Restricted Function with libsandbox and pysandbox

Question

I am using the sample2.py listed here https://github.com/openjudge/sandbox as a wrapper to call the sandbox libraries (aka. libsandbox && pysandbox).

Following is my C++ Code

#include <stdio.h>
int main(){
   return 0;
}

The result when i run the sample2.py is

result: RF
cpu: 2ms
mem: 288kB

Can anyone tell me what are the changes i have to do to the wrapper to make this work ?

Answer 1

For statically linking system calls we use system call codes for ex 0,1,2 3-sys_read 1-sys_exit and so on Go through link for more details link for system call list with code : http://docs.cs.up.ac.za/programming/asm/derick_tut/syscalls.html

I change this:

x86_64=set([0,1,5,8,9,10,11,12,16,21,25,63,89,158,219,231])

for this:

x86_64=set([0,1,2,3,4,5,8,9,10,11,12,16,21,25,63,89,158,219,231,])

in sample2.py, and It works

Modified sample2.py is available in my github repository link : https://github.com/palashmaran/libsandbox.git

Answer 2

The RF result code was most likely due to unexpected syscalls for file operations (i.e. SYS_open(), SYS_close(), SYS_stat(), ...). It so happens when (1) the target program actually does file operations, and (or) when (2) it was dynamically linked and needs to load .so libraries in runtime. Since your target program does not invoke file operations, it belongs to the latter case.

Then, to resolve the RF outcome, either,

1. statically link the target program to avoid dependencies on shared libraries; or,
2. extend the policy rules in the wrapper script to handle relevant SYSCALL / SYSRET events;

DISCLAIMER: I am the author of libsandbox.