container to run programs inside
- mount: provides utility function that wrappers mount syscall
- rlimit: provides utility function that defines rlimit syscall
## Packages
- tracer: ptrace tracer and provides syscall trap filter context
- deamon: creates pre-forked container to run programs inside
- runprogram: wrapper to call forkexec and trecer
- rununshared: wrapper to call forkexec and unshared namespaces
- runconfig: defines arch & language specified trace condition for seccomp and ptrace
- types: general runtime specs
- mount: provides utility function that wrappers mount syscall
- rlimit: provides utility function that defines rlimit syscall
- specs: provides general res / result data structures
## Executable
@ -84,7 +87,7 @@ Pre-forked container also saves time for container creation / cleanup.
$ go test -bench . -benchtime 10s
goos: linux
goarch: amd64
pkg: github.com/criyle/go-sandbox/forkexec
pkg: github.com/criyle/go-sandbox/pkg/forkexec
BenchmarkSimpleFork-4 10000 1106064 ns/op
BenchmarkUnsharePid-4 10000 1367824 ns/op
BenchmarkUnshareUser-4 10000 1311523 ns/op
@ -97,7 +100,7 @@ BenchmarkFastUnshareMountPivot-4 100 114364585 ns/op
BenchmarkUnshareAll-4 100 851014031 ns/op
BenchmarkUnshareMountPivot-4 20 901204445 ns/op
PASS
ok github.com/criyle/go-sandbox/forkexec 262.112s
ok github.com/criyle/go-sandbox/pkg/forkexec 262.112s
```
## TODO

View File

@ -8,13 +8,13 @@ import (
"os/signal"
"time"
"github.com/criyle/go-sandbox/cgroup"
"github.com/criyle/go-sandbox/deamon"
"github.com/criyle/go-sandbox/memfd"
"github.com/criyle/go-sandbox/pkg/cgroup"
"github.com/criyle/go-sandbox/pkg/memfd"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/runconfig"
"github.com/criyle/go-sandbox/runprogram"
"github.com/criyle/go-sandbox/rununshared"
"github.com/criyle/go-sandbox/types/rlimit"
"github.com/criyle/go-sandbox/types/specs"
)

View File

@ -8,9 +8,9 @@ import (
"os"
"syscall"
"github.com/criyle/go-sandbox/forkexec"
"github.com/criyle/go-sandbox/pkg/forkexec"
"github.com/criyle/go-sandbox/pkg/unixsocket"
"github.com/criyle/go-sandbox/types/specs"
"github.com/criyle/go-sandbox/unixsocket"
)
// ContainerInit is called for container init process

View File

@ -34,7 +34,7 @@ Any socket related error will cause the deamon exit (with all process inside con
*/
import (
"github.com/criyle/go-sandbox/types/rlimit"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/types/specs"
)

View File

@ -3,7 +3,7 @@ package deamon
import (
"os"
"github.com/criyle/go-sandbox/types/mount"
"github.com/criyle/go-sandbox/pkg/mount"
"golang.org/x/sys/unix"
)

View File

@ -4,9 +4,9 @@ import (
"fmt"
"os"
"github.com/criyle/go-sandbox/forkexec"
"github.com/criyle/go-sandbox/memfd"
"github.com/criyle/go-sandbox/unixsocket"
"github.com/criyle/go-sandbox/pkg/forkexec"
"github.com/criyle/go-sandbox/pkg/memfd"
"github.com/criyle/go-sandbox/pkg/unixsocket"
"golang.org/x/sys/unix"
)

View File

@ -6,7 +6,7 @@ import (
"fmt"
"os"
"github.com/criyle/go-sandbox/unixsocket"
"github.com/criyle/go-sandbox/pkg/unixsocket"
)
// Ping send ping message to container

View File

@ -3,9 +3,9 @@ package deamon
import (
"fmt"
"github.com/criyle/go-sandbox/types/rlimit"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/types/specs"
"github.com/criyle/go-sandbox/unixsocket"
