3 ms·
I was once thinking of implementing such an online judge. Looking through the existing implementations, most restrict the syscalls available to the untrusted pr
by ekr 8y ago
I was once thinking of implementing such an online judge. Looking through the existing implementations, most restrict the syscalls available to the untrusted process, and run in a chroot.
On freebsd, you'd use something like capsicum. On linux, something like seccomp. Although, nowadays I imagine people would think of just running in a VM or a container.
- atmosx 8y agoDocker has apparmor and secco o profiles. Apart from the default, you can monitor for syscalls and build a custom, pet app profile. Couple that with proper mount perms, drop root user, monitor for outgoing connections and write proper firewall rules (cillium can be used to write bpf rules) and you are pretty secure. You need time, attention to detail and multiple iterations to distill the profiles for each layer.