/* safeexec (safe execution environment)

*

* Idea:

* we use stdin and stdout to passing and receiving information to

* the program we are about to execute, and report statistics on

* FILE *redirect

*/

#include <errno.h>

#include <ctype.h>

#include <sys/select.h>

#include <signal.h>

#include <time.h>

#include <stdlib.h>

#include <assert.h>

#include <stdarg.h>

#include <string.h>

#include <stdio.h>

#include <sys/stat.h>

#include <sys/types.h>

#include <sys/wait.h>

#include <sys/time.h>

#include <sys/param.h>

#include <sys/resource.h>

#include "error.h"

#include "safe.h"

#include "memusage.h"

#include "setlimit.h"

#include "safeexec.h"

#ifndef _XOPEN_SOURCE

#define _XOPEN_SOURCE 700

#endif

#define SIGXFSZ 25 /* exceeded file size limit(Fix for FreeBSD) */

#define MAXMEM 8388608 /* recent version of Java need more memory */

#define INTERVAL 61 /* about 16 times a second */

#define NICE_LEVEL 15

#define LARGECONST 4194304

struct config profile = { 1, 32768, 0, 0, 8192, 8192, 0, 10, 5000, 65535 };

struct config *pdefault = &profile;

pid_t pid; /* is global, because we kill the proccess in alarm handler */

int mark;

int silent = 0;

FILE *redirect;

FILE *junk;

char *usage_file = "/dev/null";

char *error_file = "/dev/null";

char *chroot_dir = NULL;

char *run_dir = NULL;

enum{

OK, /* process finished normally */

OLE, /* output limit exceeded */

MLE, /* memory limit exceeded */

TLE, /* time limit exceeded */

RTLE, /* time limit exceeded(wall clock) */

RF, /* invalid function */

IE /* internal error */

};

enum

{

PARSE, INPUT1, INPUT16,

INPUT2, INPUT4, INPUT8,

ERROR, EXECUTE, INPUT32

}; /* for the parsing "finite-state machine" */

char *names[] = {

"UNKONWN", /* 0 */

"SIGHUP", /* 1 */

"SIGINT", /* 2 */

"SIGQUIT", /* 3 */

"SIGILL", /* 4 */

"SIGTRAP", /* 5 */

"SIGABRT", /* 6 */

"SIGBUS", /* 7 */

"SIGFPE", /* 8 */

"SIGKILL", /* 9 */

"SIGUSR1", /* 10 */

"SIGSEGV", /* 11 */

"SIGUSR2", /* 12 */

"SIGPIPE", /* 13 */

"SIGALRM", /* 14 */

"SIGTERM", /* 15 */

"SIGSTKFLT", /* 16 */

"SIGCHLD", /* 17 */

"SIGCONT", /* 18 */

"SIGSTOP", /* 19 */

"SIGTSTP", /* 20 */

"SIGTTIN", /* 21 */

"SIGTTOU", /* 22 */

"SIGURG", /* 23 */

"SIGXCPU", /* 24 */

"SIGXFSZ", /* 25 */

"SIGVTALRM", /* 26 */

"SIGPROF", /* 27 */

"SIGWINCH", /* 28 */

"SIGIO", /* 29 */

"SIGPWR", /* 30 */

"SIGSYS", /* 31 */

};

void printstats (const char *format, ...)

{

va_list p;

if (silent == 1)

return;

va_start (p, format);

vfprintf (redirect, format, p);

va_end (p);

}

char *name (int signal)

{

if (signal >= sizeof (names) / sizeof (char *))

signal = 0;

return (names[signal]);

}

int max (int a, int b)

{

return (a > b ? a : b);

}

/* Kill the child process, noting that the child

can already be a zombie (on this case errno

will be ESRCH)

*/

void terminate (pid_t pid)

{

int v;

v = kill (pid, SIGKILL);

if (v < 0)

if (errno != ESRCH)

error (NULL);

}

int miliseconds (struct timeval *tv)

{

return ((int) tv->tv_sec * 1000 + (int) tv->tv_usec / 1000);

}

/* high resolution (microsecond) sleep */

void msleep (int ms)

{

struct timeval tv;

int v;

do

{

tv.tv_sec = ms / 1000;

tv.tv_usec = (ms % 1000) * 1000;

v = select (0, NULL, NULL, NULL, &tv);

/* The value of the timeout is undefined after the select returns */

}

while ((v < 0) && (errno == EINTR));

if (v < 0)

error (NULL);

}

/* Validate the config options, call error () on error */

void validate (void)

{

if (profile.cpu == 0)

error ("Cpu time must be greater than zero");

if (profile.memory >= MAXMEM)

error ("Memory limit must be smaller than %u", MAXMEM);

if (profile.core >= LARGECONST)

error ("Core limit must be smaller than %u", LARGECONST);

if (profile.stack >= LARGECONST)

error ("Stack limit must be smaller than %u", LARGECONST);

if (profile.fsize >= LARGECONST)

error ("File size limit must be smaller than %u", LARGECONST);

if (profile.nproc >= 65536)

error ("Number of process(es) must be smaller than %u", 65536);

if (profile.clock <= 0)

error ("Wall clock time must be greater than zero");

if (profile.clock >= LARGECONST)

error ("Wall clock time must be smaller than %u", LARGECONST);

if (profile.minuid < 500)

error ("Lower uid limit is smaller than %u", 500);

if (profile.maxuid >= 65536)

error ("Upper uid limit must be smaller than %u", 65536);

if (profile.minuid > profile.maxuid)

error ("Lower uid limit is bigger than upper uid limit");

}

/* return NULL on failure, or argv + k

where the command description starts */

char **parse (char **p)

{

unsigned int *input1, *input2;

char *function;

int state;

state = PARSE;

if (*p == NULL)

state = ERROR;

else

for (; state != ERROR;)

{

p++;

if (*p == NULL)

{

state = ERROR;

continue;

}

if (state == EXECUTE)

break;

switch (state)

{

case PARSE:

state = INPUT1;

function = *p;

if (strcmp (*p, "--cpu") == 0)

input1 = (unsigned int *) &profile.cpu;

else if (strcmp (*p, "--mem") == 0)

input1 = (unsigned int *) &profile.memory;

else if (strcmp (*p, "--space") == 0)

input1 = (unsigned int *) &profile.aspace;

else if (strcmp (*p, "--uids") == 0)

{

input2 = (unsigned int *) &profile.minuid;

input1 = (unsigned int *) &profile.maxuid;

state = INPUT2;

}

else if (strcmp (*p, "--minuid") == 0)

input1 = (unsigned int *) &profile.minuid;

else if (strcmp (*p, "--maxuid") == 0)

input1 = (unsigned int *) &profile.maxuid;

else if (strcmp (*p, "--core") == 0)

input1 = (unsigned int *) &profile.core;

else if (strcmp (*p, "--nproc") == 0)

input1 = (unsigned int *) &profile.nproc;

else if (strcmp (*p, "--fsize") == 0)

input1 = (unsigned int *) &profile.fsize;

else if (strcmp (*p, "--stack") == 0)

input1 = (unsigned int *) &profile.stack;

else if (strcmp (*p, "--clock") == 0)

input1 = (unsigned int *) &profile.clock;

else if (strcmp (*p, "--exec") == 0)

state = EXECUTE;

else if (strcmp (*p, "--usage") == 0)

state = INPUT4;

else if (strcmp (*p, "--chroot") == 0)

state = INPUT8;

else if (strcmp (*p, "--rundir") == 0)

state = INPUT16;

else if (strcmp (*p, "--error") == 0)

state = INPUT32;

else if (strcmp (*p, "--silent") == 0)

{

silent = 1;

state = PARSE;

}

else

{

fprintf (stderr, "error: Invalid option: %s\n", *p);

state = ERROR;

}

break;

case INPUT4:

usage_file = *p;

state = PARSE;

break;

case INPUT8:

chroot_dir = *p;

state = PARSE;

break;

case INPUT16:

run_dir = *p;

state = PARSE;

break;

case INPUT32:

error_file = *p;

state = PARSE;

break;

case INPUT2:

if (sscanf (*p, "%u", input2) == 1)

state = INPUT1;

else

{

fprintf (stderr,

"error: Failed to match the first numeric argument for %s\n",

function);

state = ERROR;

}

break;

case INPUT1:

if (sscanf (*p, "%u", input1) == 1)

state = PARSE;

else

{

fprintf (stderr,

"error: Failed to match the numeric argument for %s\n",

function);

state = ERROR;

}

break;

default:

break;

}

}

if (state == ERROR)

return (NULL);

else

{

assert (state == EXECUTE);

return (p);

}

}

void printusage (char **p)

{

fprintf (stderr, "usage: %s <options> --exec <command>\n", *p);

fprintf (stderr, "Available options:\n");

fprintf (stderr, "\t--cpu <seconds> Default: %lu second(s)\n",

pdefault->cpu);

fprintf (stderr, "\t--mem <kbytes> Default: %lu kbyte(s)\n",

pdefault->memory);

fprintf (stderr, "\t--space <kbytes> Default: %lu kbyte(s)\n",

pdefault->aspace);

fprintf (stderr, "\t--uids <minuid> <maxuid> Default: %u-%u\n",

pdefault->minuid, pdefault->maxuid);

fprintf (stderr, "\t--minuid <uid> Default: %u\n",

pdefault->minuid);

fprintf (stderr, "\t--maxuid <uid> Default: %u\n",

pdefault->maxuid);

fprintf (stderr, "\t--core <kbytes> Default: %lu kbyte(s)\n",

pdefault->core);

fprintf (stderr, "\t--nproc <number> Default: %lu proccess(es)\n",

pdefault->nproc);

fprintf (stderr, "\t--fsize <kbytes> Default: %lu kbyte(s)\n",

pdefault->fsize);

fprintf (stderr, "\t--stack <kbytes> Default: %lu kbyte(s)\n",

pdefault->stack);

fprintf (stderr, "\t--clock <seconds> Wall clock timeout (default: %lu)\n",

pdefault->clock);

fprintf (stderr, "\t--usage <filename> Report statistics to ... (default: stderr)\n");

fprintf (stderr, "\t--chroot <path> Directory to chrooted (default: /tmp)\n");

fprintf (stderr, "\t--error <path> Print stderr to file (default: /dev/null)\n");

}

void wallclock (int v)

{

if (v != SIGALRM)

error ("Signal delivered is not SIGALRM");

mark = RTLE;

terminate (pid);

}

int main (int argc, char **argv, char **envp)

{

struct rusage usage;

char **p;

int status, mem, skipped, memused;

int tsource, ttarget;

int v;

redirect = stderr;

safe_signal (SIGPIPE, SIG_DFL);

tsource = time (NULL);

p = parse (argv);

if (p == NULL)

{

printusage (argv);

return (EXIT_FAILURE);

}

else

{

/* Get an unused uid */

if (profile.minuid != profile.maxuid)

{

srand (time (NULL) ^ getpid ());

profile.minuid += rand () % (profile.maxuid - profile.minuid);

}

if (strcmp (usage_file, "/dev/null") != 0)

{

redirect = fopen (usage_file, "w");

chown (usage_file, profile.minuid, getgid());

chmod (usage_file, 0640);

if (redirect == NULL)

error ("Couldn't open usage file\n");

}

/* stderr from user program is junk */

junk = fopen (error_file, "w");

if (junk == NULL)

error ("Couldn't open junk file %s\n", error_file);

if (strcmp (error_file, "/dev/null") != 0)

{

chown (error_file, profile.minuid, getgid());

chmod (error_file, 0640);

}

if (setgid (profile.minuid) < 0)

{

if (errno == EPERM)

{

error ("Couldn't setgid due to permission");

}

else

{

error (NULL);

}

}

if (setuid (profile.minuid) < 0)

{

if (errno == EPERM)

{

error ("Couldn't setuid due to permission");

}

else

{

error (NULL);

}

}

if (getuid () == 0)

error ("Not changing the uid to an unpriviledged one is a BAD ideia");

if (signal (SIGALRM, wallclock) == SIG_ERR)

error ("Couldn't install signal handler");

if (alarm (profile.clock) != 0)

error ("Couldn't set alarm");

/* Fork new process */

pid = fork ();

if (pid < 0)

error (NULL);

if (pid == 0)

/* Forked/child process */

{

/* Chrooting */

if (chroot_dir != NULL)

{

if (0 != chdir(chroot_dir))

{

kill (getpid (), SIGPIPE);

error ("Can not change to chroot dir");

}

if (0 != chroot(chroot_dir))

{

kill (getpid (), SIGPIPE);

error ("Can not chroot");

}

}

/* Change dir */

if (run_dir != NULL)

{

if (0 != chdir(run_dir))

{

kill (getpid (), SIGPIPE);

error ("Cannot change to rundir");

}

}

dup2(fileno(junk), fileno(stderr));

if (setuid (profile.minuid) < 0)

error (NULL);

/* Don't run as root */

if (getuid () == 0)

error ("Running as a root is not secure!");

/* Set priority */

if (0 != setpriority(PRIO_USER,profile.minuid,NICE_LEVEL))

{

kill (getpid (), SIGPIPE);

error (NULL);

}

/* Set resource limits - memory, time etc */

setlimits(profile);

/* Execute the program */

if (execve (*p, p, envp) < 0)

{

kill (getpid (), SIGPIPE);

error (NULL);

}

}

else

/* Parent process */

{

if (setuid (profile.minuid) < 0)

error (NULL);

if (getuid () == 0)

error ("Running as a root is not secure!");

memusage_init ();

mark = OK;

/* Poll every INTERVAL ms and get the maximum *

* memory usage, exit when the child terminates */

mem = 64;

skipped = 0;

memused = 0;

do

{

msleep (INTERVAL);

memused = memusage (pid);

if (memused > -1)

{

mem = max (mem, memused);

}

else

{ /* Can not read memory usage! */

skipped++;

}

if (skipped > 10)

{ /* process is already finished or something wrong happened */

terminate (pid);

mark = MLE;

}

if (mem > profile.memory)

{

terminate (pid);

mark = MLE;

}

do

v = wait4 (pid, &status, WNOHANG | WUNTRACED, &usage);

//v = wait4 (pid, &status, WNOHANG | WUNTRACED | WCONTINUED | WEXITED, &usage);

while ((v < 0) && (errno != EINTR));

if (v < 0)

error (NULL);

}

while (v == 0);

memusage_close ();

ttarget = time (NULL);

if (mark == MLE)

printstats ("Memory Limit Exceeded\n");

else if (mark == RTLE)

printstats ("Time Limit Exceeded\n");

else

{

if (WIFEXITED (status) != 0)

{

if (WEXITSTATUS (status) != 0)

printstats ("Command exited with non-zero status (%d)\n",

WEXITSTATUS (status));

else

printstats ("OK\n");

}

else

{

if (WIFSIGNALED (status) != 0)

{

/* Was killed for a TLE (or was it an OLE) */

if (WTERMSIG (status) == SIGKILL)

mark = TLE;

else if (WTERMSIG (status) == SIGXFSZ)

mark = OLE;

else if (WTERMSIG (status) == SIGHUP)

mark = RF;

else if (WTERMSIG (status) == SIGPIPE)

mark = IE;

else

printstats ("Command terminated by signal (%d: %s)\n",

WTERMSIG (status),

name (WTERMSIG (status)));

}

else if (WIFSTOPPED (status) != 0)

printstats ("Command terminated by signal (%d: %s)\n",

WSTOPSIG (status), name (WSTOPSIG (status)));

else

printstats ("OK\n");

if (mark == TLE)

{

/* We know the child has terminated at right time(OS did). *

* But seing 1.990 as TLE while limit 2.0 is confusing. *

* So here is small adjustment for presentation. */

usage.ru_utime.tv_sec = profile.cpu;

usage.ru_utime.tv_usec = 0;

printstats ("Time Limit Exceeded\n");

}

else if (mark == OLE)

printstats ("Output Limit Exceeded\n");

else if (mark == RTLE)

printstats ("Time Limit Exceeded\n");

else if (mark == RF)

printstats ("Invalid Function\n");

else if (mark == IE)

printstats ("Internal Error\n");

}

}

printstats ("elapsed time: %d seconds\n", ttarget - tsource);

printstats ("memory usage: %d kbytes\n", mem);

printstats ("cpu usage: %0.3f seconds\n",

(float) miliseconds (&usage.ru_utime) / 1000.0);

}

}

fclose (redirect);

return (EXIT_SUCCESS);

}