"github.com/criyle/go-sandbox/pkg/unixsocket"
)
// ExecveParam is parameters to run process inside container

2
go.mod
View File

@ -4,5 +4,5 @@ go 1.12
require (
github.com/seccomp/libseccomp-golang v0.9.1
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456
)

4
go.sum
View File

@ -1,4 +1,4 @@
github.com/seccomp/libseccomp-golang v0.9.1 h1:NJjM5DNFOs0s3kYE1WUOr6G8V97sdt46rlXTMfXGWBo=
github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a h1:aYOabOQFp6Vj6W1F80affTUvO9UxmJRx8K0gsfABByQ=
golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456 h1:ng0gs1AKnRRuEMZoTLLlbOd+C17zUDepwGQBb/n+JVg=
golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

View File

@ -2,6 +2,6 @@ package cgroup
const (
// systemd mounted cgroups
basePath = "/sys/fs/cgroup"
basePath = "/sys/fs/pkg/cgroup"
cgroupProcs = "cgroup.procs"
)

View File

@ -6,7 +6,7 @@ import (
"syscall"
"testing"
"github.com/criyle/go-sandbox/types/mount"
"github.com/criyle/go-sandbox/pkg/mount"
"golang.org/x/sys/unix"
)

View File

@ -3,7 +3,7 @@ package forkexec
import (
"syscall"
"github.com/criyle/go-sandbox/types/mount"
"github.com/criyle/go-sandbox/pkg/mount"
)
// prepareExec prepares execve parameters

View File

@ -5,8 +5,8 @@ package forkexec
import (
"syscall"
"github.com/criyle/go-sandbox/types/mount"
"github.com/criyle/go-sandbox/types/rlimit"
"github.com/criyle/go-sandbox/pkg/mount"
"github.com/criyle/go-sandbox/pkg/rlimit"
)
// Runner is the RunProgramConfig including the exec path, argv

View File

@ -3,7 +3,7 @@ package seccomp
import (
"testing"
libseccomp "github.com/seccomp/libseccomp-golang"
libseccomp "github.com/pkg/seccomp/libseccomp-golang"
)
var (

View File

@ -3,7 +3,7 @@ package runprogram
import (
"syscall"
"github.com/criyle/go-sandbox/types/rlimit"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/types/specs"
)

View File

@ -3,8 +3,8 @@ package runprogram
import (
libseccomp "github.com/seccomp/libseccomp-golang"
"github.com/criyle/go-sandbox/forkexec"
"github.com/criyle/go-sandbox/seccomp"
"github.com/criyle/go-sandbox/pkg/forkexec"
"github.com/criyle/go-sandbox/pkg/seccomp"
"github.com/criyle/go-sandbox/tracer"
"github.com/criyle/go-sandbox/types/specs"
)

View File

@ -3,7 +3,7 @@ package rununshared
import (
"os"
"github.com/criyle/go-sandbox/types/mount"
"github.com/criyle/go-sandbox/pkg/mount"
"golang.org/x/sys/unix"
)

View File

@ -5,8 +5,8 @@ import (
"os"
"time"
"github.com/criyle/go-sandbox/forkexec"
"github.com/criyle/go-sandbox/seccomp"
"github.com/criyle/go-sandbox/pkg/forkexec"
"github.com/criyle/go-sandbox/pkg/seccomp"
"github.com/criyle/go-sandbox/types/specs"
libseccomp "github.com/seccomp/libseccomp-golang"
"golang.org/x/sys/unix"

View File

@ -1,8 +1,8 @@
package rununshared
import (
"github.com/criyle/go-sandbox/types/mount"
"github.com/criyle/go-sandbox/types/rlimit"
"github.com/criyle/go-sandbox/pkg/mount"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/types/specs"
)

View File

@ -268,7 +268,7 @@ func handleTrap(handler Handler, pid int) error {
switch act {
case TraceBan:
// Set the syscallno to -1 and return value into register to skip syscall.
// https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
// https://www.kernel.org/doc/Documentation/prctl/pkg/seccomp_filter.txt
return ctx.skipSyscall()
case TraceKill: