commit 4ac76f2e9fbfb75d1945d9955ddbb0088c5d0a7f · dunkirk.sh/battleship-arena

+58 -10
internal/runner/runner.go
···

       1
       1
        
       package runner

     

       2
       2
        
       

     

       3
       3
        
       import (

     

       4
       4
       +
       	"context"

     

       4
       5
        
       	"fmt"

     

       5
       6
        
       	"log"

     

       6
       7
        
       	"os"

     
···

       9
       10
        
       	"regexp"

     

       10
       11
        
       	"strconv"

     

       11
       12
        
       	"strings"

     

       13
       13
       +
       	"syscall"

     

       12
       14
        
       	"time"

     

       13
       15
        
       

     

       14
       16
        
       	"battleship-arena/internal/storage"

     
···

       23
       25
        
       	return "./battleship-engine"

     

       24
       26
        
       }

     

       25
       27
        
       

     

       28
       28
       +
       // runSandboxed executes a command in a systemd-run sandbox with resource limits

     

       29
       29
       +
       func runSandboxed(ctx context.Context, name string, args []string, timeoutSec int) ([]byte, error) {

     

       30
       30
       +
       	// Create context with timeout

     

       31
       31
       +
       	ctx, cancel := context.WithTimeout(ctx, time.Duration(timeoutSec)*time.Second)

     

       32
       32
       +
       	defer cancel()

     

       33
       33
       +
       	

     

       34
       34
       +
       	// Build systemd-run command with security properties

     

       35
       35
       +
       	systemdArgs := []string{

     

       36
       36
       +
       		"--user",           // Run as current user (not system-wide)

     

       37
       37
       +
       		"--scope",          // Create transient scope unit

     

       38
       38
       +
       		"--quiet",          // Suppress systemd output

     

       39
       39
       +
       		"--collect",        // Automatically clean up after exit

     

       40
       40
       +
       		"--property=MemoryMax=512M",        // Max 512MB RAM

     

       41
       41
       +
       		"--property=CPUQuota=200%",         // Max 2 CPU cores worth

     

       42
       42
       +
       		"--property=TasksMax=50",           // Max 50 processes/threads

     

       43
       43
       +
       		"--property=PrivateNetwork=true",   // Isolate network (no internet)

     

       44
       44
       +
       		"--property=PrivateTmp=true",       // Private /tmp

     

       45
       45
       +
       		"--property=ProtectHome=true",      // Make /home inaccessible

     

       46
       46
       +
       		"--property=ProtectSystem=strict",  // Read-only /usr, /boot, /etc

     

       47
       47
       +
       		"--property=NoNewPrivileges=true",  // Prevent privilege escalation

     

       48
       48
       +
       		"--",

     

       49
       49
       +
       	}

     

       50
       50
       +
       	systemdArgs = append(systemdArgs, args...)

     

       51
       51
       +
       	

     

       52
       52
       +
       	cmd := exec.CommandContext(ctx, "systemd-run", systemdArgs...)

     

       53
       53
       +
       	

     

       54
       54
       +
       	// Set process group for cleanup

     

       55
       55
       +
       	cmd.SysProcAttr = &syscall.SysProcAttr{

     

       56
       56
       +
       		Setpgid: true,

     

       57
       57
       +
       	}

     

       58
       58
       +
       	

     

       59
       59
       +
       	output, err := cmd.CombinedOutput()

     

       60
       60
       +
       	

     

       61
       61
       +
       	// Check for timeout

     

       62
       62
       +
       	if ctx.Err() == context.DeadlineExceeded {

     

       63
       63
       +
       		return output, fmt.Errorf("command timed out after %d seconds", timeoutSec)

     

       64
       64
       +
       	}

     

       65
       65
       +
       	

     

       66
       66
       +
       	return output, err

     

       67
       67
       +
       }

     

       68
       68
       +
       

     

       26
       69
        
       func CompileSubmission(sub storage.Submission, uploadDir string) error {

     

