Compare commits

...

7 Commits

Author SHA1 Message Date
Gorgeous-Patrick
a6205a428c
Merge 369229e0d5 into 1e890d6475 2025-04-24 08:04:39 +00:00
criyle
1e890d6475 container: skip waitAll 2025-04-03 23:21:14 +00:00
criyle
ea0b084794 runprog: ensure alway re-evaluate
related #14
2025-03-14 02:45:32 -04:00
criyle
98f24cf60a runprog: re-evaluate status after retrieve cgroup measurement
related #14
2025-03-14 02:41:55 -04:00
Patrick Li
369229e0d5 fix: allow more essential syscalls 2024-12-05 18:36:33 -05:00
Gorgeous-Patrick
d58b2485a2 test: makefile for test 2024-12-05 14:56:57 -05:00
Gorgeous-Patrick
6407c89d90 DOCKER NOT WORKING 2024-12-05 14:47:05 -05:00
11 changed files with 80 additions and 79 deletions

3
.gitignore vendored
View File

@ -2,7 +2,6 @@
.DS_Store
# Test Env
test*/
env*.sh
# Test Files
@ -10,3 +9,5 @@ env*.sh
/test
.vscode
runprog
*.test

7
Dockerfile Normal file
View File

@ -0,0 +1,7 @@
FROM golang
COPY . /app
WORKDIR /app/cmd/runprog
RUN apt update && apt install -y gcc libstdc++6 libseccomp-dev
RUN go build

View File

@ -16,6 +16,10 @@ var (
"/dev/urandom",
"/proc/meminfo",
"/etc/localtime",
"/usr/lib/libstdc++.so.6",
"/usr/lib/libc.so.6",
"/usr/lib/libm.so.6",
"/usr/lib/libgcc_s.so.1",
}
// default write permission files
@ -75,6 +79,17 @@ var (
"clock_gettime",
"restart_syscall",
"futex",
"gettid",
"getpid",
"prlimit64",
"getrandom",
"set_tid_address",
"set_robust_list",
"rseq",
"newfstatat",
}
// default syscalls to trace
@ -108,71 +123,11 @@ var (
// config for different type of program
// workpath and arg0 have additional read / stat permission
runptraceConfig = map[string]ProgramConfig{
"python2.7": {
Syscall: SyscallConfig{
ExtraAllow: []string{
"futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo",
},
ExtraCount: map[string]int{
"set_tid_address": 1,
"set_robust_list": 1,
},
},
FileAccess: FileAccessConfig{
ExtraRead: []string{
"/usr/bin/python2.7",
"/usr/lib/python2.7/",
"/usr/bin/lib/python2.7/",
"/usr/local/lib/python2.7/",
"/usr/lib/pymodules/python2.7/",
"/usr/bin/Modules/",
"/usr/bin/pybuilddir.txt",
"/usr/lib/locale/",
"./answer.code",
},
ExtraStat: []string{
"/usr", "/usr/bin",
},
},
RunCommand: []string{"/usr/bin/python2.7", "-E", "-s", "-B"},
},
"python3": {
Syscall: SyscallConfig{
ExtraAllow: []string{
"futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo", "getrandom",
},
ExtraCount: map[string]int{
"set_tid_address": 1,
"set_robust_list": 1,
},
},
FileAccess: FileAccessConfig{
ExtraRead: []string{
"/usr/bin/python3",
"/usr/lib/python3/",
"/usr/bin/python3.6",
"/usr/lib/python3.6/",
"/usr/bin/lib/python3.6/",
"/usr/local/lib/python3.6/",
"/usr/bin/pyvenv.cfg",
"/usr/pyvenv.cfg",
"/usr/bin/Modules",
"/usr/bin/pybuilddir.txt",
"/usr/lib/dist-python",
"/usr/lib/locale/",
"./answer.code",
},
ExtraStat: []string{
"/usr", "/usr/bin", "/usr/lib", "/usr/lib/python36.zip",
},
},
RunCommand: []string{"/usr/bin/python3", "-I", "-B"},
},
"compiler": {
Syscall: SyscallConfig{
ExtraAllow: []string{
"gettid", "set_tid_address", "set_robust_list", "futex",
"getpid", "vfork", "fork", "clone", "execve", "wait4",
"set_tid_address", "set_robust_list", "futex",
"vfork", "fork", "clone", "execve", "wait4",
"clock_gettime", "clock_getres",
"setrlimit", "pipe",
"getdents64", "getdents",

