Help with seccomp filter

[AlphaNecron]

I'm trying to make a judge, and seccomp filter is not allowing normal calls though I've added all calls shown in strace. Can you help me?

[criyle]

Which call are you referring to? Seccomp config is provided by github.com/elastic/go-seccomp-bpf and you may check their example to write a config.

[AlphaNecron]

Using your config in cmd/runprog, modified a bit to match C++ calls, and it does not even work.

[criyle]

Please add log when running with ./runprog -show-trace-details ./a.out to allow further investigation.

[AlphaNecron]

------  41367  ------
set ptrace option for 41367
ptrace stopped
------  41367  ------
ptrace stopped
------  41367  ------
ptrace seccomp before execve (should be the execve syscall)
------  41367  ------
ptrace stop exec
------  41367  ------
seccomp traced
syscall: 21 access <nil>
check stat:  /etc/ld.so.preload
------  41367  ------
seccomp traced
syscall: 257 openat <nil>
open:  /etc/ld.so.cache r 
------  41367  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libstdc++.so.6 r 
------  41367  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libm.so.6 r 
------  41367  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libgcc_s.so.1 r 
------  41367  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libc.so.6 r 
------  41367  ------
seccomp traced
syscall: 218 set_tid_address <nil>
------  41367  ------
seccomp traced
syscall: 273 set_robust_list <nil>
------  41367  ------
seccomp traced
syscall: 334 rseq <nil>
------  41367  ------
process exited:  41367 0
id:"686492272fd040728de6d36fbbc883ab_hello-world_1682241272_e52284405a631fe8.0"  input:"10 20\n5 9 6 5 8 9 10 6 5 6"  duration:1 Result[2.662ms 4.9 MiB][1.355631ms 3.34794ms]
tracer started:  41384 <nil>
------  41384  ------
set ptrace option for 41384
ptrace stopped
------  41384  ------
ptrace stopped
------  41384  ------
ptrace seccomp before execve (should be the execve syscall)
------  41384  ------
ptrace stop exec
------  41384  ------
seccomp traced
syscall: 21 access <nil>
check stat:  /etc/ld.so.preload
------  41384  ------
seccomp traced
syscall: 257 openat <nil>
open:  /etc/ld.so.cache r 
------  41384  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libstdc++.so.6 r 
------  41384  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libm.so.6 r 
------  41384  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libgcc_s.so.1 r 
------  41384  ------
seccomp traced
syscall: 257 openat <nil>
open:  /usr/lib/libc.so.6 r 
------  41384  ------
seccomp traced
syscall: 218 set_tid_address <nil>
------  41384  ------
seccomp traced
syscall: 273 set_robust_list <nil>
------  41384  ------
seccomp traced
syscall: 334 rseq <nil>
------  41384  ------
process exited:  41384 0
id:"686492272fd040728de6d36fbbc883ab_hello-world_1682241272_e52284405a631fe8.1"  input:"8 22\n6 10 7 6 9 10 7 7"  duration:1 Result[582µs 8.9 MiB][1.163373ms 1.763512ms]

[criyle]

The main point of tracing is to ensure the program not to access unnecessary files. You may use -runner ns to use mount namespace to restrict file access instead. In this mode, program runs in an isolated mount namespace with seccomp filter applied.

[AlphaNecron]

Oh okay. Thanks.

[AlphaNecron]

Is using ActionTrace as the default action a good idea?

[AlphaNecron]

Btw runner.Result.Memory increases after each run, from 4MB to 11MB, is it an intended behavior?

[criyle]

If Cgroup v2 enabled or running without root, there's no memory max statistic so max_rss is being used. However, this statistic is not clearing when exec so it inherits parent process value, which is the memory used by executor_server.