Only run "untrusted" programs under sudo
[gruntmaster-daemon.git] / gruntmaster-exec
CommitLineData
c40a2dd0 1#!/usr/bin/perl
da905f9e
MG
2use v5.14;
3use strict;
c40a2dd0 4use warnings;
da905f9e 5
c40a2dd0
MG
6use constant +{
7 # Accepted
8 AC => 0,
da905f9e 9
c40a2dd0
MG
10 # Internal server error
11 ERR => -1,
da905f9e 12
c40a2dd0
MG
13 # All other errors
14 WA => 1,
15 NZX => 2,
16 TLE => 3,
17 OLE => 4,
18 DIED => 5,
19 REJ => 10,
20};
4e08f696
MG
21# These constants are changed by ex/makevm
22use constant USER => 65534;
23use constant GROUP => 65534;
50cdf3cb 24
a6b04042 25use BSD::Resource qw/setrlimit RLIMIT_AS RLIMIT_FSIZE RLIMIT_NPROC/;
c40a2dd0
MG
26use IPC::Signal qw/sig_name sig_num/;
27use sigtrap qw/XFSZ/;
69c25408 28
c40a2dd0
MG
29use Getopt::Long;
30use POSIX qw//;
65ab2558 31use Text::ParseWords qw/shellwords/;
c40a2dd0
MG
32use Time::HiRes qw/alarm/;
33
4e08f696 34my (@fds, $timeout, $mlimit, $olimit, $nobody);
1fe52cde
MG
35my $close = 1;
36
c40a2dd0
MG
37GetOptions(
38 "fd=s" => \@fds,
39 "timeout=f" => \$timeout,
40 "mlimit=i" => \$mlimit,
41 "olimit=i" => \$olimit,
1fe52cde 42 "close!" => \$close,
4e08f696 43 "nobody!" => \$nobody,
c40a2dd0
MG
44);
45
65ab2558
MG
46my $killuser = $ENV{GRUNTMASTER_KILL_USER};
47my @sudo;
1e5f2b8b 48@sudo = (shellwords ($ENV{GRUNTMASTER_SUDO}), '--') if $ENV{GRUNTMASTER_SUDO} && $nobody;
65ab2558
MG
49$mlimit = 1_000_000_000 if @sudo; # sudo wants a lot of address space
50
c40a2dd0
MG
51my $ret = fork // die 'Cannot fork';
52if ($ret) {
53 my $tle;
65ab2558
MG
54 local $SIG{ALRM} = sub {
55 if ($killuser) {
56 system @sudo, 'pkill', '-KILL', '-u', $killuser;
57 } else {
58 kill KILL => $ret
59 }
60 $tle = 1
61 };
c40a2dd0
MG
62 alarm ($timeout || 5);
63 waitpid $ret, 0;
64 alarm 0;
65ab2558
MG
65 if (@sudo) {
66 $? = $? >> 8;
67 $? = $? < 128 ? ($? << 8) : $? - 128;
68 }
c40a2dd0
MG
69 my $sig = $? & 127;
70 my $signame = sig_name $sig;
71 exit !say TLE, "\nTime Limit Exceeded" if $tle;
72 exit !say OLE, "\nOutput Limit Exceeded" if $sig && $signame eq 'XFSZ';
73 exit !say DIED, "\nCrash (SIG$signame)" if $sig && $signame ne 'PIPE';
74 exit !say NZX, "\nNon-zero exit status: " . ($? >> 8) if $? >> 8;
75 exit !say AC, "\nAll OK";
76} else {
77 $^F = 50;
1fe52cde
MG
78 if ($close) {
79 POSIX::close $_ for 0 .. $^F;
80 }
c40a2dd0
MG
81 for my $fdstring (@fds) {
82 my ($fd, $file) = split ' ', $fdstring, 2;
83 open my $fh, $file or die $!;
84 my $oldfd = fileno $fh;
85 if ($oldfd != $fd) {
86 POSIX::dup2 $oldfd, $fd or die $!;
87 POSIX::close $oldfd or die $!;
88 }
89 }
65ab2558 90 my $nproc = $killuser ? 5 : 1;
c40a2dd0
MG
91 %ENV = (ONLINE_JUDGE => 1, PATH => $ENV{PATH}, HOME => $ENV{HOME});
92 setrlimit RLIMIT_AS, $mlimit, $mlimit or die $! if $mlimit;
93 setrlimit RLIMIT_FSIZE, $olimit, $olimit or die $! if $olimit;
65ab2558 94 setrlimit RLIMIT_NPROC, $nproc, $nproc or die $! if $nobody;
4e08f696
MG
95 POSIX::setgid $nobody ? 65534 : USER;
96 POSIX::setuid $nobody ? 65534 : GROUP;
1e5f2b8b
MG
97 unshift @ARGV, @sudo;
98 say STDERR "Execing: ", join ' ', map { "'$_'" } @ARGV;
c40a2dd0
MG
99 exec @ARGV;
100}
101
1021;
69c25408
MG
103__END__
104
105=encoding utf-8
106
107=head1 NAME
108
109gruntmaster-exec - Gruntmaster 6000 executor
110
111=head1 SYNOPSIS
112
113 gruntmaster-exec 20000000 111 echo 'Hello, world!'
114
115=head1 DESCRIPTION
116
117gruntmaster-exec is the script used by gruntmasterd to run programs.
118
119The first argument is the address space limit (in bytes), the second argument is the output limit (also in bytes). The rest of the arguments are the command that should be run and its arguments.
120
121gruntmaster-exec sets the resource limits, cleans the environment (except for PATH and HOME), adds the ONLINE_JUDGE environment variable with value 1, and finally C<exec>s the given command.
122
123=head1 AUTHOR
124
125Marius Gavrilescu E<lt>marius@ieval.roE<gt>
126
127=head1 COPYRIGHT AND LICENSE
128
129Copyright (C) 2014 by Marius Gavrilescu
130
131This program is free software: you can redistribute it and/or modify
132it under the terms of the GNU Affero General Public License as published by
133the Free Software Foundation, either version 3 of the License, or
134(at your option) any later version.
This page took 0.023769 seconds and 4 git commands to generate.