X-Git-Url: http://mj.ucw.cz/gitweb/?a=blobdiff_plain;ds=sidebyside;f=box%2Fbox.c;h=ca2a292bbb3d2793e965b0ae1b5ea307e432c575;hb=def7011b3ec2f20cc195a4405198e03eb6c92b47;hp=e3dadeaa70774f52ee6e49c7c69715891bfa2888;hpb=4fe7051e4ee89e51c6f6922220ab4b17d0d489b2;p=moe.git

diff --git a/box/box.c b/box/box.c
index e3dadea..ca2a292 100644
--- a/box/box.c
+++ b/box/box.c
@@ -47,7 +47,11 @@ static int ticks_per_sec;
 static int exec_seen;
 static int partial_line;
 
+static int mem_peak_kb;
+static int total_ms, wall_ms;
+
 static void die(char *msg, ...) NONRET;
+static void sample_mem_peak(void);
 
 /*** Meta-files ***/
 
@@ -85,8 +89,6 @@ meta_printf(const char *fmt, ...)
   va_end(args);
 }
 
-static int total_ms, wall_ms;
-
 static void
 final_stats(struct rusage *rus)
 {
@@ -99,6 +101,7 @@ final_stats(struct rusage *rus)
 
   meta_printf("time:%d.%03d\n", total_ms/1000, total_ms%1000);
   meta_printf("time-wall:%d.%03d\n", wall_ms/1000, wall_ms%1000);
+  meta_printf("mem:%llu\n", (unsigned long long) mem_peak_kb * 1024);
 }
 
 /*** Messages and exits ***/
@@ -108,6 +111,7 @@ box_exit(int rc)
 {
   if (box_pid > 0)
     {
+      sample_mem_peak();
       if (is_ptraced)
 	ptrace(PTRACE_KILL, box_pid);
       kill(-box_pid, SIGKILL);
@@ -133,6 +137,7 @@ flush_line(void)
   partial_line = 0;
 }
 
+/* Report an error of the sandbox itself */
 static void NONRET __attribute__((format(printf,1,2)))
 die(char *msg, ...)
 {
@@ -147,6 +152,7 @@ die(char *msg, ...)
   box_exit(2);
 }
 
+/* Report an error of the program inside the sandbox */
 static void NONRET __attribute__((format(printf,1,2)))
 err(char *msg, ...)
 {
@@ -166,6 +172,7 @@ err(char *msg, ...)
   box_exit(1);
 }
 
+/* Write a message, but only if in verbose mode */
 static void __attribute__((format(printf,1,2)))
 msg(char *msg, ...)
 {
@@ -204,7 +211,10 @@ enum action {
   A_NO,			// Always forbid
   A_YES,		// Always permit
   A_FILENAME,		// Permit if arg1 is a known filename
+  A_ACTION_MASK = 15,
+  A_SAMPLE_MEM = 64,	// Sample memory usage before the syscall
   A_LIBERAL = 128,	// Valid only in liberal mode
+  // Must fit in a unsigned char
 };
 
 static unsigned char syscall_action[NUM_ACTIONS] = {
@@ -226,7 +236,7 @@ static unsigned char syscall_action[NUM_ACTIONS] = {
     S(readlink) = A_FILENAME,
 
     // Syscalls permitted always
-    S(exit) = A_YES,
+    S(exit) = A_YES | A_SAMPLE_MEM,
     S(read) = A_YES,
     S(write) = A_YES,
     S(close) = A_YES,
@@ -259,13 +269,15 @@ static unsigned char syscall_action[NUM_ACTIONS] = {
     S(fcntl) = A_YES,
     S(fcntl64) = A_YES,
     S(mmap) = A_YES,
+    S(mmap2) = A_YES,
     S(munmap) = A_YES,
     S(ioctl) = A_YES,
     S(uname) = A_YES,
     S(gettid) = A_YES,
     S(set_thread_area) = A_YES,
     S(get_thread_area) = A_YES,
-    S(exit_group) = A_YES,
+    S(set_tid_address) = A_YES,
+    S(exit_group) = A_YES | A_SAMPLE_MEM,
 
     // Syscalls permitted only in liberal mode
     S(time) = A_YES | A_LIBERAL,
@@ -304,7 +316,6 @@ static unsigned char syscall_action[NUM_ACTIONS] = {
     S(rt_sigtimedwait) = A_YES | A_LIBERAL,
     S(rt_sigqueueinfo) = A_YES | A_LIBERAL,
     S(rt_sigsuspend) = A_YES | A_LIBERAL,
-    S(mmap2) = A_YES | A_LIBERAL,
     S(_sysctl) = A_YES | A_LIBERAL,
 #undef S
 };
@@ -639,28 +650,28 @@ valid_filename(unsigned long addr)
     err("FA: Forbidden access to file `%s'", namebuf);
 }
 
