mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
Sandbox implemented in GO with container / ptrace / seccomp
| cmd/run_program | ||
| forkexec | ||
| mount | ||
| rlimit | ||
| runconfig | ||
| runprogram | ||
| rununshared | ||
| seccomp | ||
| tracer | ||
| .gitignore | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| README.md | ||
go-judger
Under developing.
Goal is to reimplement uoj-judger/run_program in GO language using libseccomp.
Install:
- install go compiler:
apt install golang-go - install libseccomp-dev:
apt install libseccomp-dev - install:
go install github.com/criyle/go-judger/...
Features (same as uoj-judger/run_program):
- Restricted computing resource: Time & Memory (Stack) & Output
- Restricted syscall access (by libseccomp & ptrace)
- Restricted file access (read & write & access & exec)
New Features:
- Percise resource limits (s -> ms, mb -> kb)
- More architectures (arm32, arm64, x86)
- Allow multiple traced programs in different threads
- Allow pipes as input / output files
Default file access action:
- check file read / write:
open,openat - check file read:
readlink,readlinkat - check file write:
unlink,unlinkat,chmod,rename - check file access:
stat,lstat,access,faccessat - check file exec:
execve
Packages:
- seccomp: provides utility function that wrappers libseccomp
- mount: provides utility function that wrappers mount syscall
- rlimit: provides utility function that defines rlimit syscall
- forkexec: fork-exec provides mount, unshare, ptrace, seccomp, capset before exec
- tracer: ptrace tracer and provides syscall trap filter context
- runprogram: wrapper to call forkexec and trecer
- rununshared: wrapper to call forkexec and unshared namespaces
- runconfig: defines arch & language specified trace condition
Executable:
- run_program: under construction
Configuations:
- run_program/config.go: all configs toward running specs
TODO:
- Use Linux Namespace to isolate file access (elimilate ptrace)
- Use Linux Control Groups to limit & acct CPU & memory (elimilate wait4 rusage)