Sandbox implemented in GO with container / ptrace / seccomp
Go to file
2019-03-31 21:43:40 -04:00
runner add ability to skip syscall 2019-03-31 21:43:40 -04:00
tracee add some comment to tracee 2019-03-30 22:03:21 -04:00
tracer add ability to skip syscall 2019-03-31 21:43:40 -04:00
.gitignore first commit 2019-03-26 20:55:28 -04:00
README.md add syscall handle to tracer 2019-03-31 19:13:05 -04:00

go-judger

Under developing.

Goal is to reimplement uoj-judger/run_program in GO language using libseccomp.

Features (same as uoj-judger):

  1. Restricted computing resource: Time / Memory (Stack) / Output
  2. Restricted syscall access (by libseccomp / ptrace)
  3. Restricted file access (read / write / access / exec)

Planed features:

  1. Enhanced memory allocation check (e.g. trace brk rtval)
  2. More architectures
  3. ...

Default file access action:

  • check file read / write: open, openat
  • check file read: readlink, readlinkat
  • check file write: unlink, unlinkat, chmod, rename
  • check file access: stat, lstat, access
  • check file exec: execve

Build dependency:

  • install libseccomp-dev: apt install libseccomp-dev on ubuntu
  • ...

Packages:

  • Tracee: fork-exec with seccomp loaded
  • Tracer: ptrace tracee and provides syscall trap

Executable:

  • Runner: demo