+// Check syscall. If invalid, return -1, otherwise return the action mask.
 static int
 valid_syscall(struct user *u)
 {
   unsigned int sys = u->regs.orig_eax;
-  enum action act = (sys < NUM_ACTIONS) ? syscall_action[sys] : A_DEFAULT;
+  unsigned int act = (sys < NUM_ACTIONS) ? syscall_action[sys] : A_DEFAULT;
 
   if (act & A_LIBERAL)
     {
-      if (filter_syscalls == 1)
-        act &= ~A_LIBERAL;
-      else
+      if (filter_syscalls != 1)
         act = A_DEFAULT;
     }
-  switch (act)
+
+  switch (act & A_ACTION_MASK)
     {
     case A_YES:
-      return 1;
+      return act;
     case A_NO:
-      return 0;
+      return -1;
     case A_FILENAME:
       valid_filename(u->regs.ebx);
-      return 1;
+      return act;
     default: ;
     }
 
@@ -672,16 +683,16 @@ valid_syscall(struct user *u)
 	  meta_printf("exitsig:%d\n", (int)u->regs.ecx);
 	  err("SG: Committed suicide by signal %d", (int)u->regs.ecx);
 	}
-      return 0;
+      return -1;
     case __NR_tgkill:
       if (u->regs.ebx == box_pid && u->regs.ecx == box_pid)
 	{
 	  meta_printf("exitsig:%d\n", (int)u->regs.edx);
 	  err("SG: Committed suicide by signal %d", (int)u->regs.edx);
 	}
-      return 0;
+      return -1;
     default:
-      return 0;
+      return -1;
     }
 }
 
@@ -701,6 +712,27 @@ signal_int(int unused UNUSED)
   err("SG: Interrupted");
 }
 
+#define PROC_BUF_SIZE 4096
+static void
+read_proc_file(char *buf, char *name, int *fdp)
+{
+  int c;
+
+  if (!*fdp)
+    {
+      sprintf(buf, "/proc/%d/%s", (int) box_pid, name);
+      *fdp = open(buf, O_RDONLY);
+      if (*fdp < 0)
+	die("open(%s): %m", buf);
+    }
+  lseek(*fdp, 0, SEEK_SET);
+  if ((c = read(*fdp, buf, PROC_BUF_SIZE-1)) < 0)
+    die("read on /proc/$pid/%s: %m", name);
+  if (c >= PROC_BUF_SIZE-1)
+    die("/proc/$pid/%s too long", name);
+  buf[c] = 0;
+}
+
 static void
 check_timeout(void)
 {
@@ -718,35 +750,23 @@ check_timeout(void)
     }
   if (timeout)
     {
-      char buf[4096], *x;
-      int c, utime, stime, ms;
-      static int proc_status_fd;
-      if (!proc_status_fd)
-	{
-	  sprintf(buf, "/proc/%d/stat", (int) box_pid);
-	  proc_status_fd = open(buf, O_RDONLY);
-	  if (proc_status_fd < 0)
-	    die("open(%s): %m", buf);
-	}
-      lseek(proc_status_fd, 0, SEEK_SET);
-      if ((c = read(proc_status_fd, buf, sizeof(buf)-1)) < 0)
-	die("read on /proc/$pid/stat: %m");
-      if (c >= (int) sizeof(buf) - 1)
-	die("/proc/$pid/stat too long");
-      buf[c] = 0;
+      char buf[PROC_BUF_SIZE], *x;
+      int utime, stime, ms;
+      static int proc_stat_fd;
+      read_proc_file(buf, "stat", &proc_stat_fd);
       x = buf;
       while (*x && *x != ' ')
 	x++;
       while (*x == ' ')
 	x++;
       if (*x++ != '(')
-	die("proc syntax error 1");
+	die("proc stat syntax error 1");
       while (*x && (*x != ')' || x[1] != ' '))
 	x++;
       while (*x == ')' || *x == ' ')
 	x++;
       if (sscanf(x, "%*c %*d %*d %*d %*d %*d %*d %*d %*d %*d %*d %d %d", &utime, &stime) != 2)
-	die("proc syntax error 2");
+	die("proc stat syntax error 2");
       ms = (utime + stime) * 1000 / ticks_per_sec;
       if (verbose > 1)
 	fprintf(stderr, "[time check: %d msec]\n", ms);
@@ -755,6 +775,51 @@ check_timeout(void)
     }
 }
 
