fix: 解决 long 类型参数溢出 & c_cpp 白名单补充 readlinkat 权限

.travis.yml

@@ -4,8 +4,5 @@ services:
   - docker
 
 script:
-  - docker build -t judger-test -f tests/Dockerfile-16.04 .
-  - docker run -it --rm -v $PWD:/src judger-test /bin/bash -c "chmod +x tests/runtest.sh && ./tests/runtest.sh"
-
-  - docker build -t judger-test -f tests/Dockerfile-18.04 .
+  - docker build -t judger-test -f Dockerfile ..
   - docker run -it --rm -v $PWD:/src judger-test /bin/bash -c "chmod +x tests/runtest.sh && ./tests/runtest.sh"

src/main.c

@@ -1,13 +1,15 @@
+#include <stdlib.h>
 #include "argtable3.h"
 #include "runner.h"
 
 #define INT_PLACE_HOLDER "<n>"
 #define STR_PLACE_HOLDER "<str>"
 
 struct arg_lit *verb, *help, *version;
-struct arg_int *max_cpu_time, *max_real_time, *max_memory, *max_stack, *memory_limit_check_only,
-        *max_process_number, *max_output_size, *uid, *gid;
-struct arg_str *exe_path, *input_path, *output_path, *error_path, *args, *env, *log_path, *seccomp_rule_name;
+struct arg_int *max_cpu_time, *max_real_time, *memory_limit_check_only,
+        *max_process_number, *uid, *gid;
+struct arg_str *exe_path, *input_path, *output_path, *error_path, *args, *env, *log_path, *seccomp_rule_name,
+        *max_memory, *max_stack, *max_output_size;
 struct arg_end *end;
 
 int main(int argc, char *argv[]) {
@@ -16,11 +18,11 @@ int main(int argc, char *argv[]) {
             version = arg_litn(NULL, "version", 0, 1, "Display Version Info And Exit"),
             max_cpu_time = arg_intn(NULL, "max_cpu_time", INT_PLACE_HOLDER, 0, 1, "Max CPU Time (ms)"),
             max_real_time = arg_intn(NULL, "max_real_time", INT_PLACE_HOLDER, 0, 1, "Max Real Time (ms)"),
-            max_memory = arg_intn(NULL, "max_memory", INT_PLACE_HOLDER, 0, 1, "Max Memory (byte)"),
+            max_memory = arg_strn(NULL, "max_memory", STR_PLACE_HOLDER, 0, 1, "Max Memory (byte)"),
             memory_limit_check_only = arg_intn(NULL, "memory_limit_check_only", INT_PLACE_HOLDER, 0, 1, "only check memory usage, do not setrlimit (default False)"),
-            max_stack = arg_intn(NULL, "max_stack", INT_PLACE_HOLDER, 0, 1, "Max Stack (byte, default 16M)"),
+            max_stack = arg_strn(NULL, "max_stack", STR_PLACE_HOLDER, 0, 1, "Max Stack (byte, default 16M)"),
             max_process_number = arg_intn(NULL, "max_process_number", INT_PLACE_HOLDER, 0, 1, "Max Process Number"),
-            max_output_size = arg_intn(NULL, "max_output_size", INT_PLACE_HOLDER, 0, 1, "Max Output Size (byte)"),
+            max_output_size = arg_strn(NULL, "max_output_size", STR_PLACE_HOLDER, 0, 1, "Max Output Size (byte)"),
 
             exe_path = arg_str1(NULL, "exe_path", STR_PLACE_HOLDER, "Exe Path"),
             input_path = arg_strn(NULL, "input_path", STR_PLACE_HOLDER, 0, 1, "Input Path"),
@@ -79,7 +81,7 @@ int main(int argc, char *argv[]) {
     }
 
     if (max_memory->count > 0) {
-        _config.max_memory = (long) *max_memory->ival;
+        _config.max_memory = atol(max_memory->sval[0]);
     } else {
         _config.max_memory = UNLIMITED;
     }
@@ -91,7 +93,7 @@ int main(int argc, char *argv[]) {
     }
 
     if (max_stack->count > 0) {
-        _config.max_stack = (long) *max_stack->ival;
+        _config.max_stack = atol(max_stack->sval[0]);
     } else {
         _config.max_stack = 16 * 1024 * 1024;
     }
@@ -103,7 +105,7 @@ int main(int argc, char *argv[]) {
     }
 
     if (max_output_size->count > 0) {
-        _config.max_output_size = (long) *max_output_size->ival;
+        _config.max_output_size = atol(max_output_size->sval[0]);
     } else {
         _config.max_output_size = UNLIMITED;
     }

src/rules/c_cpp.c

@@ -29,6 +29,7 @@ int _c_cpp_seccomp_rules(struct config *_config, bool allow_write_file) {
         SCMP_SYS(prlimit64),
         SCMP_SYS(read),
         SCMP_SYS(readlink),
+        SCMP_SYS(readlinkat),
         SCMP_SYS(readv),
         SCMP_SYS(rseq),
         SCMP_SYS(set_robust_list),

