Run user programs as nobody:nogroup

[gruntmaster-daemon.git] / gruntmaster-exec

diff --git a/gruntmaster-exec b/gruntmaster-exec
index 69e967e091120763f4e64e11d8ca933232e850de..e7d7363d4c44308c0622a32e4ecbb7565682c88c 100755 (executable)
--- a/gruntmaster-exec
+++ b/gruntmaster-exec
@@ -1,20 +1,84 @@
-#!/usr/bin/perl -w
+#!/usr/bin/perl
 use v5.14;
 use strict;
+use warnings;
+
+use constant +{
+       # Accepted
+       AC => 0,
+
+       # Internal server error
+       ERR => -1,
+
+       # All other errors
+       WA => 1,
+       NZX => 2,
+       TLE => 3,
+       OLE => 4,
+       DIED => 5,
+       REJ => 10,
+};
+# These constants are changed by ex/makevm
+use constant USER => 65534;
+use constant GROUP => 65534;
 
 use BSD::Resource qw/setrlimit RLIMIT_AS RLIMIT_FSIZE/;
+use IPC::Signal qw/sig_name sig_num/;
 use sigtrap qw/XFSZ/;
 
-##################################################
-
-my ($mlimit, $olimit, @args) = @ARGV;
-
-setrlimit RLIMIT_AS, $mlimit, $mlimit or die $! if $mlimit;
-setrlimit RLIMIT_FSIZE, $olimit, $olimit or die $! if $olimit;
-
-%ENV = (ONLINE_JUDGE => 1, PATH => $ENV{PATH}, HOME => $ENV{HOME});
-exec @args;
-
+use Getopt::Long;
+use POSIX qw//;
+use Time::HiRes qw/alarm/;
+
+my (@fds, $timeout, $mlimit, $olimit, $nobody);
+my $close = 1;
+
+GetOptions(
+       "fd=s"      => \@fds,
+       "timeout=f" => \$timeout,
+       "mlimit=i"  => \$mlimit,
+       "olimit=i"  => \$olimit,
+       "close!"    => \$close,
+       "nobody!"   => \$nobody,
+);
+
+my $ret = fork // die 'Cannot fork';
+if ($ret) {
+       my $tle;
+       local $SIG{ALRM} = sub { kill KILL => $ret; $tle = 1};
+       alarm ($timeout || 5);
+       waitpid $ret, 0;
+       alarm 0;
+       my $sig = $? & 127;
+       my $signame = sig_name $sig;
+       exit !say TLE,  "\nTime Limit Exceeded"   if $tle;
+       exit !say OLE,  "\nOutput Limit Exceeded" if $sig && $signame eq 'XFSZ';
+       exit !say DIED, "\nCrash (SIG$signame)"   if $sig && $signame ne 'PIPE';
+       exit !say NZX,  "\nNon-zero exit status: " . ($? >> 8) if $? >> 8;
+       exit !say AC,   "\nAll OK";
+} else {
+       $^F = 50;
+       if ($close) {
+               POSIX::close $_ for 0 .. $^F;
+       }
+       for my $fdstring (@fds) {
+               my ($fd, $file) = split ' ', $fdstring, 2;
+               open my $fh, $file or die $!;
+               my $oldfd = fileno $fh;
+               if ($oldfd != $fd) {
+                       POSIX::dup2 $oldfd, $fd or die $!;
+                       POSIX::close $oldfd or die $!;
+               }
+       }
+       %ENV = (ONLINE_JUDGE => 1, PATH => $ENV{PATH}, HOME => $ENV{HOME});
+       setrlimit RLIMIT_AS, $mlimit, $mlimit or die $! if $mlimit;
+       setrlimit RLIMIT_FSIZE, $olimit, $olimit or die $! if $olimit;
+       POSIX::setgid $nobody ? 65534 : USER;
+       POSIX::setuid $nobody ? 65534 : GROUP;
+       exec @ARGV;
+}
+
+1;
 __END__
 
 =encoding utf-8