qingdaou / judger

Online judge sandbox based on seccomp | OnlineJudge 安全沙箱

Judger

Judger for OnlineJudge

Document

JudgeServer

OnlineJudge

judger's Issues

树莓派上编译时报错

In file included from /home/pi/OnlineJudgeDeploy/Judger/src/rules/c_cpp.c:2:
/home/pi/OnlineJudgeDeploy/Judger/src/rules/c_cpp.c: In function ‘_c_cpp_seccomp_rules’:
/home/pi/OnlineJudgeDeploy/Judger/src/rules/c_cpp.c:35:89: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast]
     if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(execve), 1, SCMP_A0(SCMP_CMP_EQ, (scmp_datum_t)(_config->exe_path))) != 0) {
                                                                                         ^

gcc version 8.3.0 (Raspbian 8.3.0-6+rpi1)
GNU Make 4.2.1
cmake version 3.13.4

Problem while building module in nodejs

While building the nodejs version of the judger i am getting the following error,

../judger.cc:229:95: error: no matching function for call to ‘v8::Object::Set(v8::MaybeLocal<v8::String>, v8::Local<v8::Integer>)’

my node version is v16.20.1
and npm version is 8.19.4

I tried it with version node v18 and node v20 too

Wrong Answer because of last blank in the printf

Hello. Thanks for your OJ.

The last space in the sentence is treated as an incorrect answer.

for example,

my output is:
5 3 1(blank)
6 4 2(blank)

and tast case is:
5 3 1
6 4 2

There is a space at the end of the sentence in my output.
But tast case is not like that.

and there is also the opposite case. (tast case is a space at the end of the sentence, and output is not)

in this situation, I would like to admit it as an answer.

What should I do?

对于 python 文件运行，有没有对应的规则程序，现在使用c_cpp会报"signal": 31

文档中是否有错误

https://docs.onlinejudge.me/#/judger/api?id=struct-result-members

• real_time: actual running time of the process
• real_time: max vaule of memory used by the processd
  是不是写了两个 real_time ……

想要请教关于内存使用的记录的问题

您好，我之前一直尝试写一个自己的判题程序
看了一下贵校的源码，在内存使用方面调用的应当是c的系统类库中的resource_usage.ru_maxrss吧？
然后我通过python的api，获取一个Popen线程的resource_usage，一个struct结构
输出内容大概如下

(4619, 0, resource.struct_rusage(ru_utime=0.134376, ru_stime=0.003761, ru_maxrss=663552, ru_ixrss=0, ru_idrss=0, ru_isrss=0, ru_minflt=944, ru_majflt=2, ru_nswap=0, ru_inblock=0, ru_oublock=0, ru_msgsnd=0, ru_msgrcv=0, ru_nsignals=0, ru_nvcsw=1, ru_nivcsw=61))

其中ru_utime可以控制的非常完美，是理想的效果，然而就算这个ru_maxrss无论我怎样修改测试cpp代码，数值都是类似的，貌似就是给出的空间而非使用的空间。

现在搞的比较闹心……请问一下在开发过程中有没有类似的经验能够帮帮我呢，谢谢了！

More CPU Time then allowed

Submission is taking approx 900 to 1000 ms more than allowed CPU TIME, for all languages.(Tested with infinite loops)
Also, how can CPU time be less than real-time? Any suggestion on what could have gone wrong?
Correct Answer:- {'cpu_time': 89, 'real_time': 74, 'memory': 28536832, 'signal': 0, 'exit_code': 0, 'error': 0, 'result': 0}
Time Limit :- {'cpu_time': 1985, 'real_time': 1969, 'memory': 28913664, 'signal': 9, 'exit_code': 0, 'error': 0, 'result': 1}

不同的cpu系统调用名称不同

在测试的过程中，我发现不同的cpu系统调用的名称不同。
测试程序：

#include <iostream>
#include <cstdio>
using namespace std;
int main(){
//    freopen("input.txt", "r", stdin);
    int a,b,c;
    while(cin>>c) {
        while(c--){
            cin>>a>>b;
            cout<<a+b<<endl;

