mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
73 lines
1.9 KiB
Go
73 lines
1.9 KiB
Go
package config
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/criyle/go-sandbox/runner/ptrace"
|
|
)
|
|
|
|
// Handler defines file access restricted handler to call the ptrace
|
|
// safe runner
|
|
type Handler struct {
|
|
SyscallAllow, SyscallTrace, Args []string
|
|
FileSet *FileSets
|
|
SyscallCounter SyscallCounter
|
|
ShowDetails bool
|
|
}
|
|
|
|
// CheckRead checks whether the file have read permission
|
|
func (h *Handler) CheckRead(fn string) ptrace.TraceAction {
|
|
if !h.FileSet.IsReadableFile(fn) {
|
|
return h.onDgsFileDetect(fn)
|
|
}
|
|
return ptrace.TraceAllow
|
|
}
|
|
|
|
// CheckWrite checks whether the file have write permission
|
|
func (h *Handler) CheckWrite(fn string) ptrace.TraceAction {
|
|
if !h.FileSet.IsWritableFile(fn) {
|
|
return h.onDgsFileDetect(fn)
|
|
}
|
|
return ptrace.TraceAllow
|
|
}
|
|
|
|
// CheckStat checks whether the file have stat permission
|
|
func (h *Handler) CheckStat(fn string) ptrace.TraceAction {
|
|
if !h.FileSet.IsStatableFile(fn) {
|
|
return h.onDgsFileDetect(fn)
|
|
}
|
|
return ptrace.TraceAllow
|
|
}
|
|
|
|
// CheckSyscall checks syscalls other than allowed and traced agianst the
|
|
// SyscallCounter
|
|
func (h *Handler) CheckSyscall(syscallName string) ptrace.TraceAction {
|
|
// if it is traced, then try to count syscall
|
|
if inside, allow := h.SyscallCounter.Check(syscallName); inside {
|
|
if allow {
|
|
return ptrace.TraceAllow
|
|
}
|
|
return ptrace.TraceKill
|
|
}
|
|
// if it is traced but not counted, it should be soft banned
|
|
return ptrace.TraceBan
|
|
}
|
|
|
|
// onDgsFileDetect soft ban file if in soft ban set
|
|
// otherwise stops the trace process
|
|
func (h *Handler) onDgsFileDetect(name string) ptrace.TraceAction {
|
|
if h.FileSet.IsSoftBanFile(name) {
|
|
return ptrace.TraceBan
|
|
}
|
|
h.print("Dangerous fileopen: ", name)
|
|
return ptrace.TraceKill
|
|
}
|
|
|
|
// print is used to print debug information
|
|
func (h *Handler) print(v ...interface{}) {
|
|
if h.ShowDetails {
|
|
fmt.Fprintln(os.Stderr, v...)
|
|
}
|
|
}
|