woj-sandbox/library.c

#include "resource.h"
#include "sandbox.h"
#include "utils/log.h"

#include <fcntl.h>
#include <stdlib.h>
#include <unistd.h>

char *config[CFG_IS_VALID + 1] __attribute__((weak));

void setup_all(void) {
    char    comm[64];
    int     fd  = open("/proc/self/comm", O_RDONLY);
    ssize_t len = read(fd, comm, sizeof(comm));
    len         = len > 0 ? len - 1 : 0;
    comm[len]   = '\0';
    close(fd);

    LOG_INFO("Setting up sandbox for %s(%d)", comm, getpid());

    if (config[CFG_IS_VALID]) {
        LOG_INFO("Using config from launcher");
    } else {
        LOG_INFO("Using config from environment");

        config[CFG_MEMORY_LIMIT] = getenv(LIMIT_MEMORY);
        config[CFG_NPROC_LIMIT]  = getenv(LIMIT_NPROC);
        config[CFG_TIME_LIMIT]   = getenv(LIMIT_TIME);

        config[CFG_SANDBOX_TEMPLATE] = getenv(SANDBOX_TEMPLATE);
        config[CFG_SANDBOX_ACTION]   = getenv(SANDBOX_ACTION);
        config[CFG_PROGRAM]          = getenv(SANDBOX_EXE_PATH);
    }

    setup_rlimit(config);
    setup_seccomp(config);
}