File size: 3,399 Bytes
fc32096 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 | import json
import os
import platform
import resource
import secrets
import signal
import struct
import subprocess
import tempfile
from pathlib import Path
from common import ROOT
def seccomp_program():
if platform.machine() != 'x86_64':
raise RuntimeError('Sandbox syscall profile requires x86_64')
instructions = [(0x20,0,0,4),(0x15,1,0,0xc000003e),(0x06,0,0,0x80000000),
(0x20,0,0,0),(0x45,0,1,0x40000000),(0x06,0,0,0x00050001)]
for number in [41,42,43,44,45,46,47,49,50,53,56,57,58,101,165,166,272,288,298,304,308,310,311,321,323,428,429,430,431,432,435,442]:
instructions += [(0x15,0,1,number),(0x06,0,0,0x00050001)]
instructions.append((0x06,0,0,0x7fff0000))
return b''.join(struct.pack('HBBI',*instruction) for instruction in instructions)
def limits():
resource.setrlimit(resource.RLIMIT_CPU,(2,2))
resource.setrlimit(resource.RLIMIT_AS,(384*1024**2,384*1024**2))
resource.setrlimit(resource.RLIMIT_FSIZE,(65536,65536))
resource.setrlimit(resource.RLIMIT_NOFILE,(64,64))
resource.setrlimit(resource.RLIMIT_CORE,(0,0))
def check_code(code,entry_point,test_code):
base = ROOT/'tmp/coding_sandbox'
base.mkdir(parents=True,exist_ok=True)
nonce = secrets.token_hex(16)
with tempfile.TemporaryDirectory(prefix='case-',dir=base) as directory:
work = Path(directory)
(work/'payload.json').write_text(json.dumps({'code':code,'entry_point':entry_point,'test_code':test_code}))
(work/'worker.py').write_bytes((ROOT/'src/code_worker.py').read_bytes())
(work/'filter.bpf').write_bytes(seccomp_program())
with (work/'filter.bpf').open('rb') as filter_file, (work/'stdout.log').open('wb') as stdout, (work/'stderr.log').open('wb') as stderr:
command = ['bwrap','--unshare-all','--die-with-parent','--new-session','--cap-drop','ALL',
'--ro-bind','/usr','/usr','--symlink','usr/lib','/lib','--symlink','usr/lib64','/lib64',
'--proc','/proc','--dev','/dev','--size','16777216','--tmpfs','/tmp',
'--ro-bind',str(work),'/work','--chdir','/tmp','--clearenv','--setenv','PATH','/usr/bin',
'--ro-bind',str(ROOT/'tools/python/cpython-3.12.13-linux-x86_64-gnu'),'/runtime',
'--setenv','HOME','/tmp','--setenv','PYTHONHASHSEED','0','--seccomp',str(filter_file.fileno()),
'/runtime/bin/python3.12','-I','-S','/work/worker.py',nonce]
try:
process = subprocess.run(command,stdout=stdout,stderr=stderr,timeout=4,pass_fds=(filter_file.fileno(),))
except subprocess.TimeoutExpired:
return {'passed':False,'error_type':'Timeout','error':'wall_timeout_4s'}
content = (work/'stdout.log').read_bytes()[:65536].decode(errors='replace')
marker = '__WSP_RESULT__'+nonce
matches = [line[len(marker):] for line in content.split('\n') if line.startswith(marker)]
if process.returncode == 0 and len(matches)==1:
return json.loads(matches[0])
error = (work/'stderr.log').read_bytes()[:1000].decode(errors='replace')
if 'bwrap:' in error:
raise RuntimeError('Sandbox infrastructure failure: '+error[:500])
return {'passed':False,'error_type':'ProcessFailure','returncode':process.returncode,'error':error[:300]}
|