mirror of
https://github.com/renbaoshuo/S2OJ.git
synced 2024-09-20 17:15:18 +00:00
d030c261b2
Java 7 is now out of support. A large number of people use Java 8. As the latest Java LTS version, now add support for Java 11. Due to the policies from Oracle, SunJDK is replaced.
781 lines
23 KiB
C
781 lines
23 KiB
C
#ifdef __x86_64__
|
|
typedef unsigned long long int reg_val_t;
|
|
#define REG_SYSCALL orig_rax
|
|
#define REG_RET rax
|
|
#define REG_ARG0 rdi
|
|
#define REG_ARG1 rsi
|
|
#define REG_ARG2 rdx
|
|
#define REG_ARG3 rcx
|
|
#else
|
|
typedef long int reg_val_t;
|
|
#define REG_SYSCALL orig_eax
|
|
#define REG_RET eax
|
|
#define REG_ARG0 ebx
|
|
#define REG_ARG1 ecx
|
|
#define REG_ARG2 edx
|
|
#define REG_ARG3 esx
|
|
#endif
|
|
|
|
const size_t MaxPathLen = 200;
|
|
|
|
set<string> writable_file_name_set;
|
|
set<string> readable_file_name_set;
|
|
set<string> statable_file_name_set;
|
|
set<string> soft_ban_file_name_set;
|
|
int syscall_max_cnt[1000];
|
|
bool syscall_should_soft_ban[1000];
|
|
|
|
string basename(const string &path) {
|
|
size_t p = path.rfind('/');
|
|
if (p == string::npos) {
|
|
return path;
|
|
} else {
|
|
return path.substr(p + 1);
|
|
}
|
|
}
|
|
string dirname(const string &path) {
|
|
size_t p = path.rfind('/');
|
|
if (p == string::npos) {
|
|
return "";
|
|
} else {
|
|
return path.substr(0, p);
|
|
}
|
|
}
|
|
string getcwdp(pid_t pid) {
|
|
char s[20];
|
|
char cwd[MaxPathLen + 1];
|
|
if (pid != 0) {
|
|
sprintf(s, "/proc/%lld/cwd", (long long int)pid);
|
|
} else {
|
|
sprintf(s, "/proc/self/cwd");
|
|
}
|
|
int l = readlink(s, cwd, MaxPathLen);
|
|
if (l == -1) {
|
|
return "";
|
|
}
|
|
cwd[l] = '\0';
|
|
return cwd;
|
|
}
|
|
string abspath(pid_t pid, const string &path) {
|
|
if (path.size() > MaxPathLen) {
|
|
return "";
|
|
}
|
|
if (path.empty()) {
|
|
return path;
|
|
}
|
|
string s;
|
|
string b;
|
|
size_t st;
|
|
if (path[0] == '/') {
|
|
s = "/";
|
|
st = 1;
|
|
} else {
|
|
s = getcwdp(pid) + "/";
|
|
st = 0;
|
|
}
|
|
for (size_t i = st; i < path.size(); i++) {
|
|
b += path[i];
|
|
if (path[i] == '/') {
|
|
if (b == "../" && !s.empty()) {
|
|
if (s == "./") {
|
|
s = "../";
|
|
} else if (s != "/") {
|
|
size_t p = s.size() - 1;
|
|
while (p > 0 && s[p - 1] != '/') {
|
|
p--;
|
|
}
|
|
if (s.size() - p == 3 && s[p] == '.' && s[p + 1] == '.' && s[p + 2] == '/') {
|
|
s += b;
|
|
} else {
|
|
s.resize(p);
|
|
}
|
|
}
|
|
} else if (b != "./" && b != "/") {
|
|
s += b;
|
|
}
|
|
b.clear();
|
|
}
|
|
}
|
|
if (b == ".." && !s.empty()) {
|
|
if (s == "./") {
|
|
s = "..";
|
|
} else if (s != "/") {
|
|
size_t p = s.size() - 1;
|
|
while (p > 0 && s[p - 1] != '/') {
|
|
p--;
|
|
}
|
|
if (s.size() - p == 3 && s[p] == '.' && s[p + 1] == '.' && s[p + 2] == '/') {
|
|
s += b;
|
|
} else {
|
|
s.resize(p);
|
|
}
|
|
}
|
|
} else if (b != ".") {
|
|
s += b;
|
|
}
|
|
if (s.size() >= 2 && s[s.size() - 1] == '/') {
|
|
s.resize(s.size() - 1);
|
|
}
|
|
return s;
|
|
}
|
|
string realpath(const string &path) {
|
|
char real[PATH_MAX + 1] = {};
|
|
