Documentation
¶
Overview ¶
Package runner executes the authoritative target and produces the oracle.RunResult. Runs are air-gapped and non-gameable: fresh execution context, no network, output caps, pinned sanitizer options. The runner never judges — it only observes; the oracle disposes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ParseSanitizer ¶
func ParseSanitizer(_, stderr string) oracle.SanitizerReport
ParseSanitizer extracts a SanitizerReport from a target's stderr. Sanitizers write their reports to stderr only, so stdout is deliberately ignored: it is attacker/agent-influenceable (a harness that echoes its input could otherwise forge a report). Even so, a parsed report is only a *candidate* — the runner corroborates it against abnormal termination before trusting it (see corroborateSanitizer), because a target can echo report-shaped bytes to stderr too. A lone stack frame does not by itself count as a fired report. Returns a zero (Fired:false) report when no signature is present.
Types ¶
type DockerRunner ¶
type DockerRunner struct {
// DockerBin overrides the docker binary (default "docker").
DockerBin string
// PoVMount is the container path the PoV directory is mounted read-only at.
PoVMount string
}
DockerRunner is the air-gapped production runner. Each PoV runs in a fresh `--rm` container the agent cannot tamper with, with `--network none` by default. This is the non-gameable execution context the oracle depends on. It shells out to the `docker` CLI (no cgo, robust across Docker versions).
type Interaction ¶
type Interaction string
Interaction selects how RunResults are sourced.
const ( Repro Interaction = "repro" // agent writes a PoV; target runs once in a fresh context (default) Service Interaction = "service" // live target; per-connection wrapper records results )
type LocalRunner ¶
type LocalRunner struct{}
LocalRunner executes a local binary in a fresh subprocess. It is not container-isolated, so it is intended for tests and single-machine demos; the DockerRunner is the air-gapped production path. It still honors output caps, timeouts, and pinned sanitizer options.
type RunSpec ¶
type RunSpec struct {
// Exactly one of Image (Docker) or Binary (local process) is used, depending
// on the Runner implementation.
Image string
Binary string
Workdir string // working directory (local runner) / container workdir
ArgvTmpl []string // command template; the token "{poc}" is replaced with the PoV path
StdinPoV bool // feed the PoV on stdin instead of via an argv file
PoV []byte // the proof-of-vulnerability input
Env []string // extra environment (KEY=VALUE)
// NoPoV marks a self-contained reproducer: the target reproduces on its own
// (e.g. an ARVO image whose testcase is baked in and run by `arvo`). No PoV
// is written/mounted and the argv is used verbatim (no "{poc}" append).
NoPoV bool
Sanitizer string // e.g. "asan"; drives ASan option pinning + parsing
Timeout time.Duration // wall-clock cap; 0 → default 30s
Network bool // default false → air-gapped
}
RunSpec fully describes one execution.
Source Files