       27
       70
        
       	storage.UpdateSubmissionStatus(sub.ID, "testing")

     

       28
       71
        
       

     
···

       67
       110
        
       

     

       68
       111
        
       	log.Printf("Compiling submission %d for %s", sub.ID, prefix)

     

       69
       112
        
       	

     

       70
       70
       -
       	cmd := exec.Command("g++", "-std=c++11", "-c", "-O3",

     

       113
       113
       +
       	// Compile in sandbox with 60 second timeout

     

       114
       114
       +
       	compileArgs := []string{

     

       115
       115
       +
       		"g++", "-std=c++11", "-c", "-O3",

     

       71
       116
        
       		"-I", filepath.Join(enginePath, "src"),

     

       72
       117
        
       		"-o", filepath.Join(buildDir, "ai_"+prefix+".o"),

     

       73
       118
        
       		filepath.Join(enginePath, "src", sub.Filename),

     

       74
       74
       -
       	)

     

       75
       75
       -
       	output, err := cmd.CombinedOutput()

     

       119
       119
       +
       	}

     

       120
       120
       +
       	

     

       121
       121
       +
       	output, err := runSandboxed(context.Background(), "compile-"+prefix, compileArgs, 60)

     

       76
       122
        
       	if err != nil {

     

       77
       123
        
       		return fmt.Errorf("compilation failed: %s", output)

     

       78
       124
        
       	}

     
···

       140
       186
        
       		return 0, 0, 0

     

       141
       187
        
       	}

     

       142
       188
        
       	

     

       143
       143
       -
       	compileArgs := []string{"-std=c++11", "-O3",

     

       189
       189
       +
       	// Compile match binary in sandbox with 120 second timeout

     

       190
       190
       +
       	compileArgs := []string{"g++"}

     

       191
       191
       +
       	compileArgs = append(compileArgs, "-std=c++11", "-O3",

     

       144
       192
        
       		"-o", combinedBinary,

     

       145
       193
        
       		mainPath,

     

       146
       194
        
       		filepath.Join(enginePath, "src", "battleship_light.cpp"),

     

       147
       147
       -
       	}

     

       195
       195
       +
       	)

     

       148
       196
        
       	

     

       149
       197
        
       	if prefix1 == prefix2 {

     

       150
       198
        
       		compileArgs = append(compileArgs, filepath.Join(enginePath, "src", fmt.Sprintf("memory_functions_%s.cpp", prefix1)))

     
···

       155
       203
        
       		)

     

       156
       204
        
       	}

     

       157
       205
        
       	

     

       158
       158
       -
       	cmd := exec.Command("g++", compileArgs...)

     

       159
       159
       -
       	output, err := cmd.CombinedOutput()

     

       206
       206
       +
       	output, err := runSandboxed(context.Background(), "compile-match", compileArgs, 120)

     

       160
       207
        
       	if err != nil {

     

       161
       208
        
       		log.Printf("Failed to compile match binary: %s", output)

     

       162
       209
        
       		return 0, 0, 0

     

       163
       210
        
       	}

     

       164
       211
        
       	

     

       165
       165
       -
       	cmd = exec.Command(combinedBinary, strconv.Itoa(numGames))

     

       166
       166
       -
       	output, err = cmd.CombinedOutput()

     

       212
       212
       +
       	// Run match in sandbox with 300 second timeout (1000 games should be ~60s, give headroom)

     

       213
       213
       +
       	runArgs := []string{combinedBinary, strconv.Itoa(numGames)}

     

       214
       214
       +
       	output, err = runSandboxed(context.Background(), "run-match", runArgs, 300)

     

       167
       215
        
       	if err != nil {

     

       168
       168
       -
       		log.Printf("Match execution failed: %v", err)

     

       216
       216
       +
       		log.Printf("Match execution failed: %v\n%s", err, output)

     

       169
       217
        
       		return 0, 0, 0

     

       170
       218
        
       	}

     

       171
       219