if (realpath(path.c_str(), real) == NULL) {
|
|
return "";
|
|
}
|
|
return real;
|
|
}
|
|
|
|
inline bool is_in_set_smart(string name, const set<string> &s) {
|
|
if (name.size() > MaxPathLen) {
|
|
return false;
|
|
}
|
|
if (s.count(name)) {
|
|
return true;
|
|
}
|
|
for (size_t i = 0; i + 1 < name.size(); i++) {
|
|
if ((i == 0 || name[i - 1] == '/') && name[i] == '.' && name[i + 1] == '.' && (i + 2 == name.size() || name[i + 2] == '.')) {
|
|
return false;
|
|
}
|
|
}
|
|
int level;
|
|
for (level = 0; !name.empty(); name = dirname(name), level++) {
|
|
if (level == 1 && s.count(name + "/*")) {
|
|
return true;
|
|
}
|
|
if (s.count(name + "/")) {
|
|
return true;
|
|
}
|
|
}
|
|
if (level == 1 && s.count("/*")) {
|
|
return true;
|
|
}
|
|
if (s.count("/")) {
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
inline bool is_writable_file(string name) {
|
|
if (name == "/") {
|
|
return writable_file_name_set.count("system_root");
|
|
}
|
|
return is_in_set_smart(name, writable_file_name_set) || is_in_set_smart(realpath(name), readable_file_name_set);
|
|
}
|
|
inline bool is_readable_file(const string &name) {
|
|
if (is_writable_file(name)) {
|
|
return true;
|
|
}
|
|
if (name == "/") {
|
|
return readable_file_name_set.count("system_root");
|
|
}
|
|
return is_in_set_smart(name, readable_file_name_set) || is_in_set_smart(realpath(name), readable_file_name_set);
|
|
}
|
|
inline bool is_statable_file(const string &name) {
|
|
if (is_readable_file(name)) {
|
|
return true;
|
|
}
|
|
if (name == "/") {
|
|
return statable_file_name_set.count("system_root");
|
|
}
|
|
return is_in_set_smart(name, statable_file_name_set) || is_in_set_smart(realpath(name), statable_file_name_set);
|
|
}
|
|
inline bool is_soft_ban_file(const string &name) {
|
|
if (name == "/") {
|
|
return soft_ban_file_name_set.count("system_root");
|
|
}
|
|
return is_in_set_smart(name, soft_ban_file_name_set) || is_in_set_smart(realpath(name), soft_ban_file_name_set);
|
|
}
|
|
|
|
#ifdef __x86_64__
|
|
int syscall_max_cnt_list_default[][2] = {
|
|
{__NR_read , -1},
|
|
{__NR_write , -1},
|
|
{__NR_readv , -1},
|
|
{__NR_writev , -1},
|
|
{__NR_open , -1},
|
|
{__NR_unlink , -1},
|
|
{__NR_close , -1},
|
|
{__NR_readlink , -1},
|
|
{__NR_openat , -1},
|
|
{__NR_unlinkat , -1},
|
|
{__NR_readlinkat , -1},
|
|
{__NR_stat , -1},
|
|
{__NR_fstat , -1},
|
|
{__NR_lstat , -1},
|
|
{__NR_lseek , -1},
|
|
{__NR_access , -1},
|
|
{__NR_dup , -1},
|
|
{__NR_dup2 , -1},
|
|
{__NR_dup3 , -1},
|
|
{__NR_ioctl , -1},
|
|
{__NR_fcntl , -1},
|
|
|
|
{__NR_mmap , -1},
|
|
{__NR_mprotect , -1},
|
|
{__NR_munmap , -1},
|
|
{__NR_brk , -1},
|
|
{__NR_mremap , -1},
|
|
{__NR_msync , -1},
|
|
{__NR_mincore , -1},
|
|
{__NR_madvise , -1},
|
|
|
|
{__NR_rt_sigaction , -1},
|
|
{__NR_rt_sigprocmask, -1},
|
|
{__NR_rt_sigreturn , -1},
|
|
{__NR_rt_sigpending , -1},
|
|
{__NR_sigaltstack , -1},
|
|
|
|
{__NR_getcwd , -1},
|
|
|
|
{__NR_exit , -1},
|
|
{__NR_exit_group , -1},
|
|
|
|
{__NR_arch_prctl , -1},
|
|
|
|
{__NR_gettimeofday , -1},
|
