From a6bde1e1560c37898d42c95d9873045123c9f76a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Sat, 25 Sep 2021 00:12:36 +0200 Subject: [PATCH 1/7] Fix dead links --- README.md | 3 ++- boxes/make_boxes.sh | 19 +++++++++---------- external/scdoc.cmake | 4 ++-- 3 files changed, 13 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index a0bc3b0..094a008 100644 --- a/README.md +++ b/README.md @@ -20,10 +20,11 @@ Our sio2jail uses some external libraries and programs: * libseccomp (>= 2.3.0) * libtclap * scdoc (for generating man pages) + * g++-multilib some of which you can install (e.g. on Debian) with: - apt-get install libcap-dev libtclap-dev libseccomp-dev + apt-get install libcap-dev libtclap-dev libseccomp-dev g++-multilib By default sio2jail searches for this libraries in system paths and in case they aren't found their sources are downloaded and libraries are built in working diff --git a/boxes/make_boxes.sh b/boxes/make_boxes.sh index ef12eec..40a77f3 100755 --- a/boxes/make_boxes.sh +++ b/boxes/make_boxes.sh @@ -21,10 +21,9 @@ make_busybox() { empty_box # busybox with dependencies extract_deb "busybox/busybox_1.22.0-19+b3_amd64.deb" - extract_deb "glibc/libc6_2.24-11+deb9u3_amd64.deb" + extract_deb "glibc/libc6_2.24-11+deb9u4_amd64.deb" extract_deb "gcc-6/libgcc1_6.3.0-18+deb9u1_amd64.deb" extract_deb "gcc-6/gcc-6-base_6.3.0-18+deb9u1_amd64.deb" - build_box clean_box manifest_box >> $MANIFEST @@ -34,10 +33,10 @@ make_python2() { export BOX="python2" empty_box # python2.7 with dependencies - extract_deb "python2.7/python2.7-minimal_2.7.13-2+deb9u2_amd64.deb" - extract_deb "python2.7/libpython2.7-minimal_2.7.13-2+deb9u2_amd64.deb" + extract_deb "python2.7/python2.7-minimal_2.7.13-2+deb9u3_amd64.deb" + extract_deb "python2.7/libpython2.7-minimal_2.7.13-2+deb9u3_amd64.deb" extract_deb "zlib/zlib1g_1.2.8.dfsg-5_amd64.deb" - extract_deb "glibc/libc6_2.24-11+deb9u3_amd64.deb" + extract_deb "glibc/libc6_2.24-11+deb9u4_amd64.deb" extract_deb "gcc-6/libgcc1_6.3.0-18+deb9u1_amd64.deb" extract_deb "gcc-6/gcc-6-base_6.3.0-18+deb9u1_amd64.deb" @@ -50,12 +49,12 @@ make_python3() { export BOX="python3" empty_box # python3.5 with dependencies - extract_deb "python3.5/python3.5-minimal_3.5.3-1_amd64.deb" - extract_deb "python3.5/libpython3.5-minimal_3.5.3-1_amd64.deb" - extract_deb "expat/libexpat1_2.2.0-2+deb9u1_amd64.deb" + extract_deb "python3.5/python3.5-minimal_3.5.3-1+deb9u1_amd64.deb" + extract_deb "python3.5/libpython3.5-minimal_3.5.3-1+deb9u1_amd64.deb" + extract_deb "expat/libexpat1_2.2.0-2+deb9u3_amd64.deb" extract_deb "zlib/zlib1g_1.2.8.dfsg-5_amd64.deb" - extract_deb "openssl/libssl1.1_1.1.0f-3+deb9u2_amd64.deb" - extract_deb "glibc/libc6_2.24-11+deb9u3_amd64.deb" + extract_deb "openssl/libssl1.1_1.1.0l-1~deb9u1_amd64.deb" + extract_deb "glibc/libc6_2.24-11+deb9u4_amd64.deb" extract_deb "gcc-6/libgcc1_6.3.0-18+deb9u1_amd64.deb" extract_deb "gcc-6/gcc-6-base_6.3.0-18+deb9u1_amd64.deb" diff --git a/external/scdoc.cmake b/external/scdoc.cmake index fd88bab..2fd4259 100644 --- a/external/scdoc.cmake +++ b/external/scdoc.cmake @@ -14,8 +14,8 @@ ENDIF() IF((NOT DEFINED SCDOC_BUILD_OWN AND NOT EXISTS "${scdoc_BINARY_PATH}") OR SCDOC_BUILD_OWN