This commit is contained in:
MeiK 2020-10-28 17:30:16 +08:00
parent edef4a410c
commit 09890bd293
2 changed files with 5 additions and 1 deletions

View File

@ -134,7 +134,7 @@ pub async fn compile(
&v,
// 编译的资源限制为固定的
10000,
64 * 1024,
256 * 1024,
)?;
let mut runner = process.runner.clone();

View File

@ -215,6 +215,8 @@ impl Runner {
filter.add_rules(syscall_number, rules).unwrap();
let (syscall_number, rules) = trace_syscall(libc::SYS_munmap);
filter.add_rules(syscall_number, rules).unwrap();
let (syscall_number, rules) = trace_syscall(libc::SYS_mremap);
filter.add_rules(syscall_number, rules).unwrap();
} else {
let (syscall_number, rules) = allow_syscall(libc::SYS_brk);
filter.add_rules(syscall_number, rules).unwrap();
@ -222,6 +224,8 @@ impl Runner {
filter.add_rules(syscall_number, rules).unwrap();
let (syscall_number, rules) = allow_syscall(libc::SYS_munmap);
filter.add_rules(syscall_number, rules).unwrap();
let (syscall_number, rules) = allow_syscall(libc::SYS_mremap);
filter.add_rules(syscall_number, rules).unwrap();
}
SeccompFilter::apply(filter.try_into().unwrap()).unwrap();
libc::execve(exec_args.pathname, exec_args.argv, exec_args.envp);