|
{__NR_getrlimit , -1},
|
|
{__NR_getrusage , -1},
|
|
{__NR_times , -1},
|
|
{__NR_time , -1},
|
|
{__NR_clock_gettime , -1},
|
|
|
|
{__NR_restart_syscall, -1},
|
|
|
|
{-1 , -1}
|
|
};
|
|
|
|
int syscall_soft_ban_list_default[] = {
|
|
-1
|
|
};
|
|
|
|
const char *readable_file_name_list_default[] = {
|
|
"/etc/ld.so.nohwcap",
|
|
"/etc/ld.so.preload",
|
|
"/etc/ld.so.cache",
|
|
"/lib/x86_64-linux-gnu/",
|
|
"/usr/lib/x86_64-linux-gnu/",
|
|
"/usr/lib/locale/locale-archive",
|
|
"/proc/self/exe",
|
|
"/etc/timezone",
|
|
"/usr/share/zoneinfo/",
|
|
"/dev/random",
|
|
"/dev/urandom",
|
|
"/proc/meminfo",
|
|
"/etc/localtime",
|
|
NULL
|
|
};
|
|
|
|
#else
|
|
#error T_T
|
|
#endif
|
|
|
|
void add_file_permission(const string &file_name, char mode) {
|
|
if (mode == 'w') {
|
|
writable_file_name_set.insert(file_name);
|
|
} else if (mode == 'r') {
|
|
readable_file_name_set.insert(file_name);
|
|
} else if (mode == 's') {
|
|
statable_file_name_set.insert(file_name);
|
|
}
|
|
for (string name = dirname(file_name); !name.empty(); name = dirname(name)) {
|
|
statable_file_name_set.insert(name);
|
|
}
|
|
}
|
|
|
|
void init_conf(const RunProgramConfig &config) {
|
|
for (int i = 0; syscall_max_cnt_list_default[i][0] != -1; i++) {
|
|
syscall_max_cnt[syscall_max_cnt_list_default[i][0]] = syscall_max_cnt_list_default[i][1];
|
|
}
|
|
for (int i = 0; syscall_soft_ban_list_default[i] != -1; i++) {
|
|
syscall_should_soft_ban[syscall_soft_ban_list_default[i]] = true;
|
|
}
|
|
|
|
for (int i = 0; readable_file_name_list_default[i]; i++) {
|
|
readable_file_name_set.insert(readable_file_name_list_default[i]);
|
|
}
|
|
statable_file_name_set.insert(config.work_path + "/");
|
|
|
|
if (config.type != "java8" && config.type != "java11") {
|
|
add_file_permission(config.program_name, 'r');
|
|
} else {
|
|
int p = config.program_name.find('.');
|
|
if (p == string::npos) {
|
|
readable_file_name_set.insert(config.work_path + "/");
|
|
} else {
|
|
readable_file_name_set.insert(config.work_path + "/" + config.program_name.substr(0, p) + "/");
|
|
}
|
|
}
|
|
add_file_permission(config.work_path, 'r');
|
|
|
|
for (vector<string>::const_iterator it = config.extra_readable_files.begin(); it != config.extra_readable_files.end(); it++) {
|
|
add_file_permission(*it, 'r');
|
|
}
|
|
for (vector<string>::const_iterator it = config.extra_writable_files.begin(); it != config.extra_writable_files.end(); it++) {
|
|
add_file_permission(*it, 'w');
|
|
}
|
|
|
|
writable_file_name_set.insert("/dev/null");
|
|
|
|
if (config.allow_proc) {
|
|
syscall_max_cnt[__NR_clone ] = -1;
|
|
syscall_max_cnt[__NR_fork ] = -1;
|
|
syscall_max_cnt[__NR_vfork ] = -1;
|
|
syscall_max_cnt[__NR_nanosleep ] = -1;
|
|
syscall_max_cnt[__NR_execve ] = -1;
|
|
}
|
|
|
|
if (config.type == "python2.7") {
|
|
syscall_max_cnt[__NR_set_tid_address] = 1;
|
|
syscall_max_cnt[__NR_set_robust_list] = 1;
|
|
syscall_max_cnt[__NR_futex ] = -1;
|
|
|
|
syscall_max_cnt[__NR_getdents ] = -1;
|
|
syscall_max_cnt[__NR_getdents64 ] = -1;
|
|