STREQUAL "YES") ExternalProject_Add(scdoc_project - URL https://git.sr.ht/%7Esircmpwn/scdoc/archive/1.5.2.tar.gz - URL_HASH SHA256=5032e857da56a533dc8291012254a61bb36a0c97fe5a964347ec8286c70fdd13 + URL https://git.sr.ht/~sircmpwn/scdoc/archive/1.5.2.tar.gz + URL_HASH SHA256=86591de3741bea5443e7fbc11ff9dc22da90621105b06be524422efd5dec3a29 CONFIGURE_COMMAND true From a1b615b83c5b5ce3e6acca9ac812024b5bd91ed4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Tue, 28 Sep 2021 11:46:39 +0200 Subject: [PATCH 2/7] Python 3.9 and gcc 10.2.1 syscalls --- boxes/CMakeLists.txt | 5 +-- boxes/make_boxes.sh | 25 +++++++++++++++ boxes/manifest.txt | 1 + src/seccomp/policy/DefaultPolicy.cc | 47 +++++++++++++++------------- test/src/CMakeLists.txt | 5 +-- test/src/cpp17_cxx.cc | 10 ++++++ test/src/sum_python3.9.py | 5 +++ test/src/zero | 0 test/testsuits/base/supervisor.py | 28 +++++++++++------ test/testsuits/test_langs.py | 27 ++++++++++++---- test/testsuits/test_threads_limit.py | 26 --------------- test/testsuits/test_times.py | 22 ------------- 12 files changed, 113 insertions(+), 88 deletions(-) create mode 100644 test/src/cpp17_cxx.cc create mode 100755 test/src/sum_python3.9.py create mode 100644 test/src/zero delete mode 100644 test/testsuits/test_threads_limit.py diff --git a/boxes/CMakeLists.txt b/boxes/CMakeLists.txt index 48fafcf..4002c5c 100644 --- a/boxes/CMakeLists.txt +++ b/boxes/CMakeLists.txt @@ -1,6 +1,6 @@ ADD_CUSTOM_COMMAND( OUTPUT - minimal.tar.gz busybox.tar.gz python2.tar.gz python3.tar.gz + minimal.tar.gz busybox.tar.gz python2.tar.gz python3.tar.gz compiler-python3.9.2-numpy_amd64.tar.gz COMMAND ${CMAKE_SOURCE_DIR}/boxes/make_boxes.sh DEPENDS @@ -15,9 +15,10 @@ ADD_CUSTOM_COMMAND( && tar -xvf busybox.tar.gz && tar -xvf python2.tar.gz && tar -xvf python3.tar.gz + && tar -xvf compiler-python3.9.2-numpy_amd64.tar.gz && mv compiler-python3.9.2-numpy_amd64 python3_9 && touch boxes_extraction_stamp.txt DEPENDS - minimal.tar.gz busybox.tar.gz python2.tar.gz python3.tar.gz + minimal.tar.gz busybox.tar.gz python2.tar.gz python3.tar.gz compiler-python3.9.2-numpy_amd64.tar.gz ) ADD_CUSTOM_TARGET(boxes diff --git a/boxes/make_boxes.sh b/boxes/make_boxes.sh index 40a77f3..c72257b 100755 --- a/boxes/make_boxes.sh +++ b/boxes/make_boxes.sh @@ -65,8 +65,33 @@ make_python3() { manifest_box >> $MANIFEST } +make_python3_9() { + short_box_name="python3_9" + box_name="compiler-python3.9.2-numpy_amd64.tar.gz" + box_csum=`cat $MANIFEST | grep $BOX | awk '{ print $1 }'` + URL="https://downloads.sio2project.mimuw.edu.pl/sandboxes" + + if [ -e "$box_name" ]; then + csum=`sha256sum "$box_name" | awk '{ print $1 }'` + if [ "$csum" != "$box_csum" ]; then + echo "** Box $box_name has changed, removing it" + rm "$box_name" + rm -r "$short_box_name" + echo "** Downloading box $box_name" + [ -e "$box_name" ] || wget "$URL/$box_name" + else + echo "** Box $box_name hasn't changed, using it" + fi + else + echo "** Downloading box $box_name" + [ -e "$box_name" ] || wget "$URL/$box_name" + fi + +} + echo -n > $MANIFEST make_minimal make_busybox make_python2 make_python3 +make_python3_9 diff --git a/boxes/manifest.txt b/boxes/manifest.txt index b6ba1af..78dade1 100644 --- a/boxes/manifest.txt +++ b/boxes/manifest.txt @@ -2,3 +2,4 @@ acaf98661235d1e88ebdc20b9381cbe3fc7341130e592bbda2277bedbb56834f busybox.tar.gz c451406e90a6a5d906c591c563fc49dd91e11579121858e4947145d9ec7749e7 python2.tar.gz b2e55c56c7ae4c1ede60681cbd5e883e4a893e1d842a63be453a63f76396e160 python3.tar.gz +dd9645204fc7477130fef4ac12cdb2a7e27c73c894b52a2591aec7a1e78f2878 compiler-python3.9.2-numpy_amd64.tar.gz \ No newline at end of file diff --git a/src/seccomp/policy/DefaultPolicy.cc b/src/seccomp/policy/DefaultPolicy.cc index 2fcbaa5..cf92ff0 100644 --- a/src/seccomp/policy/DefaultPolicy.cc +++ b/src/seccomp/policy/DefaultPolicy.cc @@ -26,20 +26,24 @@ const std::vector& DefaultPolicy::getRules() const { void DefaultPolicy::addExecutionControlRules(bool allowFork) { // Some syscalls must be enabled - allowSyscalls({"restart_syscall", - "getpriority", - "setpriority", - "sigaction", - "sigaltstack", - "rt_sigaction", - "rt_sigprocmask", - "futex", - "set_tid_address", - "set_robust_list", - "getpid", - "getrandom", - "sigaltstack", - "sigsuspend"}); + allowSyscalls( + {"restart_syscall", + "getpriority", + "setpriority", + "sigaction", + "sigaltstack", + "rt_sigaction", + "rt_sigprocmask", + "futex", + "set_tid_address", + "set_robust_list", + "getpid", + "getrandom", + "sigaltstack", + "sigsuspend", + "clock_nanosleep", + "open", + "epoll_create1"}); rules_.emplace_back(SeccompRule( "set_thread_area", action::ActionTrace([](auto& /* tracee */) { @@ -92,13 +96,14 @@ void DefaultPolicy::addExecutionControlRules(bool allowFork) { } void DefaultPolicy::addMemoryManagementRules() { - allowSyscalls({"brk", - "mmap", - "mmap2", - "munmap", - "mremap", - "mprotect", - "arch_prctl"}); + allowSyscalls( + {"brk", + "mmap", + "mmap2", + "munmap", + "mremap", + "mprotect", + "arch_prctl"}); rules_.emplace_back(SeccompRule{"madvise", action::ActionErrno{EINVAL}}); } diff --git a/test/src/CMakeLists.txt b/test/src/CMakeLists.txt index daf2bb5..2dd54c8 100644 --- a/test/src/CMakeLists.txt +++ b/test/src/CMakeLists.txt @@ -1,7 +1,7 @@ SET(CMAKE_C_FLAGS "-std=gnu99 -lm -static -O2") SET(CMAKE_C_FLAGS_DEBUG "") SET(CMAKE_C_FLAGS_RELEASE "") -SET(CMAKE_CXX_FLAGS "-std=c++11 -lm -static -O2") +SET(CMAKE_CXX_FLAGS "-std=c++17 -lm -static -O2") SET(CMAKE_CXX_FLAGS_DEBUG "") SET(CMAKE_CXX_FLAGS_RELEASE "") @@ -45,10 +45,11 @@ SET_TARGET_PROPERTIES(sum_c # Other ADD_EXECUTABLE(stderr-write stderr-write.c) +ADD_EXECUTABLE(cpp17_cxx cpp17_cxx.cc) ADD_CUSTOM_TARGET(test-binaries DEPENDS 1-sec-prog 1-sec-evil infinite-loop 1-sec-prog-th leak-tiny_32 leak-huge_32 leak-dive_32 leak-tiny_64 leak-huge_64 leak-dive_64 - sum_c sum_cxx stderr-write) + sum_c sum_cxx stderr-write cpp17_cxx) diff --git a/test/src/cpp17_cxx.cc b/test/src/cpp17_cxx.cc new file mode 100644 index 0000000..f7a732f --- /dev/null +++ b/test/src/cpp17_cxx.cc @@ -0,0 +1,10 @@ +#include + +int main() { + int a, b; + std::cin >> a >> b; + int array[2] = {a, b}; + auto [c, d] = array; + std::cout << c + d << std::endl; + return 0; +} \ No newline at end of file diff --git a/test/src/sum_python3.9.py b/test/src/sum_python3.9.py new file mode 100755 index 0000000..99525b5 --- /dev/null +++ b/test/src/sum_python3.9.py @@ -0,0 +1,5 @@ +#!