Skip to content

Commit

Permalink
cptbox/isolate: print target of denied *kill and prlimit syscalls
Browse files Browse the repository at this point in the history
  • Loading branch information
Xyene committed Jun 2, 2024
1 parent 95a432b commit b1303be
Showing 1 changed file with 7 additions and 5 deletions.
12 changes: 7 additions & 5 deletions dmoj/cptbox/isolate.py
Original file line number Diff line number Diff line change
Expand Up @@ -390,13 +390,15 @@ def _access_check(self, debugger: Debugger, file: str, fs_jail: FilesystemPolicy

def handle_kill(self, debugger: Debugger) -> None:
# Allow tgkill to execute as long as the target thread group is the debugged process
# libstdc++ seems to use this to signal itself, see <https://github.com/DMOJ/judge/issues/183>
if debugger.uarg0 != debugger.pid:
raise DeniedSyscall(ACCESS_EPERM, 'Cannot kill other processes')
# libstdc++ seems to use this to signal itself, see <https://github.com/DMOJ/judge/issues/18A3>

This comment has been minimized.

Copy link
@hieplpvip

hieplpvip Jun 6, 2024

Contributor

18A3 seems like typo

This comment has been minimized.

Copy link
@int-y1

int-y1 Jun 7, 2024

Contributor

the correct link should be https://github.com/DMOJ/judge-server/issues/183

target = debugger.uarg0
if target != debugger.pid:
raise DeniedSyscall(ACCESS_EPERM, f'Cannot kill other processes (target={target}, self={debugger.pid})')

def handle_prlimit(self, debugger: Debugger) -> None:
if debugger.uarg0 not in (0, debugger.pid):
raise DeniedSyscall(ACCESS_EPERM, 'Cannot prlimit other processes')
target = debugger.uarg0
if target not in (0, debugger.pid):
raise DeniedSyscall(ACCESS_EPERM, f'Cannot prlimit other processes (target={target}, self={debugger.pid})')

def handle_prctl(self, debugger: Debugger) -> None:
PR_GET_DUMPABLE = 3
Expand Down

0 comments on commit b1303be

Please sign in to comment.