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
syscall_max_cnt[__NR_prlimit64 ] = -1;
|
|
syscall_max_cnt[__NR_getpid ] = -1;
|
|
syscall_max_cnt[__NR_sysinfo ] = -1;
|
|
# endif
|
|
|
|
readable_file_name_set.insert("/usr/bin/python2.7");
|
|
readable_file_name_set.insert("/usr/lib/python2.7/");
|
|
readable_file_name_set.insert("/usr/bin/lib/python2.7/");
|
|
readable_file_name_set.insert("/usr/local/lib/python2.7/");
|
|
readable_file_name_set.insert("/usr/lib/pymodules/python2.7/");
|
|
readable_file_name_set.insert("/usr/bin/Modules/");
|
|
readable_file_name_set.insert("/usr/bin/pybuilddir.txt");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
readable_file_name_set.insert("/usr/lib/locale/");
|
|
readable_file_name_set.insert(config.work_path + "/answer.code");
|
|
# endif
|
|
|
|
statable_file_name_set.insert("/usr");
|
|
statable_file_name_set.insert("/usr/bin");
|
|
} else if (config.type == "python3") {
|
|
syscall_max_cnt[__NR_set_tid_address] = 1;
|
|
syscall_max_cnt[__NR_set_robust_list] = 1;
|
|
syscall_max_cnt[__NR_futex ] = -1;
|
|
|
|
syscall_max_cnt[__NR_getdents ] = -1;
|
|
syscall_max_cnt[__NR_getdents64 ] = -1;
|
|
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
syscall_max_cnt[__NR_prlimit64 ] = -1;
|
|
syscall_max_cnt[__NR_getrandom ] = -1;
|
|
syscall_max_cnt[__NR_sysinfo ] = -1;
|
|
syscall_max_cnt[__NR_getpid ] = -1;
|
|
# endif
|
|
|
|
readable_file_name_set.insert("/usr/bin/python3");
|
|
readable_file_name_set.insert("/usr/lib/python3/");
|
|
# ifndef UOJ_JUDGER_PYTHON3_VERSION
|
|
readable_file_name_set.insert("/usr/bin/python3.4");
|
|
readable_file_name_set.insert("/usr/lib/python3.4/");
|
|
readable_file_name_set.insert("/usr/bin/lib/python3.4/");
|
|
readable_file_name_set.insert("/usr/local/lib/python3.4/");
|
|
# endif
|
|
# ifdef UOJ_JUDGER_PYTHON3_VERSION
|
|
readable_file_name_set.insert("/usr/bin/python" UOJ_JUDGER_PYTHON3_VERSION);
|
|
readable_file_name_set.insert("/usr/lib/python" UOJ_JUDGER_PYTHON3_VERSION "/");
|
|
readable_file_name_set.insert("/usr/bin/lib/python" UOJ_JUDGER_PYTHON3_VERSION "/");
|
|
readable_file_name_set.insert("/usr/local/lib/python" UOJ_JUDGER_PYTHON3_VERSION "/");
|
|
# endif
|
|
readable_file_name_set.insert("/usr/bin/pyvenv.cfg");
|
|
readable_file_name_set.insert("/usr/pyvenv.cfg");
|
|
readable_file_name_set.insert("/usr/bin/Modules/");
|
|
readable_file_name_set.insert("/usr/bin/pybuilddir.txt");
|
|
readable_file_name_set.insert("/usr/lib/dist-python");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
readable_file_name_set.insert("/usr/lib/locale/");
|
|
readable_file_name_set.insert(config.work_path + "/answer.code");
|
|
# endif
|
|
|
|
statable_file_name_set.insert("/usr");
|
|
statable_file_name_set.insert("/usr/bin");
|
|
statable_file_name_set.insert("/usr/lib");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
statable_file_name_set.insert("/usr/lib/python36.zip");
|
|
# endif
|
|
} else if (config.type == "java8") {
|
|
syscall_max_cnt[__NR_gettid ] = -1;
|
|
syscall_max_cnt[__NR_set_tid_address] = 1;
