Sandbox implemented in GO with container / ptrace / seccomp
Go to file
2019-04-17 18:36:56 -04:00
run_program fix permission check for files 2019-04-15 18:49:25 -04:00
secutil move seccomp filter utility into separate package 2019-04-17 18:36:56 -04:00
tracee move seccomp filter utility into separate package 2019-04-17 18:36:56 -04:00
tracer move seccomp filter utility into separate package 2019-04-17 18:36:56 -04:00
.gitignore first commit 2019-03-26 20:55:28 -04:00
LICENSE Create LICENSE 2019-04-01 14:28:20 -04:00
README.md move seccomp filter utility into separate package 2019-04-17 18:36:56 -04:00

go-judger

Under developing.

Goal is to reimplement uoj-judger/run_program in GO language using libseccomp.

Install:

  • install go compiler: apt install golang-go
  • install libseccomp-dev: apt install libseccomp-dev
  • install: go install github.com/criyle/go-judger/...

Features (same as uoj-judger/run_program):

  1. Restricted computing resource: Time & Memory (Stack) & Output
  2. Restricted syscall access (by libseccomp & ptrace)
  3. Restricted file access (read & write & access & exec)

Default file access action:

  • check file read / write: open, openat
  • check file read: readlink, readlinkat
  • check file write: unlink, unlinkat, chmod, rename
  • check file access: stat, lstat, access
  • check file exec: execve

Packages:

  • Secutil: provides common utility function that wrappers libseccomp
  • Tracee: ptraced fork-exec with seccomp loaded
  • Tracer: ptrace tracee and provides syscall trap context

Executable:

  • run_program: under construction

TODO:

Planned example config file format(yaml) run_program.yaml:

python2:
  syscall:
    extraAllow:
      - clone
    extraCount:
      set_tid_address: 1
    extraBan:
      - socket
  file:
    extraRead:
      - /usr/bin
    extraWrite:
      - ./
    extraStat:
      - /usr/bin
    extraBan:
      - /etc/passwd

Planned config file format for compiler compiler.yaml:

python:
  exec: python ...
  ...:

Planned runtime spec(yaml) run.yaml:

inputFile: input.txt
outputFile: output.txt
...:
  • allow multiple traced programs
  • allow pipes
  • Percise resource limits (s -> ms, mb -> kb)
  • More architectures (arm32, x86)
  • ...

Default Allowed Syscalls:

// file access through fd
"read", "write", "readv", "writev",
"close",
"fstat",
"lseek",
"dup", "dup2", "dup3",
"ioctl", "fcntl",

// memory action
"mmap", "mprotect", "munmap", "brk",
"mremap", "msync", "mincore", "madvise",

// signal action
"rt_sigaction",
"rt_sigprocmask",
"rt_sigreturn",
"rt_sigpending",
"sigaltstack",

// get current work dir
"getcwd",

// process exit
"exit",
"exit_group",

// others
"arch_prctl",

"gettimeofday",
"getrlimit",
"getrusage",
"times",
"time",
"clock_gettime",

"restart_syscall",

Default Allowed File Reads:

"/etc/ld.so.nohwcap",
"/etc/ld.so.preload",
"/etc/ld.so.cache",
"/lib/x86_64-linux-gnu/",
"/usr/lib/x86_64-linux-gnu/",
"/usr/lib/locale/locale-archive",
"/proc/self/exe",
"/etc/timezone",
"/usr/share/zoneinfo/",
"/dev/random",
"/dev/urandom",
"/proc/meminfo",
"/etc/localtime",
``