mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
151 lines
3.6 KiB
Go
151 lines
3.6 KiB
Go
package main
|
|
|
|
import (
|
|
"os"
|
|
|
|
tracer "github.com/criyle/go-judger/tracer"
|
|
)
|
|
|
|
func inifConf(t *tracer.Tracer, fs *fileSets, sc *syscallCounter, pType string, addRead []string, addWrite []string, allowProc bool) {
|
|
for _, name := range defaultReadableFileNameList {
|
|
fs.Readable.Add(name)
|
|
}
|
|
|
|
if t.WorkPath == "" {
|
|
t.WorkPath, _ = os.Getwd()
|
|
}
|
|
fs.Statable.Add(t.WorkPath)
|
|
|
|
if pType != "java7" && pType != "java8" {
|
|
fs.addFilePermission(t.Args[0], filePermRead)
|
|
} else {
|
|
// ...
|
|
fs.addFilePermission(t.Args[0], filePermRead)
|
|
}
|
|
fs.addFilePermission(t.WorkPath, filePermRead)
|
|
|
|
for _, name := range addRead {
|
|
fs.addFilePermission(name, filePermRead)
|
|
}
|
|
|
|
for _, name := range addWrite {
|
|
fs.addFilePermission(name, filePermWrite)
|
|
}
|
|
|
|
fs.Writable.Add("/dev/null")
|
|
|
|
if allowProc {
|
|
t.Allow = append(t.Allow, "clone", "fork", "vfork", "nanosleep", "execve")
|
|
}
|
|
|
|
var (
|
|
writeableFiles, readableFiles, statableFiles, softbanFiles []string
|
|
)
|
|
|
|
switch pType {
|
|
case "python2.7":
|
|
sc.add("set_tid_address", 1)
|
|
sc.add("set_robust_list", 1)
|
|
t.Allow = append(t.Allow, "futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo")
|
|
|
|
readableFiles = append(readableFiles,
|
|
"/usr/bin/python2.7",
|
|
"/usr/lib/python2.7/",
|
|
"/usr/bin/lib/python2.7/",
|
|
"/usr/local/lib/python2.7/",
|
|
"/usr/lib/pymodules/python2.7/",
|
|
"/usr/bin/Modules/",
|
|
"/usr/bin/pybuilddir.txt",
|
|
"/usr/lib/locale/",
|
|
t.WorkPath+"/answer.code",
|
|
)
|
|
|
|
statableFiles = append(statableFiles, "/usr", "/usr/bin")
|
|
t.Args = append([]string{"/usr/bin/python2.7", "-E", "-s", "-B"}, t.Args...)
|
|
|
|
case "python3":
|
|
sc.add("set_tid_address", 1)
|
|
sc.add("set_robust_list", 1)
|
|
t.Allow = append(t.Allow, "futex", "getdents", "getdents64", "prlimit64", "getpid", "sysinfo", "getrandom")
|
|
|
|
readableFiles = append(readableFiles,
|
|
"/usr/bin/python3",
|
|
"/usr/lib/python3/",
|
|
"/usr/bin/python3.6",
|
|
"/usr/lib/python3.6/",
|
|
"/usr/bin/lib/python3.6/",
|
|
"/usr/local/lib/python3.6/",
|
|
"/usr/bin/pyvenv.cfg",
|
|
"/usr/pyvenv.cfg",
|
|
"/usr/bin/Modules",
|
|
"/usr/bin/pybuilddir.txt",
|
|
"/usr/lib/dist-python",
|
|
"/usr/lib/locale/",
|
|
t.WorkPath+"/answer.code",
|
|
)
|
|
|
|
statableFiles = append(statableFiles, "/usr", "/usr/bin", "/usr/lib", "/usr/lib/python36.zip")
|
|
t.Args = append([]string{"/usr/bin/python3", "-I", "-B"}, t.Args...)
|
|
|
|
case "java7":
|
|
case "java8":
|
|
// ....
|
|
|
|
case "compiler":
|
|
t.Allow = append(t.Allow, "gettid", "set_tid_address", "set_robust_list", "futex",
|
|
"getpid", "vfork", "fork", "clone", "execve", "wait4",
|
|
"clock_gettime", "clock_getres",
|
|
"setrlimit", "pipe",
|
|
"getdents64", "getdents",
|
|
"umask", "rename", "chmod", "mkdir",
|
|
"chdir", "fchdir",
|
|
"ftruncate",
|
|
"sched_getaffinity", "sched_yield",
|
|
"uname", "sysinfo",
|
|
"prlimit64", "getrandom",
|
|
)
|
|
// soft ban
|
|
t.Trace = append(t.Trace, "socket", "connect", "geteuid", "getuid")
|
|
|
|
writeableFiles = append(writeableFiles, "/tmp/", t.WorkPath+"/")
|
|
readableFiles = append(readableFiles,
|
|
t.WorkPath,
|
|
absPath(0, t.WorkPath+"/../runtime")+"/",
|
|
"/etc/oracle/java/usagetracker.properties",
|
|
"/usr/",
|
|
"/lib/",
|
|
"/lib64/",
|
|
"/bin/",
|
|
"/sbin/",
|
|
"/sys/devices/system/cpu/",
|
|
"/proc/",
|
|
"/etc/timezone",
|
|
"/etc/fpc-2.6.2.cfg.d/",
|
|
"/etc/fpc.cfg",
|
|
"/*",
|
|
)
|
|
fs.Readable.SystemRoot = true
|
|
|
|
softbanFiles = append(softbanFiles,
|
|
"/etc/nsswitch.conf",
|
|
"/etc/passwd",
|
|
)
|
|
}
|
|
|
|
for _, name := range writeableFiles {
|
|
fs.Writable.Add(name)
|
|
}
|
|
|
|
for _, name := range readableFiles {
|
|
fs.Readable.Add(name)
|
|
}
|
|
|
|
for _, name := range statableFiles {
|
|
fs.Statable.Add(name)
|
|
}
|
|
|
|
for _, name := range softbanFiles {
|
|
fs.SoftBan.Add(name)
|
|
}
|
|
}
|