        }
    }
    return 0;
}

在本机（i5）正常。
在“Intel(R) Core(TM) Duo CPU U2400”上会result的值是runtime-error

strace之后发现系统调用的名称不一样。
部分log

access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/i686/cmov/libm.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\3\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\0F\0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=280108, ...}) = 0
mmap2(NULL, 282784, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb767b000
mmap2(0xb76bf000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x43000) = 0xb76bf000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/libgcc_s.so.1", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\240 \0\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0644, st_size=114964, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb767a000
mmap2(NULL, 118164, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb765d000
mmap2(0xb7679000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b000) = 0xb7679000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/i686/cmov/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\3\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\233\1\0004\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1738492, ...}) = 0
mmap2(NULL, 1743484, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb74b3000
mmap2(0xb7657000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a4000) = 0xb7657000
mmap2(0xb765a000, 10876, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xb765a000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb74b2000
set_thread_area({entry_number:-1, base_addr:0xb74b2940, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0 (entry_number:6)
mprotect(0xb7657000, 8192, PROT_READ)   = 0
mprotect(0xb76bf000, 4096, PROT_READ)   = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb74b1000
mprotect(0xb77a7000, 16384, PROT_READ)  = 0
mprotect(0xb77ec000, 4096, PROT_READ)   = 0
munmap(0xb77b3000, 82863)               = 0
open("input.txt", O_RDONLY)             = 3
dup3(3, 0, 0)                           = 0
close(3)                                = 0
fstat64(0, {st_mode=S_IFREG|0644, st_size=14, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77c7000
read(0, "3\n1 2\n2 3\n3 4\n", 4096)     = 14
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 9), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb77c6000

之后尝试添加了mmap2，fstat64，set_thread_area这三个系统调用之后运行才正常（缺一不可，包括那个set_thread_area）。

可能其它的cpu还会有不同的名字，可能会在广泛使用中产生影响。

还有，readme中可以备注一下内核的版本，3.5以下的内核会报”init seccomp failed“。

对java测评中出现的异常

judger产生的错误日志

FATAL [2019-12-26 06:47:49] [/Judger/src/child.c:159]Error: System errno: No such file or directory; Internal errno: EXECVE_FAILED

exe_path = '/usr/bin/java -cp /Judger/ -XX:MaxRAM=%dk -Djava.security.manager -Dfile.encoding=UTF-8 -Djava.awt.headless=true Main' % (1024*1024)

input: in.txt
output: out.txt
error: error.txt
log: log.log
运行test.py 尝试测评报错

/Judger/
|-- CMakeLists.txt
|-- Main.class
|-- Main.java
|-- src
|-- in.txt
|-- test.py
|-- log.log
|-- testout.txt
|-- error.txt

import _judger
import os
def judgeJava(timelimit, memorylimit, inputpath, outputpath, errorpath, id, judgername):
    return _judger.run(max_cpu_time=timelimit,
            max_real_time=10000,
            max_memory=1024*1024*1024,
            max_process_number=32,
            max_output_size=32*1024*1024,
            max_stack=32*2014*1024,
            # five args above can be _judger.UNLIMITED
            exe_path='java -cp /JudeeJudger/ -XX:MaxRAM=%dk -Djava.security.manager -Dfile.encoding=UTF-8  -Djava.awt.headless=true Main' % (1024*1024),
            input_path=inputpath,
            output_path=outputpath,
            error_path=errorpath,
            args=[],
            # can be empty list
            env=["LANG=en_US.UTF-8", "LANGUAGE=en_US:en", "LC_ALL=en_US.UTF-8"],
            log_path=judgername+"judger.log",
            # can be None
            seccomp_rule_name=None,
            uid=0,
            gid=0,
            memory_limit_check_only=0
            )



if __name__ == '__main__':
    a = judgeJava(10000,10000,'/JudeeJudger/te.txt','/JudeeJudger/testout.txt','/JudeeJudger/testroort.txt',234,'/JudeeJudger/test')
    print(a)

Getting error, submitting code with Javascript, on using SPJ. Works fine for other languages.

