The SIO2 project
  1. The SIO2 project
  2. SIO-1814

Make checker sandboxing more lenient

        Details

          Description

          Preferably run it under proot, like ingen & inwer (if performance in proot is good enough, as checkers are run with each submission judging).

          If not, add a flag to supervisor that allows more syscalls (fseek, gettimeofday etc.).

            Issue Links

            blocks

            Task - A task that needs to be done. SIO-1780 Make teacher permissions secure

            • Major - Major loss of function.
            • Resolved - A resolution has been taken, and it is awaiting verification by reporter. From here issues are either reopened, or are closed.

              Activity

              Ascending order - Click to sort in descending order
              Michał Łazowik made changes -
              Field Original Value New Value
              Status New [ 10000 ] Open [ 1 ]
              Michał Łazowik made changes -
              Assignee Michał Łazowik [ mlazowik ]
              Michał Łazowik made changes -
              TAG Developer Michał Łazowik [ mlazowik ]
              TAG Reviewer Mateusz Śmiech [ foobar ]
              Michał Łazowik made changes -
              Component/s Evaluation Engine / Workers [ 10113 ]
              Component/s OIOIOI [ 10220 ]
              Michał Łazowik made changes -
              Parent SIO-1780 [ 16193 ]
              Issue Type Sub-task [ 9 ] Bug [ 1 ]
              Michał Łazowik made changes -
              Status Open [ 1 ] In Progress [ 3 ]
              Michał Łazowik made changes -
              Status In Progress [ 3 ] Open [ 1 ]
              Michał Łazowik made changes -
              Link This issue blocks SIO-1780 [ SIO-1780 ]
              Michał Łazowik made changes -
              Status Open [ 1 ] In Progress [ 3 ]
              Hide
              Permalink
              Michał Łazowik added a comment -
              Supervisors benchmark:
              (compare 5 * 10^6 small ints)

              (#run, sample tests, full tests)

              PRoot:
              #1: 10.017385179s, 11.391354969s
              #2: 10.226155055s, 10.930424845s

              No sandboxing:
              #1: 9.381381731s, 10.999184434s
              #2: 9.18131602s, 10.264128036s

              Supervisor:
              #1: 11.412477519s, 12.920478417s
              #2: 10.469766335s, 12.542908907s
              Show
              Michał Łazowik added a comment - Supervisors benchmark: (compare 5 * 10^6 small ints) (#run, sample tests, full tests) PRoot: #1: 10.017385179s, 11.391354969s #2: 10.226155055s, 10.930424845s No sandboxing: #1: 9.381381731s, 10.999184434s #2: 9.18131602s, 10.264128036s Supervisor: #1: 11.412477519s, 12.920478417s #2: 10.469766335s, 12.542908907s
              Hide
              Permalink
              Gerrit Gerrit added a comment -
              Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 1
              https://gerrit.sio2project.mimuw.edu.pl/2564

              SIO-1814 Use PRoot for checker sandboxing

              It's also used for ingen and does not block syscalls that might be useful
              in checkers, but should be forbidden in solutions (most notably seek).

              Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Show
              Gerrit Gerrit added a comment - Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 1 https://gerrit.sio2project.mimuw.edu.pl/2564 SIO-1814 Use PRoot for checker sandboxing It's also used for ingen and does not block syscalls that might be useful in checkers, but should be forbidden in solutions (most notably seek). Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Hide
              Permalink
              Gerrit Gerrit added a comment -
              Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 2
              https://gerrit.sio2project.mimuw.edu.pl/2564

              SIO-1814 Use PRoot for checker sandboxing

              It's also used for ingen and does not block syscalls that might be useful
              in checkers, but should be forbidden in solutions (most notably seek).

              Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Show
              Gerrit Gerrit added a comment - Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 2 https://gerrit.sio2project.mimuw.edu.pl/2564 SIO-1814 Use PRoot for checker sandboxing It's also used for ingen and does not block syscalls that might be useful in checkers, but should be forbidden in solutions (most notably seek). Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Hide
              Permalink
              Gerrit Gerrit added a comment -
              Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 3
              https://gerrit.sio2project.mimuw.edu.pl/2564

              SIO-1814 Use PRoot for checker sandboxing

              It's also used for ingen and does not block syscalls that might be useful
              in checkers, but should be forbidden in solutions (most notably seek).

              Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Show
              Gerrit Gerrit added a comment - Change I36944a0849a4a4a163be29f9f80e8467a6156497, patchset 3 https://gerrit.sio2project.mimuw.edu.pl/2564 SIO-1814 Use PRoot for checker sandboxing It's also used for ingen and does not block syscalls that might be useful in checkers, but should be forbidden in solutions (most notably seek). Change-Id: I36944a0849a4a4a163be29f9f80e8467a6156497
              Michał Łazowik made changes -
              Status In Progress [ 3 ] Resolved [ 5 ]
              Assignee Michał Łazowik [ mlazowik ] Szymon Acedański [ accek ]
              Resolution Fixed [ 1 ]
              Hide
              Permalink
              Michał Łazowik added a comment -
              Sandboxing turned on on Szkopuł.
              Show
              Michał Łazowik added a comment - Sandboxing turned on on Szkopuł.
              Hide
              Permalink
              Michał Łazowik added a comment -
              Aaaand disabled on Szkopuł. Still causes problems.
              Show
              Michał Łazowik added a comment - Aaaand disabled on Szkopuł. Still causes problems.
              Michał Łazowik made changes -
              Resolution Fixed [ 1 ]
              Status Resolved [ 5 ] Reopened [ 4 ]
              Assignee Szymon Acedański [ accek ] Michał Łazowik [ mlazowik ]
              Hide
              Permalink
              Michał Łazowik added a comment -
              Submission that breaks it: https://szkopul.edu.pl/s/247518/ from problem: https://szkopul.edu.pl/c/warsztaty-dla-gimnazjalistow/problemset/problem/wTy-sxQCIKry0Ml-6RvM0L78/site/?key=statement
              Show
              Michał Łazowik added a comment - Submission that breaks it: https://szkopul.edu.pl/s/247518/ from problem: https://szkopul.edu.pl/c/warsztaty-dla-gimnazjalistow/problemset/problem/wTy-sxQCIKry0Ml-6RvM0L78/site/?key=statement
              Szymon Acedański made changes -
              Assignee Michał Łazowik [ mlazowik ]
              Fix Version/s TAG 2015/16 Sprint 3 [ 12402 ]
              Szymon Acedański made changes -
              Fix Version/s TAG 2016/17 Summer Semester [ 12503 ]
              Szymon Acedański made changes -
              Labels T3 tag1
              Michał Łazowik made changes -
              Description Preferably run it under proot, like ingen & inwer (if performance if proot is good enough, checkers are run with each submission judging).

              If not, add a flag to supervisor that allows more syscalls (fseek, gettimeofday etc.).               		Preferably run it under proot, like ingen & inwer (if performance in proot is good enough, as checkers are run with each submission judging).

              If not, add a flag to supervisor that allows more syscalls (fseek, gettimeofday etc.).
              Szymon Acedański made changes -
              Labels tag1
              Transition Time In Source Status Execution Times Last Executer Last Execution Date
              New New Open Open
              		9s 1 Michał Łazowik 2016-05-12 11:38
              In Progress In Progress Open Open
              		1s 1 Michał Łazowik 2016-05-12 23:16
              Open Open In Progress In Progress
              		2d 22h 44m 2 Michał Łazowik 2016-05-15 10:22
              In Progress In Progress Resolved Resolved
              		36d 11h 54m 1 Michał Łazowik 2016-06-20 22:17
              Resolved Resolved Reopened Reopened
              		45m 4s 1 Michał Łazowik 2016-06-20 23:02

                People

                • Assignee:
                  Unassigned
                  Reporter:
                  Michał Łazowik
                  TAG Developer:
                  Michał Łazowik
                  TAG Reviewer:
                  Mateusz Śmiech
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  2 Start watching this issue

                  Dates

                  • Due:
                    Created:
                    Updated: