#include "resource.h" #include "sandbox.h" #include "user.h" #include "utils/log.h" #include #include #include char *config[CFG_IS_VALID + 1] __attribute__((weak)); void setup_all(void) { char comm[64]; int fd = open("/proc/self/comm", O_RDONLY); ssize_t len = read(fd, comm, sizeof(comm)); len = len > 0 ? len - 1 : 0; comm[len] = '\0'; close(fd); LOG_INFO("Setting up sandbox for %s(%d)", comm, getpid()); if (config[CFG_IS_VALID]) { LOG_INFO("Using config from launcher"); } else { LOG_INFO("Using config from environment"); config[CFG_MEMORY_LIMIT] = getenv(LIMIT_MEMORY); config[CFG_NPROC_LIMIT] = getenv(LIMIT_NPROC); config[CFG_TIME_LIMIT] = getenv(LIMIT_TIME); config[CFG_FSIZE_LIMIT] = getenv(LIMIT_FSIZE); config[CFG_SANDBOX_TEMPLATE] = getenv(SANDBOX_TEMPLATE); config[CFG_SANDBOX_ACTION] = getenv(SANDBOX_ACTION); config[CFG_PROGRAM] = getenv(SANDBOX_EXE_PATH); config[CFG_PROGRAM_ARG] = getenv(SANDBOX_EXE_ARG1); config[CFG_UID] = getenv(USER_UID); config[CFG_GID] = getenv(USER_GID); } setup_user(config); setup_rlimit(config); setup_seccomp(config); }