sandbox

type ChanProvider ¶ added in v0.4.0

type ChanProvider struct {
	// contains filtered or unexported fields
}

func NewProvider() *ChanProvider

func (sp *ChanProvider) Get() (Sandbox, error)

func (sp *ChanProvider) Put(s Sandbox) Provider

type DirectoryMap ¶ added in v0.4.0

type DirectoryMap struct {
	Inside  string
	Outside string
	Options []DirectoryMapOption
}

DirectoryMap is used to map a directory from outside to the inside of a Sandbox.

type DirectoryMapOption ¶ added in v0.4.0

type DirectoryMapOption string

DirectoryMapOption is an option for a DirectoryMap. The values are defined as in isolate. You may refer to isolate's help for more information on them.

const (
	AllowSpecial   DirectoryMapOption = "dev"
	MountFS        DirectoryMapOption = "fs"
	Maybe          DirectoryMapOption = "maybe"
	NoExec         DirectoryMapOption = "noexec"
	AllowReadWrite DirectoryMapOption = "rw"
	Temporary      DirectoryMapOption = "tmp"
)

type Dummy ¶

type Dummy struct {
	ID  int
	Dir string

	OsFS

	Logger *slog.Logger
	// contains filtered or unexported fields
}

Dummy is a very straightforward implementation of a Sandbox. It creates a temporary directory and executes the commands without many precautions.

func NewDummy(opts ...DummyOption) (*Dummy, error)

func (d *Dummy) Cleanup(_ context.Context) error

func (d *Dummy) Id() string

func (d *Dummy) Init(_ context.Context) error

func (d *Dummy) Run(ctx context.Context, config RunConfig, command string, commandArgs ...string) (*Status, error)

type DummyOption ¶ added in v0.4.0

type DummyOption func(*Dummy) error

func DummyWithLogger(logger *slog.Logger) DummyOption

type FS ¶ added in v0.4.0

type FS interface {
	Pwd() string
	Create(name string) (io.WriteCloser, error)
	MakeExecutable(name string) error

	fs.FS
}

FS is a file system abstraction for sandboxes.

type File ¶ added in v0.4.0

type File struct {
	Name   string
	Source io.ReadCloser
}

File is a named io.Reader which emulates a file.

func ExtractFile(s FS, name string) (*File, error)

type Isolate ¶

type Isolate struct {
	ID int

	OsFS

	Logger *slog.Logger
	// contains filtered or unexported fields
}

Isolate is a Sandbox implementation which calls isolate's command line program. It's required that isolate is installed on the system for it to work. This is the preferred way of sandboxing in njudge.

func NewIsolate(ID int, opts ...IsolateOption) (*Isolate, error)

func (i *Isolate) Cleanup(_ context.Context) error

func (i *Isolate) Id() string

func (i *Isolate) Init(ctx context.Context) error

func (i *Isolate) Run(_ context.Context, config RunConfig, toRun string, toRunArgs ...string) (*Status, error)

type IsolateOption ¶ added in v0.4.0

type IsolateOption func(*Isolate) error

func IsolateOptionUseLogger(logger *slog.Logger) IsolateOption

type OsFS ¶ added in v0.4.0

type OsFS struct {
	// contains filtered or unexported fields
}

OsFS implements an FS with and underlying base path. All of its methods are executed as if the current working directory is this base path. Should be only created via NewOsFS

func NewOsFS(base string) OsFS

func (o OsFS) Create(name string) (io.WriteCloser, error)

func (o OsFS) MakeExecutable(name string) error

func (o OsFS) Open(name string) (fs.File, error)

func (o OsFS) Pwd() string

type Provider ¶ added in v0.4.0

type Provider interface {
	Get() (Sandbox, error)
	Put(s Sandbox) Provider
}

Provider can be used to store Sandboxes

type RunConfig ¶ added in v0.4.0

type RunConfig struct {
	RunID string // RunID is some kind of ID of the run, doesn't need to be set but if set is used to give additional context.

	MaxProcesses     int
	InheritEnv       bool
	Env              []string
	WorkingDirectory string
	DirectoryMaps    []DirectoryMap

	TimeLimit   time.Duration
	MemoryLimit memory.Amount

	Stdin  io.Reader
	Stderr io.Writer
	Stdout io.Writer

	Args []string // Args are given to the underlying sandbox implementation as-is. This should only be used for things that are currently not supported in RunConfig.
}

RunConfig is used to configure the sandbox, setting limits and streams (stdin, stdout, stderr).

type Sandbox ¶ added in v0.4.0

type Sandbox interface {
	Id() string // Id should return an unique ID for sandboxes of the same type

	Init(ctx context.Context) error
	FS
	Run(ctx context.Context, config RunConfig, command string, commandArgs ...string) (*Status, error)
	Cleanup(ctx context.Context) error
}

Sandbox is used to Run a command inside a secure sandbox.

type Status ¶ added in v0.4.0

type Status struct {
	Verdict  Verdict
	Signal   int
	Time     time.Duration
	Memory   memory.Amount
	ExitCode int
}

Status contains information about how a program ran.

func RunBinary(ctx context.Context, s Sandbox, binary File, stdin io.Reader, stdout io.Writer, tl time.Duration, ml memory.Amount) (*Status, error)

type Verdict ¶ added in v0.4.0

type Verdict int

Verdict is the overall outcome of running a program.

const (
	VerdictOK Verdict = 1 << iota
	VerdictTL
	VerdictML
	VerdictRE
	VerdictXX
	VerdictCE
)

func (v Verdict) String() string