Protection against a dangerous code

Codingame inspired me to create RPG for programmers. Who knows how it is better to organize protection against a dangerous code? I can do lexical filtering and restrict the compiled programs in number of open file descriptors and busy memory


	if (pipe(user->rPipe) || pipe(user->wPipe)){
		return 0;

	int pid = fork();
	if (pid < 0){ return 0; }
	else if (pid == 0){
		int size = 41943040;
		struct rlimit rl = { .rlim_cur = size, .rlim_max = size };
		setrlimit(RLIMIT_AS, &rl);

		dup2(user->wPipe[READ], 0);
		dup2(user->rPipe[WRITE], 1);
		dup2(user->rPipe[WRITE], 2);
		close(user->rPipe[READ]); close(user->wPipe[WRITE]);
		close(user->wPipe[READ]); close(user->rPipe[WRITE]);
		struct rlimit rl2 = { .rlim_cur = 0, .rlim_max = 0 };
		setrlimit(RLIMIT_NPROC, &rl2);
		struct rlimit rl3 = { .rlim_cur = 5, .rlim_max = 5 };
		setrlimit(RLIMIT_NOFILE, &rl3);
		execlp(cmdline, (char*)NULL);
		close(user->wPipe[READ]); close(user->rPipe[WRITE]);
		user->processInfo = pid;
		user->stdoutReadHandle = user->rPipe[READ];
		user->stdinWriteHandle = user->wPipe[WRITE];

	return 1;

Use of scripting languages is a little safer, but there it is necessary to strengthen filtering lexicon. It is more difficult to restrict Java because it launches one copy to the virtual machine for all programs therefore it is impossible to restrict the number of files.

Ejudge (contest management system) trace processes, but require the kernel patch. I tried to make a sandbox with trace, but she behaves inadequately.

How to protect the server from actions of client software programs, having spent for it a minimum of system resources (Debian)? Maybe someone knows how protection of CG works?

Run the following as the submission (in Bash) on one of the puzzles. It will give you some hints on what CG does with whatever languages happen to be running on the VM at the time:


ps ax | grep Answer >&2
  • danBhentschel
1 Like

Interestingly, thanks. You can tell what jail is used?


personally I use firejail

1 Like

I think that mbox approaches for this purpose better. It is much easier, and I don’t need X protection.