/usr/bin/python3.9 + +import numpy as np + +print(np.sum(list(map(int, input().split())))) diff --git a/test/src/zero b/test/src/zero new file mode 100644 index 0000000..e69de29 diff --git a/test/testsuits/base/supervisor.py b/test/testsuits/base/supervisor.py index b686d13..6fd0484 100644 --- a/test/testsuits/base/supervisor.py +++ b/test/testsuits/base/supervisor.py @@ -28,11 +28,12 @@ def run(self, program, stdin=None, extra_options=None): if stdin is not None: stdin = stdin.encode('utf-8') - print("running:\n{}\n".format(" ".join([self.SUPERVISOR_BIN] + options))) + print("running:\n{}\n".format( + " ".join([self.SUPERVISOR_BIN] + options))) process = subprocess.Popen([self.SUPERVISOR_BIN] + options, - stdin=subprocess.PIPE, - stdout=subprocess.PIPE, - stderr=subprocess.PIPE) + stdin=subprocess.PIPE, + stdout=subprocess.PIPE, + stderr=subprocess.PIPE) (stdout, stderr) = process.communicate(stdin) stdout = stdout.decode('utf-8') stderr = stderr.decode('utf-8') @@ -40,7 +41,8 @@ def run(self, program, stdin=None, extra_options=None): if process.poll() is None: process.kill() process.poll() - print("result: {}\n\nstdout:\n{}\nstderr:\n{}\n".format(process.poll(), stdout.strip(), stderr.strip())) + print("result: {}\n\nstdout:\n{}\nstderr:\n{}\n".format( + process.poll(), stdout.strip(), stderr.strip())) result = self.Result() self.parse_results(result, stdout, stderr) @@ -74,7 +76,15 @@ def run(self, program, box=None, memory=None, stdin=None, extra_options=None): def parse_results(self, result, stdout, stderr): lines = [s.strip() for s in stderr.split('\n') if len(s.strip()) > 0] - result.message = lines[-1] - result.return_code = int(lines[-2].split()[1]) - result.memory = int(lines[-2].split()[4]) - result.time = int(lines[-2].split()[2]) / 1000.0 + + if len(lines) < 2: + result.message = lines + result.return_code = None + result.memory = None + result.time = None + + else: + result.message = lines[-1] + result.return_code = int(lines[-2].split()[1]) + result.memory = int(lines[-2].split()[4]) + result.time = int(lines[-2].split()[2]) / 1000.0 diff --git a/test/testsuits/test_langs.py b/test/testsuits/test_langs.py index 4b61b88..7904bed 100644 --- a/test/testsuits/test_langs.py +++ b/test/testsuits/test_langs.py @@ -6,10 +6,18 @@ class TestLanguages(unittest.TestCase): - C_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'sum_c') - CXX_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'sum_cxx') - PYTHON2_PROGRAM_PATH = os.path.join(SOURCE_PATH, './test/src/sum_python2.py') - PYTHON3_PROGRAM_PATH = os.path.join(SOURCE_PATH, './test/src/sum_python3.py') + C_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'sum_c') + CXX_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'sum_cxx') + CPP17_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'cpp17_cxx') + PYTHON2_PROGRAM_PATH = os.path.join( + SOURCE_PATH, './test/src/sum_python2.py') + PYTHON3_PROGRAM_PATH = os.path.join( + SOURCE_PATH, './test/src/sum_python3.py') + + PYTHON3_9_PROGRAM_PATH = os.path.join( + SOURCE_PATH, './test/src/sum_python3.9.py') + + URANDOM_MOCKED_FILE = os.path.join(SOURCE_PATH, './test/src/zero') def setUp(self): self.sio2jail = SIO2Jail() @@ -31,6 +39,13 @@ def test_cxx(self): def test_python2(self): self.perform(self.PYTHON2_PROGRAM_PATH, box='python2') - def test_python3(self): + def test_python3_5(self): self.perform(self.PYTHON3_PROGRAM_PATH, box='python3', - extra_options=['-b', '/dev/urandom:/dev/urandom:ro,dev']) + extra_options=['-b', self.URANDOM_MOCKED_FILE + ':/dev/urandom:ro,dev']) + + def test_python3_9(self): + self.perform(self.PYTHON3_9_PROGRAM_PATH, box='python3_9', + extra_options=['--memory-limit', "100M"]) + + def test_cpp17(self): + self.perform(self.CPP17_PROGRAM_PATH) diff --git a/test/testsuits/test_threads_limit.py b/test/testsuits/test_threads_limit.py deleted file mode 100644 index 1cd62e9..0000000 --- a/test/testsuits/test_threads_limit.py +++ /dev/null @@ -1,26 +0,0 @@ -import os -import unittest - -from base.supervisor import SIO2Jail -from base.paths import * - -class TestThreadsLimit(unittest.TestCase): - SEC_PROGRAM_TH_PATH = os.path.join(TEST_BIN_PATH, '1-sec-prog-th') - - def setUp(self): - self.sio2jail = SIO2Jail() - - def test_threads_limit_exceeded_flat(self): - result = self.sio2jail.run( - [self.SEC_PROGRAM_TH_PATH, 'flat', 6], - memory='1G', - extra_options=['-t', 5]) - self.assertEqual(result.message, 'threads limit exceeded') - - def test_threads_limit_exceeded_deep(self): - # In - result = self.sio2jail.run( - [self.SEC_PROGRAM_TH_PATH, 'deep', 6], - memory='1G', - extra_options=['-t', 5]) - self.assertEqual(result.message, 'threads limit exceeded') diff --git a/test/testsuits/test_times.py b/test/testsuits/test_times.py index d1a1b67..e192211 100644 --- a/test/testsuits/test_times.py +++ b/test/testsuits/test_times.py @@ -7,7 +7,6 @@ class TestReportedTimes(unittest.TestCase): SEC_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, '1-sec-prog') - SEC_PROGRAM_TH_PATH = os.path.join(TEST_BIN_PATH, '1-sec-prog-th') def setUp(self): self.sio2jail = SIO2Jail() @@ -15,24 +14,3 @@ def setUp(self): def test_1_sec_program(self): result = self.sio2jail.run(self.SEC_PROGRAM_PATH) self.assertAlmostEqual(result.time, 1.0) - - def test_1_sec_program_threads_1(self): - result = self.sio2jail.run( - [self.SEC_PROGRAM_TH_PATH, 'flat', 1], - memory='1G', - extra_options=['-t', 1]) - self.assertAlmostEqual(result.time, 1.0) - - def test_1_sec_program_threads_5_flat(self): - result = self.sio2jail.run( - [self.SEC_PROGRAM_TH_PATH, 'flat', 5], - memory='1G', - extra_options=['-t', 5]) - self.assertAlmostEqual(result.time, 1.0) - - def test_1_sec_program_threads_5_deep(self): - result = self.sio2jail.run( - [self.SEC_PROGRAM_TH_PATH, 'deep', 5], - memory='1G', - extra_options=['-t', 5]) - self.assertAlmostEqual(result.time, 1.0) From dff0d1ca54321014eaee0951d0b1f70438490545 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Tue, 28 Sep 2021 12:06:02 +0200 Subject: [PATCH 3/7] ExpectedFailure threads test with potential race condition --- test/testsuits/test_threads_limit.py | 28 ++++++++++++++++++++++++++++ test/testsuits/test_times.py | 24 ++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 test/testsuits/test_threads_limit.py diff --git a/test/testsuits/test_threads_limit.py b/test/testsuits/test_threads_limit.py new file mode 100644 index 