|
|
syscall_max_cnt[__NR_set_robust_list] = 14;
|
|
syscall_max_cnt[__NR_futex ] = -1;
|
|
|
|
syscall_max_cnt[__NR_uname ] = 1;
|
|
|
|
syscall_max_cnt[__NR_clone ] = 13;
|
|
|
|
syscall_max_cnt[__NR_getdents ] = 4;
|
|
|
|
syscall_max_cnt[__NR_clock_getres ] = 2;
|
|
|
|
syscall_max_cnt[__NR_setrlimit ] = 1;
|
|
|
|
syscall_max_cnt[__NR_sched_getaffinity] = -1;
|
|
syscall_max_cnt[__NR_sched_yield ] = -1;
|
|
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
syscall_max_cnt[__NR_prlimit64 ] = -1;
|
|
syscall_max_cnt[__NR_getpid ] = -1;
|
|
syscall_max_cnt[__NR_sysinfo ] = -1;
|
|
syscall_max_cnt[__NR_clone ] = -1;
|
|
syscall_max_cnt[__NR_set_robust_list] = -1;
|
|
# endif
|
|
|
|
syscall_should_soft_ban[__NR_socket ] = true;
|
|
syscall_should_soft_ban[__NR_connect ] = true;
|
|
syscall_should_soft_ban[__NR_geteuid ] = true;
|
|
syscall_should_soft_ban[__NR_getuid ] = true;
|
|
|
|
soft_ban_file_name_set.insert("/etc/nsswitch.conf");
|
|
soft_ban_file_name_set.insert("/etc/passwd");
|
|
|
|
add_file_permission("/usr/lib/jvm/java-8-openjdk-amd64/", 'r');
|
|
readable_file_name_set.insert("/sys/devices/system/cpu/");
|
|
readable_file_name_set.insert("/proc/");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
readable_file_name_set.insert("/sys/fs/cgroup/cpu/");
|
|
readable_file_name_set.insert("/sys/fs/cgroup/memory/");
|
|
readable_file_name_set.insert("/usr/lib/locale/");
|
|
# endif
|
|
statable_file_name_set.insert("/usr/java/");
|
|
statable_file_name_set.insert("/tmp/");
|
|
} else if (config.type == "java11") {
|
|
syscall_max_cnt[__NR_gettid ] = -1;
|
|
syscall_max_cnt[__NR_set_tid_address] = 1;
|
|
syscall_max_cnt[__NR_set_robust_list] = 15;
|
|
syscall_max_cnt[__NR_futex ] = -1;
|
|
|
|
syscall_max_cnt[__NR_uname ] = 1;
|
|
|
|
syscall_max_cnt[__NR_clone ] = 14;
|
|
|
|
syscall_max_cnt[__NR_getdents ] = 4;
|
|
|
|
syscall_max_cnt[__NR_clock_getres ] = 2;
|
|
|
|
syscall_max_cnt[__NR_setrlimit ] = 1;
|
|
|
|
syscall_max_cnt[__NR_sched_getaffinity] = -1;
|
|
syscall_max_cnt[__NR_sched_yield ] = -1;
|
|
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
syscall_max_cnt[__NR_prlimit64 ] = -1;
|
|
syscall_max_cnt[__NR_getpid ] = -1;
|
|
syscall_max_cnt[__NR_sysinfo ] = -1;
|
|
syscall_max_cnt[__NR_clone ] = -1;
|
|
syscall_max_cnt[__NR_set_robust_list] = -1;
|
|
syscall_max_cnt[__NR_uname ] = -1;
|
|
syscall_max_cnt[__NR_clock_getres ] = -1;
|
|
syscall_max_cnt[__NR_pread64 ] = -1;
|
|
syscall_max_cnt[__NR_prctl ] = -1;
|
|
syscall_max_cnt[__NR_nanosleep ] = -1;
|
|
# endif
|
|
|
|
syscall_should_soft_ban[__NR_socket ] = true;
|
|
syscall_should_soft_ban[__NR_connect ] = true;
|
|
syscall_should_soft_ban[__NR_geteuid ] = true;
|
|
syscall_should_soft_ban[__NR_getuid ] = true;
|
|
|
|
soft_ban_file_name_set.insert("/etc/nsswitch.conf");
|
|
soft_ban_file_name_set.insert("/etc/passwd");
|
|
|
|
add_file_permission("/usr/lib/jvm/java-11-openjdk-amd64/", 'r');
|
|
readable_file_name_set.insert("/sys/devices/system/cpu/");
|
|
