diff --git a/src/judger.rs b/src/judger.rs index badc3dd..25f2414 100644 --- a/src/judger.rs +++ b/src/judger.rs @@ -134,7 +134,7 @@ pub async fn compile( &v, // 编译的资源限制为固定的 10000, - 64 * 1024, + 256 * 1024, )?; let mut runner = process.runner.clone(); diff --git a/src/runner.rs b/src/runner.rs index 3a168a2..bdf36f1 100644 --- a/src/runner.rs +++ b/src/runner.rs @@ -215,6 +215,8 @@ impl Runner { filter.add_rules(syscall_number, rules).unwrap(); let (syscall_number, rules) = trace_syscall(libc::SYS_munmap); filter.add_rules(syscall_number, rules).unwrap(); + let (syscall_number, rules) = trace_syscall(libc::SYS_mremap); + filter.add_rules(syscall_number, rules).unwrap(); } else { let (syscall_number, rules) = allow_syscall(libc::SYS_brk); filter.add_rules(syscall_number, rules).unwrap(); @@ -222,6 +224,8 @@ impl Runner { filter.add_rules(syscall_number, rules).unwrap(); let (syscall_number, rules) = allow_syscall(libc::SYS_munmap); filter.add_rules(syscall_number, rules).unwrap(); + let (syscall_number, rules) = allow_syscall(libc::SYS_mremap); + filter.add_rules(syscall_number, rules).unwrap(); } SeccompFilter::apply(filter.try_into().unwrap()).unwrap(); libc::execve(exec_args.pathname, exec_args.argv, exec_args.envp);