76
by drtomc
Add a cut at the python trampoline. |
1 |
#!/usr/bin/python
|
2 |
# IVLE
|
|
3 |
# Copyright (C) 2007-2008 The University of Melbourne
|
|
4 |
#
|
|
5 |
# This program is free software; you can redistribute it and/or modify
|
|
6 |
# it under the terms of the GNU General Public License as published by
|
|
7 |
# the Free Software Foundation; either version 2 of the License, or
|
|
8 |
# (at your option) any later version.
|
|
9 |
#
|
|
10 |
# This program is distributed in the hope that it will be useful,
|
|
11 |
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
12 |
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
13 |
# GNU General Public License for more details.
|
|
14 |
#
|
|
15 |
# You should have received a copy of the GNU General Public License
|
|
16 |
# along with this program; if not, write to the Free Software
|
|
17 |
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
18 |
||
19 |
# CGI Trampoline
|
|
20 |
# Author: Tom Conway
|
|
21 |
# Date: 13/12/2007
|
|
22 |
||
23 |
# Usage: trampoline.py <uid> <jail-dir> <cwd-within-jail> <script-name>
|
|
24 |
# <uid> The user id of the user to do the evaluation
|
|
25 |
# At the moment this is the user-name, but it would be
|
|
26 |
# nice if it were made to be the numeric uid, since the
|
|
27 |
# trampoline has to read /etc/passwd to figure this out
|
|
28 |
# at the moment. OTOH, the server invoking the trampoline
|
|
29 |
# may know it already, and in any case can cache it between
|
|
30 |
# requests, which the trampoline cannot.
|
|
31 |
# <jail-dir> The directory that the trampoline should chroot to
|
|
32 |
# <cwd-within-jail> The directory within the jail that should be
|
|
33 |
# made the current working directory for the script.
|
|
34 |
# This should be relative to / within the jail.
|
|
35 |
# <script-name> The path (within the jail) to the script to be executed.
|
|
36 |
||
37 |
||
38 |
import os |
|
39 |
import sys |
|
40 |
import re |
|
41 |
import resource |
|
42 |
||
43 |
def throttle(): |
|
44 |
Kb = 1024 |
|
45 |
Mb = 1024 * 1024 |
|
46 |
||
47 |
limits = [(resource.RLIMIT_CORE, (0,0)), \ |
|
48 |
(resource.RLIMIT_CPU, (1,2)), \ |
|
49 |
(resource.RLIMIT_FSIZE, (5 * Mb, 5 * Mb)), \ |
|
50 |
(resource.RLIMIT_DATA, (20 * Mb, 24 * Mb)), \ |
|
51 |
(resource.RLIMIT_STACK, (8 * Mb, 9 * Mb)), \ |
|
52 |
(resource.RLIMIT_NPROC, (10, 10)), \ |
|
53 |
(resource.RLIMIT_NOFILE, (10, 12))] |
|
54 |
||
55 |
for (r,l) in limits: |
|
56 |
resource.setrlimit(r,l) |
|
57 |
||
58 |
def runscript(uid, jail, cwd, script): |
|
59 |
if uid == 0: |
|
60 |
sys.exit(sys.argv[0] + ": cannot run scripts as root!\n") |
|
61 |
# os.chroot(os.path.join(<<base-directory-for-jails>>, jail))
|
|
62 |
os.chroot(jail) |
|
63 |
os.chdir(cwd) |
|
64 |
os.setuid(uid) |
|
65 |
throttle() |
|
66 |
m = compile(file(script,'r').read(), script, 'exec') |
|
67 |
g = {} |
|
68 |
g['__builtins__'] = globals()['__builtins__'] |
|
69 |
g['__file__'] = script |
|
70 |
g['__name__'] = '__main__' |
|
71 |
eval(m, g, {}) |
|
72 |
#eval(m)
|
|
73 |
sys.exit(0) |
|
74 |
||
75 |
runscript(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4]) |