Sandbox implemented in GO with container / ptrace / seccomp
Go to file
2019-06-26 00:24:54 -07:00
cmd/run_program refactor some package and add some documentation 2019-05-21 22:46:55 -07:00
runconfig fix system root access 2019-06-26 00:24:54 -07:00
runprogram fix race problem of setpgid and refactor some package 2019-05-18 16:18:14 -07:00
secutil add test to secutil and fixed trace forked processes 2019-04-27 16:50:46 -04:00
tracee make tracee into individual process group 2019-05-18 01:40:37 -07:00
tracer fix process_vm_readv 2019-06-23 22:49:40 -07:00
.gitignore make tracee into individual process group 2019-05-18 01:40:37 -07:00
LICENSE Create LICENSE 2019-04-01 14:28:20 -04:00
README.md decoupling tracer tracee and main. refatored config. 2019-04-19 03:50:17 -04:00

go-judger

Under developing.

Goal is to reimplement uoj-judger/run_program in GO language using libseccomp.

Install:

  • install go compiler: apt install golang-go
  • install libseccomp-dev: apt install libseccomp-dev
  • install: go install github.com/criyle/go-judger/...

Features (same as uoj-judger/run_program):

  1. Restricted computing resource: Time & Memory (Stack) & Output
  2. Restricted syscall access (by libseccomp & ptrace)
  3. Restricted file access (read & write & access & exec)

Default file access action:

  • check file read / write: open, openat
  • check file read: readlink, readlinkat
  • check file write: unlink, unlinkat, chmod, rename
  • check file access: stat, lstat, access
  • check file exec: execve

Packages:

  • Secutil: provides common utility function that wrappers libseccomp
  • Tracee: ptraced fork-exec with seccomp loaded
  • Tracer: ptrace tracee and provides syscall trap context

Executable:

  • run_program: under construction

Configuations:

  • run_program/config.go: all configs toward running specs

TODO:

  • allow multiple traced programs
  • allow pipes
  • Percise resource limits (s -> ms, mb -> kb)
  • More architectures (arm32, x86)
  • ...