search

python-discord / snekbox

Easy, safe evaluation of arbitrary Python code
https://pythondiscord.com
MIT License
214 stars 39 forks source link

Add inode limits to tmpfs #187

Open wookie184 opened 1 year ago

wookie184 commented 1 year ago

Adding an inode limit would limit the number of files/directories that can exist in the tmpfs we use for file IO. Given we already have file size limits, a maximum number of files we'll read, and a timeout, it shouldn't be too important, but it may be worth putting a limit to be safe. Currently it seems to be limited by the cgroup memory limit using (allowing for about 50_000 files with the current config).

This can be done by passing the nr_inodes argument here: https://github.com/python-discord/snekbox/blob/afda301bc07efeb2a1f33db9ec3b316393badfe0/snekbox/memfs.py#L58

jb3 commented 1 year ago

We should probably add a similar nr_inodes limit for the tmpfs we spawn for /dev/shm. This would be specified in the nsjail config file though. See #113.