添加 seccomp 安全限制

This commit is contained in:
MeiK 2020-10-26 15:33:28 +08:00
parent c0e2c9ccb0
commit b2961c34fe
5 changed files with 1242 additions and 1 deletions

60
src/allow.rs Normal file
View File

@ -0,0 +1,60 @@
use super::seccomp::*;
use libc;
pub fn gen_rules() -> Vec<SyscallRuleSet> {
vec![
allow_syscall(libc::SYS_access),
allow_syscall(libc::SYS_arch_prctl),
allow_syscall(libc::SYS_brk),
allow_syscall(libc::SYS_chmod),
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_clone),
allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_dup2),
allow_syscall(libc::SYS_execve),
allow_syscall(libc::SYS_exit),
allow_syscall(libc::SYS_exit_group),
allow_syscall(libc::SYS_fcntl),
allow_syscall(libc::SYS_fork),
allow_syscall(libc::SYS_fstat),
allow_syscall(libc::SYS_futex),
allow_syscall(libc::SYS_getcwd),
allow_syscall(libc::SYS_getdents),
allow_syscall(libc::SYS_getegid),
allow_syscall(libc::SYS_geteuid),
allow_syscall(libc::SYS_getgid),
allow_syscall(libc::SYS_getpid),
allow_syscall(libc::SYS_getrandom),
allow_syscall(libc::SYS_getrlimit),
allow_syscall(libc::SYS_getrusage),
allow_syscall(libc::SYS_getuid),
allow_syscall(libc::SYS_ioctl),
allow_syscall(libc::SYS_lseek),
allow_syscall(libc::SYS_lstat),
allow_syscall(libc::SYS_mmap),
allow_syscall(libc::SYS_mprotect),
allow_syscall(libc::SYS_munmap),
allow_syscall(libc::SYS_open),
allow_syscall(libc::SYS_openat),
allow_syscall(libc::SYS_prlimit64),
allow_syscall(libc::SYS_read),
allow_syscall(libc::SYS_readlink),
allow_syscall(libc::SYS_rt_sigaction),
allow_syscall(libc::SYS_rt_sigprocmask),
allow_syscall(libc::SYS_rt_sigreturn),
allow_syscall(libc::SYS_select),
allow_syscall(libc::SYS_set_robust_list),
allow_syscall(libc::SYS_set_tid_address),
allow_syscall(libc::SYS_sigaltstack),
allow_syscall(libc::SYS_stat),
allow_syscall(libc::SYS_sysinfo),
allow_syscall(libc::SYS_umask),
allow_syscall(libc::SYS_uname),
allow_syscall(libc::SYS_unlink),
allow_syscall(libc::SYS_vfork),
allow_syscall(libc::SYS_wait4),
allow_syscall(libc::SYS_write),
allow_syscall(libc::SYS_writev),
]
}

View File

@ -130,8 +130,9 @@ pub async fn compile(
let runner = process.runner.clone();
let status = runner.await?;
resp.set_process_status(&status);
if status.exit_code != 0 {
if status.exit_code != 0 || status.signal != 0 {
debug!("compile exit code: {}", status.exit_code);
debug!("compile signal: {}", status.exit_code);
// 从 stdout 和 stderr 中获取错误信息
resp.stdout = match fs::read_to_string(path.join(STDOUT_FILENAME)).await {
Ok(val) => val,

View File

@ -14,12 +14,14 @@ use tempfile::tempdir_in;
use tonic::transport::Server;
use tonic::{Request, Response, Status};
mod allow;
mod config;
mod error;
mod exec_args;
mod judger;
mod process;
mod runner;
mod seccomp;
pub mod river {
tonic::include_proto!("river");

View File

@ -1,6 +1,9 @@
use super::allow::gen_rules;
use super::config::{STDERR_FILENAME, STDIN_FILENAME, STDOUT_FILENAME};
use super::error::{errno_str, Error, Result};
use super::exec_args::ExecArgs;
use super::seccomp::*;
use std::convert::TryInto;
use std::env;
use std::ffi::CString;
use std::future::Future;
@ -189,6 +192,11 @@ impl Runner {
eprintln!("{:?}", io::Error::last_os_error().raw_os_error());
panic!("How dare you!");
}
let filter = SeccompFilter::new(gen_rules().into_iter().collect(), SeccompAction::Kill)
.unwrap()
.try_into()
.unwrap();
SeccompFilter::apply(filter).unwrap();
libc::execve(exec_args.pathname, exec_args.argv, exec_args.envp);
}
panic!("How dare you!");

1170
src/seccomp.rs Normal file

File diff suppressed because it is too large Load Diff