go-sandbox/runner/config/handle.go
2019-08-30 00:57:07 -07:00

73 lines
1.9 KiB
Go

package config
import (
"fmt"
"os"
"github.com/criyle/go-sandbox/runner/ptrace"
)
// Handler defines file access restricted handler to call the ptrace
// safe runner
type Handler struct {
SyscallAllow, SyscallTrace, Args []string
FileSet *FileSets
SyscallCounter SyscallCounter
ShowDetails bool
}
// CheckRead checks whether the file have read permission
func (h *Handler) CheckRead(fn string) ptrace.TraceAction {
if !h.FileSet.IsReadableFile(fn) {
return h.onDgsFileDetect(fn)
}
return ptrace.TraceAllow
}
// CheckWrite checks whether the file have write permission
func (h *Handler) CheckWrite(fn string) ptrace.TraceAction {
if !h.FileSet.IsWritableFile(fn) {
return h.onDgsFileDetect(fn)
}
return ptrace.TraceAllow
}
// CheckStat checks whether the file have stat permission
func (h *Handler) CheckStat(fn string) ptrace.TraceAction {
if !h.FileSet.IsStatableFile(fn) {
return h.onDgsFileDetect(fn)
}
return ptrace.TraceAllow
}
// CheckSyscall checks syscalls other than allowed and traced agianst the
// SyscallCounter
func (h *Handler) CheckSyscall(syscallName string) ptrace.TraceAction {
// if it is traced, then try to count syscall
if inside, allow := h.SyscallCounter.Check(syscallName); inside {
if allow {
return ptrace.TraceAllow
}
return ptrace.TraceKill
}
// if it is traced but not counted, it should be soft banned
return ptrace.TraceBan
}
// onDgsFileDetect soft ban file if in soft ban set
// otherwise stops the trace process
func (h *Handler) onDgsFileDetect(name string) ptrace.TraceAction {
if h.FileSet.IsSoftBanFile(name) {
return ptrace.TraceBan
}
h.print("Dangerous fileopen: ", name)
return ptrace.TraceKill
}
// print is used to print debug information
func (h *Handler) print(v ...interface{}) {
if h.ShowDetails {
fmt.Fprintln(os.Stderr, v...)
}
}