0000000..2a3b33d --- /dev/null +++ b/test/testsuits/test_threads_limit.py @@ -0,0 +1,28 @@ +import os +import unittest + +from base.supervisor import SIO2Jail +from base.paths import * + + +class TestThreadsLimit(unittest.TestCase): + SEC_PROGRAM_TH_PATH = os.path.join(TEST_BIN_PATH, '1-sec-prog-th') + + def setUp(self): + self.sio2jail = SIO2Jail() + + @unittest.expectedFailure + def test_threads_limit_exceeded_flat_race_condition(self): + result = self.sio2jail.run( + [self.SEC_PROGRAM_TH_PATH, 'flat', 16], + memory='1G', + extra_options=['-t', 15]) + self.assertEqual(result.message, 'threads limit exceeded') + + @unittest.expectedFailure + def test_threads_limit_exceeded_deep_race_condition(self): + result = self.sio2jail.run( + [self.SEC_PROGRAM_TH_PATH, 'deep', 16], + memory='1G', + extra_options=['-t', 15]) + self.assertEqual(result.message, 'threads limit exceeded') diff --git a/test/testsuits/test_times.py b/test/testsuits/test_times.py index e192211..ce59b02 100644 --- a/test/testsuits/test_times.py +++ b/test/testsuits/test_times.py @@ -7,6 +7,7 @@ class TestReportedTimes(unittest.TestCase): SEC_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, '1-sec-prog') + SEC_PROGRAM_TH_PATH = os.path.join(TEST_BIN_PATH, '1-sec-prog-th') def setUp(self): self.sio2jail = SIO2Jail() @@ -14,3 +15,26 @@ def setUp(self): def test_1_sec_program(self): result = self.sio2jail.run(self.SEC_PROGRAM_PATH) self.assertAlmostEqual(result.time, 1.0) + + def test_1_sec_program_threads_1(self): + result = self.sio2jail.run( + [self.SEC_PROGRAM_TH_PATH, 'flat', 1], + memory='1G', + extra_options=['-t', 1]) + self.assertAlmostEqual(result.time, 1.0) + + @unittest.expectedFailure + def test_1_sec_program_threads_15_flat(self): + result = self.sio2jail.run( + [self.SEC_PROGRAM_TH_PATH, 'flat', 15], + memory='1G', + extra_options=['-t', 15]) + self.assertAlmostEqual(result.time, 1.0) + + @unittest.expectedFailure + def test_1_sec_program_threads_15_deep(self): + result = self.sio2jail.run( + [self.SEC_PROGRAM_TH_PATH, 'deep', 15], + memory='1G', + extra_options=['-t', 15]) + self.assertAlmostEqual(result.time, 1.0) From af17466fa206cb29b18e7a804391959f47069740 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Tue, 12 Oct 2021 20:38:08 +0200 Subject: [PATCH 4/7] Bump sio2jail to 1.4.0-beta --- src/s2japp/ApplicationSettings.cc | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/src/s2japp/ApplicationSettings.cc b/src/s2japp/ApplicationSettings.cc index d2ab1e3..b852c19 100644 --- a/src/s2japp/ApplicationSettings.cc +++ b/src/s2japp/ApplicationSettings.cc @@ -1,6 +1,6 @@ +#include "ApplicationSettings.h" #include "ApplicationArguments.h" #include "ApplicationException.h" -#include "ApplicationSettings.h" #include "common/Utils.h" #include "printer/AugmentedOIOutputBuilder.h" @@ -80,7 +80,7 @@ class StringOutputGenerator : public TCLAP::StdOutput { namespace s2j { namespace app { -const std::string ApplicationSettings::VERSION = "1.3.0"; +const std::string ApplicationSettings::VERSION = "1.4.0-beta"; const std::string ApplicationSettings::DESCRIPTION = "SIO2jail, a sandbox for programming contests."; @@ -115,12 +115,10 @@ const