mirror of
https://github.com/MeiK2333/river.git
synced 2025-11-04 14:49:40 +08:00
添加 seccomp 安全限制
This commit is contained in:
parent
c0e2c9ccb0
commit
b2961c34fe
60
src/allow.rs
Normal file
60
src/allow.rs
Normal file
@ -0,0 +1,60 @@
|
||||
use super::seccomp::*;
|
||||
use libc;
|
||||
|
||||
pub fn gen_rules() -> Vec<SyscallRuleSet> {
|
||||
vec![
|
||||
allow_syscall(libc::SYS_access),
|
||||
allow_syscall(libc::SYS_arch_prctl),
|
||||
allow_syscall(libc::SYS_brk),
|
||||
allow_syscall(libc::SYS_chmod),
|
||||
allow_syscall(libc::SYS_clock_gettime),
|
||||
allow_syscall(libc::SYS_clone),
|
||||
allow_syscall(libc::SYS_close),
|
||||
allow_syscall(libc::SYS_dup),
|
||||
allow_syscall(libc::SYS_dup2),
|
||||
allow_syscall(libc::SYS_execve),
|
||||
allow_syscall(libc::SYS_exit),
|
||||
allow_syscall(libc::SYS_exit_group),
|
||||
allow_syscall(libc::SYS_fcntl),
|
||||
allow_syscall(libc::SYS_fork),
|
||||
allow_syscall(libc::SYS_fstat),
|
||||
allow_syscall(libc::SYS_futex),
|
||||
allow_syscall(libc::SYS_getcwd),
|
||||
allow_syscall(libc::SYS_getdents),
|
||||
allow_syscall(libc::SYS_getegid),
|
||||
allow_syscall(libc::SYS_geteuid),
|
||||
allow_syscall(libc::SYS_getgid),
|
||||
allow_syscall(libc::SYS_getpid),
|
||||
allow_syscall(libc::SYS_getrandom),
|
||||
allow_syscall(libc::SYS_getrlimit),
|
||||
allow_syscall(libc::SYS_getrusage),
|
||||
allow_syscall(libc::SYS_getuid),
|
||||
allow_syscall(libc::SYS_ioctl),
|
||||
allow_syscall(libc::SYS_lseek),
|
||||
allow_syscall(libc::SYS_lstat),
|
||||
allow_syscall(libc::SYS_mmap),
|
||||
allow_syscall(libc::SYS_mprotect),
|
||||
allow_syscall(libc::SYS_munmap),
|
||||
allow_syscall(libc::SYS_open),
|
||||
allow_syscall(libc::SYS_openat),
|
||||
allow_syscall(libc::SYS_prlimit64),
|
||||
allow_syscall(libc::SYS_read),
|
||||
allow_syscall(libc::SYS_readlink),
|
||||
allow_syscall(libc::SYS_rt_sigaction),
|
||||
allow_syscall(libc::SYS_rt_sigprocmask),
|
||||
allow_syscall(libc::SYS_rt_sigreturn),
|
||||
allow_syscall(libc::SYS_select),
|
||||
allow_syscall(libc::SYS_set_robust_list),
|
||||
allow_syscall(libc::SYS_set_tid_address),
|
||||
allow_syscall(libc::SYS_sigaltstack),
|
||||
allow_syscall(libc::SYS_stat),
|
||||
allow_syscall(libc::SYS_sysinfo),
|
||||
allow_syscall(libc::SYS_umask),
|
||||
allow_syscall(libc::SYS_uname),
|
||||
allow_syscall(libc::SYS_unlink),
|
||||
allow_syscall(libc::SYS_vfork),
|
||||
allow_syscall(libc::SYS_wait4),
|
||||
allow_syscall(libc::SYS_write),
|
||||
allow_syscall(libc::SYS_writev),
|
||||
]
|
||||
}
|
||||
@ -130,8 +130,9 @@ pub async fn compile(
|
||||
let runner = process.runner.clone();
|
||||
let status = runner.await?;
|
||||
resp.set_process_status(&status);
|
||||
if status.exit_code != 0 {
|
||||
if status.exit_code != 0 || status.signal != 0 {
|
||||
debug!("compile exit code: {}", status.exit_code);
|
||||
debug!("compile signal: {}", status.exit_code);
|
||||
// 从 stdout 和 stderr 中获取错误信息
|
||||
resp.stdout = match fs::read_to_string(path.join(STDOUT_FILENAME)).await {
|
||||
Ok(val) => val,
|
||||
|
||||
@ -14,12 +14,14 @@ use tempfile::tempdir_in;
|
||||
use tonic::transport::Server;
|
||||
use tonic::{Request, Response, Status};
|
||||
|
||||
mod allow;
|
||||
mod config;
|
||||
mod error;
|
||||
mod exec_args;
|
||||
mod judger;
|
||||
mod process;
|
||||
mod runner;
|
||||
mod seccomp;
|
||||
|
||||
pub mod river {
|
||||
tonic::include_proto!("river");
|
||||
|
||||
@ -1,6 +1,9 @@
|
||||
use super::allow::gen_rules;
|
||||
use super::config::{STDERR_FILENAME, STDIN_FILENAME, STDOUT_FILENAME};
|
||||
use super::error::{errno_str, Error, Result};
|
||||
use super::exec_args::ExecArgs;
|
||||
use super::seccomp::*;
|
||||
use std::convert::TryInto;
|
||||
use std::env;
|
||||
use std::ffi::CString;
|
||||
use std::future::Future;
|
||||
@ -189,6 +192,11 @@ impl Runner {
|
||||
eprintln!("{:?}", io::Error::last_os_error().raw_os_error());
|
||||
panic!("How dare you!");
|
||||
}
|
||||
let filter = SeccompFilter::new(gen_rules().into_iter().collect(), SeccompAction::Kill)
|
||||
.unwrap()
|
||||
.try_into()
|
||||
.unwrap();
|
||||
SeccompFilter::apply(filter).unwrap();
|
||||
libc::execve(exec_args.pathname, exec_args.argv, exec_args.envp);
|
||||
}
|
||||
panic!("How dare you!");
|
||||
|
||||
1170
src/seccomp.rs
Normal file
1170
src/seccomp.rs
Normal file
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue
Block a user