The SIO2 project
  1. The SIO2 project
  2. SIO-1814

Make checker sandboxing more lenient

        Details

          Description

          Preferably run it under proot, like ingen & inwer (if performance in proot is good enough, as checkers are run with each submission judging).

          If not, add a flag to supervisor that allows more syscalls (fseek, gettimeofday etc.).

            Issue Links

            blocks

            Task - A task that needs to be done. SIO-1780 Make teacher permissions secure

            • Major - Major loss of function.
            • Resolved - A resolution has been taken, and it is awaiting verification by reporter. From here issues are either reopened, or are closed.

              Activity

              Ascending order - Click to sort in descending order
              Hide
              Permalink
              Michał Łazowik added a comment -
              Supervisors benchmark:
              (compare 5 * 10^6 small ints)

              (#run, sample tests, full tests)

              PRoot:
              #1: 10.017385179s, 11.391354969s
              #2: 10.226155055s, 10.930424845s

              No sandboxing:
              #1: 9.381381731s, 10.999184434s
              #2: 9.18131602s, 10.264128036s

              Supervisor:
              #1: 11.412477519s, 12.920478417s
              #2: 10.469766335s, 12.542908907s
              Show
              Michał Łazowik added a comment - Supervisors benchmark: (compare 5 * 10^6 small ints) (#run, sample tests, full tests) PRoot: #1: 10.017385179s, 11.391354969s #2: 10.226155055s, 10.930424845s No sandboxing: #1: 9.381381731s, 10.999184434s #2: 9.18131602s, 10.264128036s Supervisor: #1: 11.412477519s, 12.920478417s #2: 10.469766335s, 12.542908907s
              Hide
              Permalink
              Gerrit Gerrit added a comment -
              Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 1
              https://gerrit.sio2project.mimuw.edu.pl/2564

              SIO-1814 Use PRoot for checker sandboxing

              It's also used for ingen and does not block syscalls that might be useful
              in checkers, but should be forbidden in solutions (most notably seek).

              Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Show
              Gerrit Gerrit added a comment - Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 1 https://gerrit.sio2project.mimuw.edu.pl/2564 SIO-1814 Use PRoot for checker sandboxing It's also used for ingen and does not block syscalls that might be useful in checkers, but should be forbidden in solutions (most notably seek). Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Hide
              Permalink
              Gerrit Gerrit added a comment -
              Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 2
              https://gerrit.sio2project.mimuw.edu.pl/2564

              SIO-1814 Use PRoot for checker sandboxing

              It's also used for ingen and does not block syscalls that might be useful
              in checkers, but should be forbidden in solutions (most notably seek).

              Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Show
              Gerrit Gerrit added a comment - Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 2 https://gerrit.sio2project.mimuw.edu.pl/2564 SIO-1814 Use PRoot for checker sandboxing It's also used for ingen and does not block syscalls that might be useful in checkers, but should be forbidden in solutions (most notably seek). Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Hide
              Permalink
              Gerrit Gerrit added a comment -
              Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 3
              https://gerrit.sio2project.mimuw.edu.pl/2564

              SIO-1814 Use PRoot for checker sandboxing

              It's also used for ingen and does not block syscalls that might be useful
              in checkers, but should be forbidden in solutions (most notably seek).

              Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Show
              Gerrit Gerrit added a comment - Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 3 https://gerrit.sio2project.mimuw.edu.pl/2564 SIO-1814 Use PRoot for checker sandboxing It's also used for ingen and does not block syscalls that might be useful in checkers, but should be forbidden in solutions (most notably seek). Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Hide
              Permalink
              Michał Łazowik added a comment -
              Sandboxing turned on on Szkopuł.
              Show
              Michał Łazowik added a comment - Sandboxing turned on on Szkopuł.
              Hide
              Permalink
              Michał Łazowik added a comment -
              Aaaand disabled on Szkopuł. Still causes problems.
              Show
              Michał Łazowik added a comment - Aaaand disabled on Szkopuł. Still causes problems.
              Hide
              Permalink
              Michał Łazowik added a comment -
              Submission that breaks it: https://szkopul.edu.pl/s/247518/ from problem: https://szkopul.edu.pl/c/warsztaty-dla-gimnazjalistow/problemset/problem/wTy-sxQCIKry0Ml-6RvM0L78/site/?key=statement
              Show
              Michał Łazowik added a comment - Submission that breaks it: https://szkopul.edu.pl/s/247518/ from problem: https://szkopul.edu.pl/c/warsztaty-dla-gimnazjalistow/problemset/problem/wTy-sxQCIKry0Ml-6RvM0L78/site/?key=statement

                People

                • Assignee:
                  Unassigned
                  Reporter:
                  Michał Łazowik
                  TAG Developer:
                  Michał Łazowik
                  TAG Reviewer:
                  Mateusz Śmiech
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  2 Start watching this issue

                  Dates

                  • Due:
                    Created:
                    Updated: