fix(iris): enforce sandbox child process belongs to nobody-user(65534…

…)-group
skkuding · Dec 7, 2024 · 3d1bb20 · 3d1bb20
1 parent 59d1673
commit 3d1bb20
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/apps/iris/src/common/constants/constants.go b/apps/iris/src/common/constants/constants.go
@@ -53,3 +53,6 @@ const (
 	EXCHANGE   = "judger-exchange"
 	RESULT_KEY = "result"
 )
+
+const DEFAULT_UID = 65534 // nobody user
+const DEFAULT_GID = 65534 // nobody group
diff --git a/apps/iris/src/service/sandbox/langConfig.go b/apps/iris/src/service/sandbox/langConfig.go
@@ -262,6 +262,8 @@ func (l *langConfig) ToRunExecArgs(dir string, language Language, order int, lim
 		ErrorPath:       errorPath, // byte buffer로
 		LogPath:         constants.RUN_LOG_PATH,
 		SeccompRuleName: c.SeccompRule,
+		Uid:             constants.DEFAULT_UID,
+		Gid:             constants.DEFAULT_GID,
 		Args:            argSlice,
 	}, nil
 }