readable_file_name_set.insert("/proc/");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
readable_file_name_set.insert("/sys/fs/cgroup/cpu/");
|
|
readable_file_name_set.insert("/sys/fs/cgroup/memory/");
|
|
readable_file_name_set.insert("/usr/share/java/");
|
|
readable_file_name_set.insert("/usr/lib/locale/");
|
|
readable_file_name_set.insert("/etc/oracle/java/usagetracker.properties");
|
|
# endif
|
|
statable_file_name_set.insert("/usr/java/");
|
|
statable_file_name_set.insert("/tmp/");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
statable_file_name_set.insert("/usr/share/");
|
|
# endif
|
|
} else if (config.type == "compiler") {
|
|
syscall_max_cnt[__NR_gettid ] = -1;
|
|
syscall_max_cnt[__NR_set_tid_address] = -1;
|
|
syscall_max_cnt[__NR_set_robust_list] = -1;
|
|
syscall_max_cnt[__NR_futex ] = -1;
|
|
|
|
syscall_max_cnt[__NR_getpid ] = -1;
|
|
syscall_max_cnt[__NR_vfork ] = -1;
|
|
syscall_max_cnt[__NR_fork ] = -1;
|
|
syscall_max_cnt[__NR_clone ] = -1;
|
|
syscall_max_cnt[__NR_execve ] = -1;
|
|
syscall_max_cnt[__NR_wait4 ] = -1;
|
|
|
|
syscall_max_cnt[__NR_clock_gettime ] = -1;
|
|
syscall_max_cnt[__NR_clock_getres ] = -1;
|
|
|
|
syscall_max_cnt[__NR_setrlimit ] = -1;
|
|
syscall_max_cnt[__NR_pipe ] = -1;
|
|
|
|
syscall_max_cnt[__NR_getdents64 ] = -1;
|
|
syscall_max_cnt[__NR_getdents ] = -1;
|
|
|
|
syscall_max_cnt[__NR_umask ] = -1;
|
|
syscall_max_cnt[__NR_rename ] = -1;
|
|
syscall_max_cnt[__NR_chmod ] = -1;
|
|
syscall_max_cnt[__NR_mkdir ] = -1;
|
|
|
|
syscall_max_cnt[__NR_chdir ] = -1;
|
|
syscall_max_cnt[__NR_fchdir ] = -1;
|
|
|
|
syscall_max_cnt[__NR_ftruncate ] = -1; // for javac = =
|
|
|
|
syscall_max_cnt[__NR_sched_getaffinity] = -1; // for javac = =
|
|
syscall_max_cnt[__NR_sched_yield ] = -1; // for javac = =
|
|
|
|
syscall_max_cnt[__NR_uname ] = -1; // for javac = =
|
|
syscall_max_cnt[__NR_sysinfo ] = -1; // for javac = =
|
|
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
syscall_max_cnt[__NR_prlimit64 ] = -1;
|
|
syscall_max_cnt[__NR_getrandom ] = -1;
|
|
syscall_max_cnt[__NR_pread64 ] = -1;
|
|
syscall_max_cnt[__NR_prctl ] = -1;
|
|
syscall_max_cnt[__NR_nanosleep ] = -1;
|
|
syscall_max_cnt[__NR_socketpair ] = -1;
|
|
# endif
|
|
|
|
syscall_should_soft_ban[__NR_socket ] = true; // for javac
|
|
syscall_should_soft_ban[__NR_connect ] = true; // for javac
|
|
syscall_should_soft_ban[__NR_geteuid ] = true; // for javac
|
|
syscall_should_soft_ban[__NR_getuid ] = true; // for javac
|
|
|
|
writable_file_name_set.insert("/tmp/");
|
|
|
|
readable_file_name_set.insert(config.work_path);
|
|
writable_file_name_set.insert(config.work_path + "/");
|
|
|
|
readable_file_name_set.insert(abspath(0, string(self_path) + "/../runtime") + "/");
|
|
# ifdef UOJ_JUDGER_BASESYSTEM_UBUNTU1804
|
|
readable_file_name_set.insert("/sys/fs/cgroup/cpu/");
|
|
readable_file_name_set.insert("/sys/fs/cgroup/memory/");
|
|
readable_file_name_set.insert("/etc/oracle/java/usagetracker.properties");
|
|
# endif
|
|
|
|
readable_file_name_set.insert("system_root");
|
|
readable_file_name_set.insert("/usr/");
