go-sandbox/runner/ptrace/runner.go
2019-08-30 00:57:07 -07:00

68 lines
1.6 KiB
Go

package ptrace
import (
"syscall"
"github.com/criyle/go-sandbox/pkg/rlimit"
"github.com/criyle/go-sandbox/types"
)
// Runner defines the spec to run a program safely by ptracer
type Runner struct {
// argv and env for the child process
// work path set by setcwd (current working directory for child)
Args []string
Env []string
WorkDir string
// fexecve
ExecFile uintptr
// file disriptors for new process, from 0 to len - 1
Files []uintptr
// Resource limit set by set rlimit
RLimits rlimit.RLimits
// Res limit enforced by tracer
TraceLimit types.Limit
// Allowed / Traced syscall names
// Notice: file access syscalls should be traced
// If traced syscall is file access, it will checked by file access handler
// otherwise it will checked by syscall access handler
SyscallAllowed []string
SyscallTraced []string
// Traced syscall handler
Handler Handler
// ShowDetails / Unsafe debug flag
ShowDetails, Unsafe bool
// Use by cgroup to add proc
SyncFunc func(pid int) error
}
// TraceAction defines action against a syscall check
type TraceAction int
// BanRet defines the return value for a syscall ban acction
var BanRet = syscall.EACCES
// TraceAllow allow the access, trace ban ignores the syscall and set the
// return value to BanRet, TraceKill stops the trace action
const (
TraceAllow = iota + 1
TraceBan
TraceKill
)
// Handler defines the action when a file access encountered
type Handler interface {
CheckRead(string) TraceAction
CheckWrite(string) TraceAction
CheckStat(string) TraceAction
CheckSyscall(string) TraceAction
}