ioi / isolate

Sandbox for securely executing untrusted programs
Other
1.05k stars 157 forks source link

System Calls In Ruby Cause An Infinite Loop #89

Closed AyoubAref closed 4 years ago

AyoubAref commented 4 years ago

I have the following Ruby program, which executes ls command and prints its result.

# /box/a.rb
cmd = `ls`
puts cmd

If I run the following command it causes an infinite loop:

sudo isolate --time=1 --run /usr/local/bin/ruby /box/a.rb

Could any one help ?

Thanks in advance !

UPD: I've figured out a solution but I want a more efficient way to do it, I cloud run this command sudo timeout 2 isolate --time=1 --run /usr/local/bin/ruby /box/a.rb, so it will interrupt the process after two seconds

gollux commented 4 years ago

Running an external command requires creation of a new process. Isolate as you run it (i.e., without the -p switch) does not allow creation of new processes (for good reasons, see the man page). I guess that Ruby handles failures of fork() by retrying indefinitely.

If you want to run external programs inside the sandbox, you need to enable the cgroup mode by --cg and set a limit on the number of processes by -p. If you don't want, just impose a run time limit like you already tried. (A time limit is necessary anyway.)