tests/Dockerfile

@@ -0,0 +1,4 @@
+FROM debian:trixie-slim
+RUN sed -i 's/deb.debian.org/mirrors.aliyun.com/g' /etc/apt/sources.list.d/debian.sources
+RUN apt-get update && apt-get install -y cmake python3 python3-pip libseccomp-dev gcc g++ strace
+WORKDIR /src

tests/Python_and_core/testcase/integration/test.py

@@ -13,23 +13,23 @@ class IntegrationTest(base.BaseTestCase):
     def setUp(self):
         print("Running", self._testMethodName)
         self.workspace = self.init_workspace("integration")
-        
+
     def _compile_c(self, src_name, extra_flags=None):
         return super(IntegrationTest, self)._compile_c("../../test_src/integration/" + src_name, extra_flags)
 
     def _compile_cpp(self, src_name):
         return super(IntegrationTest, self)._compile_cpp("../../test_src/integration/" + src_name)
 
     def test_args_must_be_list(self):
-        with self.assertRaisesRegexp(ValueError, "args must be a list"):
+        with self.assertRaisesRegex(ValueError, "args must be a list"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
                         input_path="1.in", output_path="1.out", error_path="1.out",
                         args="12344", env=["a=b"], log_path="1.log",
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
-        with self.assertRaisesRegexp(ValueError, "args must be a list"):
+        with self.assertRaisesRegex(ValueError, "args must be a list"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
@@ -38,15 +38,15 @@ def test_args_must_be_list(self):
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
     def test_args_item_must_be_string(self):
-        with self.assertRaisesRegexp(ValueError, "args item must be a string"):
+        with self.assertRaisesRegex(ValueError, "args item must be a string"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
                         input_path="1.in", output_path="1.out", error_path="1.out",
                         args=["1234", 1234], env=["a=b"], log_path="1.log",
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
-        with self.assertRaisesRegexp(ValueError, "args item must be a string"):
+        with self.assertRaisesRegex(ValueError, "args item must be a string"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
@@ -58,7 +58,7 @@ def test_args_item_must_be_string(self):
             args = ["哈哈哈".encode("utf-8")]
         else:
             args = [u"哈哈哈"]
-        with self.assertRaisesRegexp(ValueError, "args item must be a string"):
+        with self.assertRaisesRegex(ValueError, "args item must be a string"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
@@ -67,15 +67,15 @@ def test_args_item_must_be_string(self):
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
     def test_env_must_be_list(self):
-        with self.assertRaisesRegexp(ValueError, "env must be a list"):
+        with self.assertRaisesRegex(ValueError, "env must be a list"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
                         input_path="1.in", output_path="1.out", error_path="1.out",
                         args=["1234"], env="1234", log_path="1.log",
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
-        with self.assertRaisesRegexp(ValueError, "env must be a list"):
+        with self.assertRaisesRegex(ValueError, "env must be a list"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
@@ -84,15 +84,15 @@ def test_env_must_be_list(self):
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
     def test_env_item_must_be_string(self):
-        with self.assertRaisesRegexp(ValueError, "env item must be a string"):
+        with self.assertRaisesRegex(ValueError, "env item must be a string"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
                         input_path="1.in", output_path="1.out", error_path="1.out",
                         args=["1234"], env=["1234", 1234], log_path="1.log",
                         seccomp_rule_name="1.so", uid=0, gid=0)
 
-        with self.assertRaisesRegexp(ValueError, "env item must be a string"):
+        with self.assertRaisesRegex(ValueError, "env item must be a string"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
@@ -104,7 +104,7 @@ def test_env_item_must_be_string(self):
             env = ["哈哈哈".encode("utf-8")]
         else:
             env = [u"哈哈哈"]
-        with self.assertRaisesRegexp(ValueError, "env item must be a string"):
+        with self.assertRaisesRegex(ValueError, "env item must be a string"):
             _judger.run(max_cpu_time=1000, max_real_time=2000,
                         max_memory=1024 * 1024 * 128, max_stack=32 * 1024 * 1024,
                         max_process_number=200, max_output_size=10000, exe_path="1.out",
@@ -126,7 +126,7 @@ def test_seccomp_rule_can_be_none(self):
                     input_path="/dev/null", output_path="/dev/null", error_path="/dev/null",
                     args=["12344"], env=["a=b"], log_path="/dev/null",
                     seccomp_rule_name=None, uid=0, gid=0)
-    
+
     def test_normal(self):
         config = self.base_config
         config["exe_path"] = self._compile_c("normal.c")

tests/runtest.sh

@@ -1,16 +1,14 @@
 #! /bin/bash
 set -ex
 dir=$PWD
-python -V
+python3 -V
 gcc -v
 g++ -v
 
-for py in python2 python3; do
-	cd $dir
-	rm -rf build && mkdir build && cd build && cmake ..
-	make
-	make install
-	cd ../bindings/Python && rm -rf build
-	$py setup.py install
-	cd ../../tests/Python_and_core && $py test.py
-done
+cd $dir
+rm -rf build && mkdir build && cd build && cmake ..
+make
+make install
+cd ../bindings/Python && rm -rf build
+python3 -m pip install --break-system-packages .
+cd ../../tests/Python_and_core && python3 test.py