+static void
+sample_mem_peak(void)
+{
+  /*
+   *  We want to find out the peak memory usage of the process, which is
+   *  maintained by the kernel, but unforunately it gets lost when the
+   *  process exits (it is not reported in struct rusage). Therefore we
+   *  have to sample it whenever we suspect that the process is about
+   *  to exit.
+   */
+  char buf[PROC_BUF_SIZE], *x;
+  static int proc_status_fd;
+  read_proc_file(buf, "status", &proc_status_fd);
+
+  x = buf;
+  while (*x)
+    {
+      char *key = x;
+      while (*x && *x != ':' && *x != '\n')
+	x++;
+      if (!*x || *x == '\n')
+	break;
+      *x++ = 0;
+      while (*x == ' ' || *x == '\t')
+	x++;
+
+      char *val = x;
+      while (*x && *x != '\n')
+	x++;
+      if (!*x)
+	break;
+      *x++ = 0;
+
+      if (!strcmp(key, "VmPeak"))
+	{
+	  int peak = atoi(val);
+	  if (peak > mem_peak_kb)
+	    mem_peak_kb = peak;
+	}
+    }
+
+  if (verbose > 1)
+    msg("[mem-peak: %u KB]\n", mem_peak_kb);
+}
+
 static void
 boxkeeper(void)
 {
@@ -816,9 +881,10 @@ boxkeeper(void)
 	  if (wall_timeout && wall_ms > wall_timeout)
 	    err("TO: Time limit exceeded (wall clock)");
 	  flush_line();
-	  fprintf(stderr, "OK (%d.%03d sec real, %d.%03d sec wall, %d syscalls)\n",
+	  fprintf(stderr, "OK (%d.%03d sec real, %d.%03d sec wall, %d MB, %d syscalls)\n",
 	      total_ms/1000, total_ms%1000,
 	      wall_ms/1000, wall_ms%1000,
+	      (mem_peak_kb + 1023) / 1024,
 	      syscall_count);
 	  box_exit(0);
 	}
@@ -826,6 +892,7 @@ boxkeeper(void)
 	{
 	  box_pid = 0;
 	  meta_printf("exitsig:%d\n", WTERMSIG(stat));
+	  final_stats(&rus);
 	  err("SG: Caught fatal signal %d%s", WTERMSIG(stat), (syscall_count ? "" : " during startup"));
 	}
       if (WIFSTOPPED(stat))
@@ -837,12 +904,15 @@ boxkeeper(void)
 	      static int stop_count = -1;
 	      if (ptrace(PTRACE_GETREGS, box_pid, NULL, &u) < 0)
 		die("ptrace(PTRACE_GETREGS): %m");
+	      if (u.regs.orig_eax < 0)		/* Process issued a breakpoint instruction */
+		err("SG: Breakpoint");
 	      stop_count++;
 	      if (!stop_count)			/* Traceme request */
 		msg(">> Traceme request caught\n");
 	      else if (stop_count & 1)		/* Syscall entry */
 		{
 		  char namebuf[32];
+		  int act;
 		  msg(">> Syscall %-12s (%08lx,%08lx,%08lx) ", syscall_name(u.regs.orig_eax, namebuf), u.regs.ebx, u.regs.ecx, u.regs.edx);
 		  if (!exec_seen)
 		    {
@@ -850,8 +920,12 @@ boxkeeper(void)
 		      if (u.regs.orig_eax == __NR_execve)
 			exec_seen = 1;
 		    }
-		  else if (valid_syscall(&u))
-		    syscall_count++;
+		  else if ((act = valid_syscall(&u)) >= 0)
+		    {
+		      syscall_count++;
+		      if (act & A_SAMPLE_MEM)
+			sample_mem_peak();
+		    }
 		  else
 		    {
 		      /*
@@ -873,6 +947,7 @@ boxkeeper(void)
 	  else if (sig != SIGSTOP && sig != SIGXCPU && sig != SIGXFSZ)
 	    {
 	      msg(">> Signal %d\n", sig);
+	      sample_mem_peak();			/* Signal might be fatal, so update mem-peak */
 	      ptrace(PTRACE_SYSCALL, box_pid, 0, sig);
 	    }
 	  else