View File

@ -430,26 +430,39 @@ func start() (*runner.Result, error) {
cpu, err := cg.CPUUsage()
if err != nil {
return nil, fmt.Errorf("cgroup cpu: %v", err)
} else {
rt.Time = time.Duration(cpu)
}
// max memory usage may not exist in cgroup v2
memory, err := cg.MemoryMaxUsage()
if err != nil && !errors.Is(err, os.ErrNotExist) {
return nil, fmt.Errorf("cgroup memory: %v", err)
} else if err == nil {
rt.Memory = runner.Size(memory)
}
procPeak, err := cg.ProcessPeak()
if err != nil && !errors.Is(err, os.ErrNotExist) {
return nil, fmt.Errorf("cgroup pid: %v", err)
}
debug("cgroup: cpu: ", cpu, " memory: ", memory, " procPeak: ", procPeak)
rt.Time = time.Duration(cpu)
if memory > 0 {
rt.Memory = runner.Size(memory)
}
if procPeak > 0 {
} else if err == nil {
rt.ProcPeak = procPeak
}
debug("cgroup: cpu: ", cpu, " memory: ", memory, " procPeak: ", procPeak)
debug("cgroup:", rt)
}
if rt.Status == runner.StatusTimeLimitExceeded || rt.Status == runner.StatusNormal {
if rt.Time > limit.TimeLimit {
rt.Status = runner.StatusTimeLimitExceeded
} else {
rt.Status = runner.StatusNormal
}
}
if rt.Status == runner.StatusMemoryLimitExceeded || rt.Status == runner.StatusNormal {
if rt.Memory > limit.MemoryLimit {
rt.Status = runner.StatusMemoryLimitExceeded
} else {
rt.Status = runner.StatusNormal
}
}
return &rt, nil
}

View File

@ -124,6 +124,14 @@ func (c *containerServer) handleExecve(cmd *execCmd, msg unixsocket.Msg) error {
if cmd.SyncAfter {
if err := syncPid(1); err != nil {
syscall.Kill(-1, syscall.SIGKILL)
c.waitPid <- pid
ret := <-c.waitPidResult
err := c.sendReply(convertReply(ret), unixsocket.Msg{})
c.waitAll <- struct{}{}
<-c.waitAllDone
return err
}
}
return c.handleExecveStarted(pid)
@ -164,7 +172,7 @@ func (c *containerServer) handleExecveStarted(pid int) error {
}
}
<-c.waitAllDone
return c.sendReply(reply{}, unixsocket.Msg{})
return nil
}
func convertReply(ret waitPidResult) reply {

View File

@ -45,7 +45,7 @@ type ExecveParam struct {
SyncAfterExec bool
}
// Execve runs process inside container. It accepts context cancelation as time limit exceeded.
// Execve runs process inside container. It accepts context cancellation as time limit exceeded.
func (c *container) Execve(ctx context.Context, param ExecveParam) runner.Result {
c.mu.Lock()
defer c.mu.Unlock()
@ -122,13 +122,11 @@ func (c *container) waitForDone(ctx context.Context, sTime time.Time) runner.Res
case <-ctx.Done(): // cancel
c.sendCmd(cmd{Cmd: cmdKill}, unixsocket.Msg{}) // kill
reply, _, _ := c.recvReply()
_, _, err := c.recvReply()
reply, _, err := c.recvReply()
return convertReplyResult(reply, sTime, mTime, err)
case ret := <-c.recvCh: // result
c.sendCmd(cmd{Cmd: cmdKill}, unixsocket.Msg{}) // kill
_, _, err := c.recvReply()
err := c.sendCmd(cmd{Cmd: cmdKill}, unixsocket.Msg{}) // kill
return convertReplyResult(ret.Reply, sTime, mTime, err)
}
}

2
go.mod
View File

@ -4,6 +4,6 @@ go 1.24
require (
github.com/elastic/go-seccomp-bpf v1.5.0
golang.org/x/net v0.37.0
golang.org/x/net v0.38.0
golang.org/x/sys v0.31.0
)

4
go.sum
View File

@ -6,8 +6,8 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
golang.org/x/net v0.37.0 h1:1zLorHbz+LYj7MQlSf1+2tPIIgibq2eL5xkrGk6f+2c=
golang.org/x/net v0.37.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

10
test_c/Makefile Normal file
View File

@ -0,0 +1,10 @@
all: helloworld/main.test nonzeroexit/main.test
helloworld/main.test: helloworld/main.cpp
g++ helloworld/main.cpp -o helloworld/main.test -DNDEBUG -O3
nonzeroexit/main.test: nonzeroexit/main.cpp
g++ nonzeroexit/main.cpp -o nonzeroexit/main.test -DNDEBUG -O3
clean:
rm -rf helloworld/*.test nonzeroexit/*.test

View File

@ -0,0 +1,6 @@
#include<iostream>
int main() {
std::cout << "Hello, world" << std::endl;
return 0;
}

View File

@ -0,0 +1,3 @@
int main() {
return 100;
}