1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
#!/usr/bin/python
# IVLE
# Copyright (C) 2007-2008 The University of Melbourne
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
# CGI Trampoline
# Author: Tom Conway
# Date: 13/12/2007
# Usage: trampoline.py <uid> <jail-dir> <cwd-within-jail> <script-name>
# <uid> The user id of the user to do the evaluation
# At the moment this is the user-name, but it would be
# nice if it were made to be the numeric uid, since the
# trampoline has to read /etc/passwd to figure this out
# at the moment. OTOH, the server invoking the trampoline
# may know it already, and in any case can cache it between
# requests, which the trampoline cannot.
# <jail-dir> The directory that the trampoline should chroot to
# <cwd-within-jail> The directory within the jail that should be
# made the current working directory for the script.
# This should be relative to / within the jail.
# <script-name> The path (within the jail) to the script to be executed.
import os
import sys
import re
import resource
def throttle():
Kb = 1024
Mb = 1024 * 1024
limits = [(resource.RLIMIT_CORE, (0,0)), \
(resource.RLIMIT_CPU, (1,2)), \
(resource.RLIMIT_FSIZE, (5 * Mb, 5 * Mb)), \
(resource.RLIMIT_DATA, (20 * Mb, 24 * Mb)), \
(resource.RLIMIT_STACK, (8 * Mb, 9 * Mb)), \
(resource.RLIMIT_NPROC, (10, 10)), \
(resource.RLIMIT_NOFILE, (10, 12))]
for (r,l) in limits:
resource.setrlimit(r,l)
def runscript(uid, jail, cwd, script):
if uid == 0:
sys.exit(sys.argv[0] + ": cannot run scripts as root!\n")
if not jail.startswith("/home/mgiuca/playground"):
sys.exit(sys.argv[0] + ": invalid jail location!\n")
os.chroot(jail)
os.chdir(cwd)
os.setuid(uid)
# throttle()
m = compile(file(script,'r').read(), script, 'exec')
g = {}
g['__builtins__'] = globals()['__builtins__']
g['__file__'] = script
g['__name__'] = '__main__'
eval(m, g, {})
#eval(m)
sys.exit(0)
runscript(int(sys.argv[1]), sys.argv[2], sys.argv[3], sys.argv[4])
|