4 ms·
You can read more about the environment here: https://www.hackerrank.com/environment https://www.hackerrank.com/environment We have a cluster of codechecker se
by anilgulecha 11y ago
You can read more about the environment here:
https://www.hackerrank.com/environment https://www.hackerrank.com/environment
We have a cluster of codechecker servers of the above type, which share the load of incoming queries. On each, sandboxing is via a chroot-based system. Programs get a fixed amount of memory/time.
Re: the codechecker keyfile - we're looking into this, as I'm not an android expert - but quick searching tells me this is used to sign apks. Our codechecker supports android builds, so that's probably what this is used for. This key is not used to sign anything official (like throwaway id_rsa you create when needed). Again, I'm not the expert on this and I'll add a confirmation here shortly.
That said, if anyone finds something a vulnerability/way out of the sandbox, please shoot me a mail (anil @ hackerrank) if you'd like to do a private disclosure.
- sgdread 11y agoYou might harden policy files for Java process to prevent usage of Runtime. Not sure about any attack vectors, but I can execute linux commands. Also interesting that you allowed threads. import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; class Solution { public static void main(String[] args) throws IOException, InterruptedException { final Runtime rt = Runtime.getRuntime(); final Process pr = rt.exec("uname -a"); new Thread(new Runnable() { public void run() { BufferedReader input = new BufferedReader(new InputStreamReader(pr.getInputStream())); String line = null; try { while ((line = input.readLine()) != null) System.out.println(line); } catch (IOException e) { e.printStackTrace(); } } }).start(); pr.waitFor(); } }
- anilgulecha 11y ago* Running commands is fine -- infact bash is a programming language we support. As long as you cannot get out of the sandbox. * Threads are allowed by the environment.