使用 gcc/g++ 时抑制系统调用
我的大学 LAN 中有一个门户，人们可以在其中上传 C/C++ 编程难题的代码。我希望确保门户安全，以便人们无法通过其提交的代码进行系统调用。可能有几种解决方法，但我想知道是否可以简单地通过设置一些聪明的 gcc 标志来做到这一点。 libc 默认情况下似乎包含
I have a portal in my university LAN where people can upload code to programming puzzles in C/C++. I would like to make the portal secure so that people cannot make system calls via their submitted code. There might be several workarounds but I'd like to know if I could do it simply by setting some clever gcc flags. libc by default seems to include <unistd.h>, which appears to be the basic file where system calls are declared. Is there a way I could tell gcc/g++ to 'ignore' this file at compile time so that none of the functions declared in unistd.h can be accessed?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
一些特殊原因
chroot("/var/jail/empty"); setuid(65534);还不够好（假设 65534 有合理的限制）？Some particular reason why
chroot("/var/jail/empty"); setuid(65534);isn't good enough (assuming 65534 has sensible limits)?限制对头文件的访问不会阻止您访问
libc函数：如果您链接到libc，它们仍然可用 - 您只是不会拥有原型（和宏）到手；但你可以自己复制它们。不链接 libc 也无济于事：系统调用可以直接通过内联汇编器（甚至涉及跳转到数据的技巧）进行。
我认为这总体上不是一个好方法。在完全独立的虚拟沙箱中运行上传的代码（也许通过 QEMU 或类似的东西）可能是更好的方法。
Restricting access to the header file won't prevent you from accessing
libcfunctions: they're still available if you link againstlibc- you just won't have the prototypes (and macros) to hand; but you can replicate them yourself.And not linking against
libcwon't help either: system calls could be made directly via inline assembler (or even tricks involving jumping into data).I don't think this is a good approach in general. Running the uploaded code in a completely self-contained virtual sandbox (via QEMU or something like that, perhaps) would probably be a better way to go.
-D可以覆盖单个函数名称。例如：或者您可以自己设置包含保护：
但是智能提交者可以使用
#undef轻松恢复它们的效果:)-Dcan overwrite individual function names. For example:Or you can set the include guard yourself:
However their effects can be easily reverted with
#undefs by intelligent submitters :)