|
|
readable_file_name_set.insert("/lib/");
|
|
readable_file_name_set.insert("/lib64/");
|
|
readable_file_name_set.insert("/bin/");
|
|
readable_file_name_set.insert("/sbin/");
|
|
// readable_file_name_set.insert("/proc/meminfo");
|
|
// readable_file_name_set.insert("/proc/self/");
|
|
|
|
readable_file_name_set.insert("/sys/devices/system/cpu/");
|
|
readable_file_name_set.insert("/proc/");
|
|
soft_ban_file_name_set.insert("/etc/nsswitch.conf"); // for javac = =
|
|
soft_ban_file_name_set.insert("/etc/passwd"); // for javac = =
|
|
|
|
readable_file_name_set.insert("/etc/timezone");
|
|
# ifndef UOJ_JUDGER_FPC_VERSION
|
|
readable_file_name_set.insert("/etc/fpc-2.6.2.cfg.d/");
|
|
# endif
|
|
# ifdef UOJ_JUDGER_FPC_VERSION
|
|
readable_file_name_set.insert("/etc/fpc-" UOJ_JUDGER_FPC_VERSION ".cfg.d/");
|
|
# endif
|
|
readable_file_name_set.insert("/etc/fpc.cfg");
|
|
|
|
statable_file_name_set.insert("/*");
|
|
}
|
|
}
|
|
|
|
string read_string_from_regs(reg_val_t addr, pid_t pid) {
|
|
char res[MaxPathLen + 1], *ptr = res;
|
|
while (ptr != res + MaxPathLen) {
|
|
*(reg_val_t*)ptr = ptrace(PTRACE_PEEKDATA, pid, addr, NULL);
|
|
for (int i = 0; i < sizeof(reg_val_t); i++, ptr++, addr++) {
|
|
if (*ptr == 0) {
|
|
return res;
|
|
}
|
|
}
|
|
}
|
|
res[MaxPathLen] = 0;
|
|
return res;
|
|
}
|
|
string read_abspath_from_regs(reg_val_t addr, pid_t pid) {
|
|
return abspath(pid, read_string_from_regs(addr, pid));
|
|
}
|
|
|
|
inline void soft_ban_syscall(pid_t pid, user_regs_struct reg) {
|
|
reg.REG_SYSCALL += 1024;
|
|
ptrace(PTRACE_SETREGS, pid, NULL, ®);
|
|
}
|
|
|
|
inline bool on_dgs_file_detect(pid_t pid, user_regs_struct reg, const string &fn) {
|
|
if (is_soft_ban_file(fn)) {
|
|
soft_ban_syscall(pid, reg);
|
|
return true;
|
|
} else {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
inline bool check_safe_syscall(pid_t pid, bool need_show_trace_details) {
|
|
struct user_regs_struct reg;
|
|
ptrace(PTRACE_GETREGS, pid, NULL, ®);
|
|
|
|
int cur_instruction = ptrace(PTRACE_PEEKTEXT, pid, reg.rip - 2, NULL) & 0xffff;
|
|
if (cur_instruction != 0x050f) {
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "informal syscall %d\n", cur_instruction);
|
|
}
|
|
return false;
|
|
}
|
|
|
|
int syscall = (int)reg.REG_SYSCALL;
|
|
if (0 > syscall || syscall >= 1000) {
|
|
return false;
|
|
}
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "syscall %d\n", (int)syscall);
|
|
}
|
|
|
|
if (syscall_should_soft_ban[syscall]) {
|
|
soft_ban_syscall(pid, reg);
|
|
} else if (syscall_max_cnt[syscall]-- == 0) {
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "dgs %d\n", (int)syscall);
|
|
}
|
|
return false;
|
|
}
|
|
|
|
if (syscall == __NR_open || syscall == __NR_openat) {
|
|
reg_val_t fn_addr;
|
|
reg_val_t flags;
|
|
if (syscall == __NR_open) {
|
|
fn_addr = reg.REG_ARG0;
|
|
flags = reg.REG_ARG1;
|
|
} else {
|
|
fn_addr = reg.REG_ARG1;
|
|
flags = reg.REG_ARG2;
|
|
}
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "open ");
|
|
|
|
switch (flags & O_ACCMODE) {
|
|