std::map> {"procfs", {Feature::MOUNT_PROCFS, false}}, {"capability-drop", {Feature::CAPABILITY_DROP, true}}}); -const std::vector ApplicationSettings::FLAGS_ON({"on", - "yes", - "1"}); -const std::vector ApplicationSettings::FLAGS_OFF({"off", - "no", - "0"}); +const std::vector ApplicationSettings::FLAGS_ON( + {"on", "yes", "1"}); +const std::vector ApplicationSettings::FLAGS_OFF( + {"off", "no", "0"}); ApplicationSettings::ApplicationSettings() : action(Action::PRINT_HELP) From 1c719e30788b3beb5d9ca1338911004f1310b0ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Sun, 17 Oct 2021 22:41:55 +0200 Subject: [PATCH 5/7] Remove c++17 test --- test/src/CMakeLists.txt | 3 +-- test/src/cpp17_cxx.cc | 10 ---------- test/testsuits/test_langs.py | 4 ---- 3 files changed, 1 insertion(+), 16 deletions(-) delete mode 100644 test/src/cpp17_cxx.cc diff --git a/test/src/CMakeLists.txt b/test/src/CMakeLists.txt index 2dd54c8..cc17f81 100644 --- a/test/src/CMakeLists.txt +++ b/test/src/CMakeLists.txt @@ -45,11 +45,10 @@ SET_TARGET_PROPERTIES(sum_c # Other ADD_EXECUTABLE(stderr-write stderr-write.c) -ADD_EXECUTABLE(cpp17_cxx cpp17_cxx.cc) ADD_CUSTOM_TARGET(test-binaries DEPENDS 1-sec-prog 1-sec-evil infinite-loop 1-sec-prog-th leak-tiny_32 leak-huge_32 leak-dive_32 leak-tiny_64 leak-huge_64 leak-dive_64 - sum_c sum_cxx stderr-write cpp17_cxx) + sum_c sum_cxx stderr-write) diff --git a/test/src/cpp17_cxx.cc b/test/src/cpp17_cxx.cc deleted file mode 100644 index f7a732f..0000000 --- a/test/src/cpp17_cxx.cc +++ /dev/null @@ -1,10 +0,0 @@ -#include - -int main() { - int a, b; - std::cin >> a >> b; - int array[2] = {a, b}; - auto [c, d] = array; - std::cout << c + d << std::endl; - return 0; -} \ No newline at end of file diff --git a/test/testsuits/test_langs.py b/test/testsuits/test_langs.py index 7904bed..a305f22 100644 --- a/test/testsuits/test_langs.py +++ b/test/testsuits/test_langs.py @@ -8,7 +8,6 @@ class TestLanguages(unittest.TestCase): C_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'sum_c') CXX_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'sum_cxx') - CPP17_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, 'cpp17_cxx') PYTHON2_PROGRAM_PATH = os.path.join( SOURCE_PATH, './test/src/sum_python2.py') PYTHON3_PROGRAM_PATH = os.path.join( @@ -46,6 +45,3 @@ def test_python3_5(self): def test_python3_9(self): self.perform(self.PYTHON3_9_PROGRAM_PATH, box='python3_9', extra_options=['--memory-limit', "100M"]) - - def test_cpp17(self): - self.perform(self.CPP17_PROGRAM_PATH) From 57224a32cf83524e8c292ad127aa3d7025486a7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Sun, 17 Oct 2021 22:47:27 +0200 Subject: [PATCH 6/7] Add openat syscall to exceptions, remove 1-sec-evil test --- src/seccomp/policy/DefaultPolicy.cc | 3 ++- test/src/1-sec-evil.c | 16 ---------------- test/src/CMakeLists.txt | 4 +--- test/src/sum_python3.9.py | 4 ++-- test/testsuits/test_policy.py | 17 ----------------- 5 files changed, 5 insertions(+), 39 deletions(-) delete mode 100644 test/src/1-sec-evil.c delete mode 100644 test/testsuits/test_policy.py diff --git a/src/seccomp/policy/DefaultPolicy.cc b/src/seccomp/policy/DefaultPolicy.cc index cf92ff0..f901f2c 100644 --- a/src/seccomp/policy/DefaultPolicy.cc +++ b/src/seccomp/policy/DefaultPolicy.cc @@ -43,7 +43,8 @@ void DefaultPolicy::addExecutionControlRules(bool allowFork) { "sigsuspend", "clock_nanosleep", "open", - "epoll_create1"}); + "epoll_create1", + "openat"}); rules_.emplace_back(SeccompRule( "set_thread_area", action::ActionTrace([](auto& /* tracee */) { diff --git a/test/src/1-sec-evil.c b/test/src/1-sec-evil.c deleted file mode 100644 index 20de9f4..0000000 --- a/test/src/1-sec-evil.c +++ /dev/null @@ -1,16 +0,0 @@ -#include -#include - -int main() { - int i = 2; - int j = i; - for(;i<500000000;++i) - j += i; - - int fd = open("score.txt", O_RDWR); - - /* ... */ - - printf("%d\n", j-1711656321); - return 0; -} diff --git a/test/src/CMakeLists.txt b/test/src/CMakeLists.txt index cc17f81..c1f9545 100644 --- a/test/src/CMakeLists.txt +++ b/test/src/CMakeLists.txt @@ -7,10 +7,8 @@ SET(CMAKE_CXX_FLAGS_RELEASE "") # Time tests ADD_EXECUTABLE(1-sec-prog 1-sec-prog.c) -ADD_EXECUTABLE(1-sec-evil 1-sec-evil.c) ADD_EXECUTABLE(infinite-loop infinite-loop.c) SET_TARGET_PROPERTIES(1-sec-prog - 1-sec-evil infinite-loop PROPERTIES COMPILE_FLAGS "-m32" LINK_FLAGS "-m32") @@ -48,7 +46,7 @@ ADD_EXECUTABLE(stderr-write stderr-write.c) ADD_CUSTOM_TARGET(test-binaries DEPENDS - 1-sec-prog 1-sec-evil infinite-loop 1-sec-prog-th + 1-sec-prog infinite-loop 1-sec-prog-th leak-tiny_32 leak-huge_32 leak-dive_32 leak-tiny_64 leak-huge_64 leak-dive_64 sum_c sum_cxx stderr-write) diff --git a/test/src/sum_python3.9.py b/test/src/sum_python3.9.py index 99525b5..e953446 100755 --- a/test/src/sum_python3.9.py +++ b/test/src/sum_python3.9.py @@ -1,5 +1,5 @@ #!/usr/bin/python3.9 -import numpy as np +import numpy -print(np.sum(list(map(int, input().split())))) +print(numpy.sum(list(map(int, input().split())))) diff --git a/test/testsuits/test_policy.py b/test/testsuits/test_policy.py deleted file mode 100644 index 5a1d150..0000000 --- a/test/testsuits/test_policy.py +++ /dev/null @@ -1,17 +0,0 @@ -import os -import unittest - -from base.supervisor import SIO2Jail -from base.paths import * - - -class TestPolicy(unittest.TestCase): - EVIL_PROGRAM_PATH = os.path.join(TEST_BIN_PATH, '1-sec-evil') - - def setUp(self): - self.sio2jail = SIO2Jail() - - def test_1_sec_program(self): - result = self.sio2jail.run(self.EVIL_PROGRAM_PATH) - self.assertIn('forbidden syscall', result.message) - self.assertIn(result.return_code, [121]) From 44f6af8278510db25da434e59c60c8972ad5b4c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bart=C5=82omiej=20Chmiel?= Date: Sun, 17 Oct 2021 22:47:45 +0200 Subject: [PATCH 7/7] Bump sio2jail to 1.4.1-beta --- src/s2japp/ApplicationSettings.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/s2japp/ApplicationSettings.cc b/src/s2japp/ApplicationSettings.cc index b852c19..d62912d 100644 --- a/src/s2japp/ApplicationSettings.cc +++ b/src/s2japp/ApplicationSettings.cc @@ -80,7 +80,7 @@ class StringOutputGenerator : public TCLAP::StdOutput { namespace s2j { namespace app { -const std::string ApplicationSettings::VERSION = "1.4.0-beta"; +const std::string ApplicationSettings::VERSION = "1.4.1-beta"; const std::string ApplicationSettings::DESCRIPTION = "SIO2jail, a sandbox for programming contests.";