Run student code
[run_student_code] allows code to be executed with limited resources and privileges. It is intended to be used for testing & marking of student code.
The code is run as a subordinate uid/gid and will not have read/write access to files owned by the executing user unless they are publically readable/writeable.
$ run_student_code id uid=65534(nobody) gid=60001(nobody) groups=60001(nobody) $ ls ~|wc -l 85 $ run_student_code ls ~ ls: cannot open directory '/import/adams/1/andrewt': Permission denied
If a pathname is supplied via --chown it is recursively chowned to the subordinate uid before running the command and chowned back to the user's primary uid afterwards. The pathname must be on a local filesystem, not NFS
This allows execution in a temporary directory with any files created by the command chowned back to the user.
$ temp_dir=$(mktemp -d)
$ cd $temp_dir
$ printf '#include <stdio.h>\nint main(void) {printf("Hello Andrew\\n");}' >a.c
$ ls -l a.c
-rw-r--r-- 1 andrewt andrewt 61 Jun 15 20:05 a.c
$ run_student_code --chown $temp_dir sh -c '
id
clang a.c
./a.out >output
ls -l *
'
uid=65534(nobody) gid=60001(nobody) groups=60001(nobody)
-rw-r--r-- 1 nobody nobody 61 Jun 16 08:29 a.c
-rwxr-xr-x 1 nobody nobody 16528 Jun 16 08:30 a.out
-rw-r--r-- 1 nobody nobody 13 Jun 16 08:30 output
$ ls -l *
-rw-r--r-- 1 andrewt andrewt 61 Jun 16 08:29 a.c
-rwxr-xr-x 1 andrewt andrewt 16528 Jun 16 08:30 a.out
-rw-r--r-- 1 andrewt andrewt 13 Jun 16 08:30 output
By default the network namespace is unshared before running the user's primary uid If network access is required, this can be disabled with --allow-network-access
$ run_student_code sh -c 'curl -sL https://deb.debian.org/debian/dists/stable/InRelease|wc -l' 0 $ run_student_code --allow-network-access sh -c 'curl -sL https://deb.debian.org/debian/dists/stable/InRelease|wc -l' 1258
The directories /home, /import, /export and /web can be optionally hidden with the option --hide_home_directories:
$ run_student_code ls /home/cs1511/public_html/index.html /home/cs1511/public_html/index.html $ run_student_code --hide-home-directories ls /home/cs1511/public_html/index.html ls: cannot access '/home/cs1511/public_html/index.html': Permission denied
By default the command is run a cgroup limited to 128 processes A different limit can be specified with -u Note this is different to ulimit -u which species a (less useful) per user limit
$ run_student_code -u 5 sh -c 'for i in $(seq 1 10); do sleep 10 & echo $i; done' 1 2 3 4 sh: 0: Cannot fork
These resource limits are specified by default.
max_core_size=0 max_file_size_bytes=8192000 max_rss_bytes=100000000 max_open_files=256 max_stack_bytes=32000000 max_cpu_seconds=60
Alternative values can be set using the same flags as used by bash ulimit
limitations
run_student_code should not be relied on to sandbox malicious code.