case O_RDONLY:
|
|
fprintf(stderr, "r ");
|
|
break;
|
|
case O_WRONLY:
|
|
fprintf(stderr, "w ");
|
|
break;
|
|
case O_RDWR:
|
|
fprintf(stderr, "rw");
|
|
break;
|
|
default:
|
|
fprintf(stderr, "??");
|
|
break;
|
|
}
|
|
fprintf(stderr, " %s\n", fn.c_str());
|
|
}
|
|
|
|
bool is_read_only = (flags & O_ACCMODE) == O_RDONLY &&
|
|
(flags & O_CREAT) == 0 &&
|
|
(flags & O_EXCL) == 0 &&
|
|
(flags & O_TRUNC) == 0;
|
|
if (is_read_only) {
|
|
if (realpath(fn) != "" && !is_readable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
} else {
|
|
if (!is_writable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
}
|
|
} else if (syscall == __NR_readlink || syscall == __NR_readlinkat) {
|
|
reg_val_t fn_addr;
|
|
if (syscall == __NR_readlink) {
|
|
fn_addr = reg.REG_ARG0;
|
|
} else {
|
|
fn_addr = reg.REG_ARG1;
|
|
}
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "readlink %s\n", fn.c_str());
|
|
}
|
|
if (!is_readable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
} else if (syscall == __NR_unlink || syscall == __NR_unlinkat) {
|
|
reg_val_t fn_addr;
|
|
if (syscall == __NR_unlink) {
|
|
fn_addr = reg.REG_ARG0;
|
|
} else {
|
|
fn_addr = reg.REG_ARG1;
|
|
}
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "unlink %s\n", fn.c_str());
|
|
}
|
|
if (!is_writable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
} else if (syscall == __NR_access) {
|
|
reg_val_t fn_addr = reg.REG_ARG0;
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "access %s\n", fn.c_str());
|
|
}
|
|
if (!is_statable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
} else if (syscall == __NR_stat || syscall == __NR_lstat) {
|
|
reg_val_t fn_addr = reg.REG_ARG0;
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "stat %s\n", fn.c_str());
|
|
}
|
|
if (!is_statable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
} else if (syscall == __NR_execve) {
|
|
reg_val_t fn_addr = reg.REG_ARG0;
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "execve %s\n", fn.c_str());
|
|
}
|
|
if (!is_readable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
} else if (syscall == __NR_chmod || syscall == __NR_rename) {
|
|
reg_val_t fn_addr = reg.REG_ARG0;
|
|
string fn = read_abspath_from_regs(fn_addr, pid);
|
|
if (need_show_trace_details) {
|
|
fprintf(stderr, "change %s\n", fn.c_str());
|
|
}
|
|
if (!is_writable_file(fn)) {
|
|
return on_dgs_file_detect(pid, reg, fn);
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
inline void on_syscall_exit(pid_t pid, bool need_show_trace_details) {
|
|
struct user_regs_struct reg;
|
|
ptrace(PTRACE_GETREGS, pid, NULL, ®);
|
|
if (need_show_trace_details) {
|
|
if ((long long int)reg.REG_SYSCALL >= 1024) {
|
|
fprintf(stderr, "ban sys %lld\n", (long long int)reg.REG_SYSCALL - 1024);
|
|
} else {
|
|
fprintf(stderr, "exitsys %lld (ret %d)\n", (long long int)reg.REG_SYSCALL, (int)reg.REG_RET);
|
|
}
|
|
}
|
|
|
|
if ((long long int)reg.REG_SYSCALL >= 1024) {
|
|
reg.REG_SYSCALL -= 1024;
|
|
reg.REG_RET = -EACCES;
|
|
ptrace(PTRACE_SETREGS, pid, NULL, ®);
|
|
}
|
|
}
|