2020-12-29 03:27:05,567 ERROR Expecting value: line 1 column 1 (char 0)
multiprocessing.pool.RemoteTraceback:
"""
Traceback (most recent call last):
File "/usr/lib/python3.6/multiprocessing/pool.py", line 119, in worker
result = (True, func(*args, **kwds))
File "/code/judge_client.py", line 20, in _run
return instance._judge_one(test_case_file_id)
File "/code/judge_client.py", line 155, in _judge_one
spj_result = self._spj(in_file_path=in_file, user_out_file_path=user_output_file)
File "/code/judge_client.py", line 91, in _spj
gid=SPJ_GROUP_GID)
File "/usr/local/lib/python3.6/dist-packages/_judger/init.py", line 84, in run
return json.loads(out.decode("utf-8"))
File "/usr/lib/python3.6/json/init.py", line 354, in loads
return _default_decoder.decode(s)
File "/usr/lib/python3.6/json/decoder.py", line 339, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/usr/lib/python3.6/json/decoder.py", line 357, in raw_decode
raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
"""

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
File "/code/server.py", line 192, in server
ret = {"err": None, "data": getattr(JudgeServer, path)(**data)}
File "/code/server.py", line 150, in judge
run_result = judge_client.run()
File "/code/judge_client.py", line 209, in run
result.append(item.get())
File "/usr/lib/python3.6/multiprocessing/pool.py", line 644, in get
raise self._value
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)

Gives runtime error all time on Ubuntu 20.04

I am trying to run the judger on ubuntu 20.04. It gives Run Time Error.

Result:
{'cpu_time': 0, 'real_time': 155, 'memory': 1478656, 'signal': 31, 'exit_code': 0, 'error': 0, 'result': 4}

I am using python 3.8

用demo里的东西测试提示这个是为什么

edb@edb-X555LI:~/Judger/demo$ sudo python demo.py
Traceback (most recent call last):
File "demo.py", line 26, in
gid=0)
ValueError: dlopen error

编译报错

mrpython@MP-ThinkPad:~/Desktop/Judger/build$ cmake .. && make && sudo make install
CMake Deprecation Warning at CMakeLists.txt:1 (cmake_minimum_required):
Compatibility with CMake < 2.8.12 will be removed from a future version of
CMake.

Update the VERSION argument value or use a ... suffix to tell
CMake that the project does not need compatibility with older versions.

-- Configuring done
-- Generating done
-- Build files have been written to: /home/mrpython/Desktop/Judger/build
[ 8%] Building C object CMakeFiles/libjudger.so.dir/src/argtable3.o
In function ‘arg_cat’,
inlined from ‘arg_cat_option’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4479:13,
inlined from ‘arg_print_syntax’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4681:9:
/home/mrpython/Desktop/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
4406 | *dest = 0;
| ~~~~~~^~~
/home/mrpython/Desktop/Judger/src/argtable3.c: In function ‘arg_print_syntax’:
/home/mrpython/Desktop/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object ‘syntax’ of size 200
4669 | char syntax[200]="";
| ^~~~~~
In function ‘arg_cat’,
inlined from ‘arg_cat_option’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4467:17,
inlined from ‘arg_print_syntax’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4681:9:
/home/mrpython/Desktop/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
4406 | *dest = 0;
| ~~~~~~^~~
/home/mrpython/Desktop/Judger/src/argtable3.c: In function ‘arg_print_syntax’:
/home/mrpython/Desktop/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object ‘syntax’ of size 200
4669 | char syntax[200]="";
| ^~~~~~
In function ‘arg_cat’,
inlined from ‘arg_cat_option’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4466:17,
inlined from ‘arg_print_syntax’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4681:9:
/home/mrpython/Desktop/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
4406 | *dest = 0;
| ~~~~~~^~~
/home/mrpython/Desktop/Judger/src/argtable3.c: In function ‘arg_print_syntax’:
/home/mrpython/Desktop/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object ‘syntax’ of size 200
4669 | char syntax[200]="";
| ^~~~~~
In function ‘arg_cat’,
inlined from ‘arg_cat_option’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4435:13,
inlined from ‘arg_print_syntax’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4681:9:
/home/mrpython/Desktop/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
4406 | *dest = 0;
| ~~~~~~^~~
/home/mrpython/Desktop/Judger/src/argtable3.c: In function ‘arg_print_syntax’:
/home/mrpython/Desktop/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object ‘syntax’ of size 200
4669 | char syntax[200]="";
| ^~~~~~
In function ‘arg_cat’,
inlined from ‘arg_cat_option’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4439:17,
inlined from ‘arg_print_syntax’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4681:9:
/home/mrpython/Desktop/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
4406 | *dest = 0;
| ~~~~~~^~~
/home/mrpython/Desktop/Judger/src/argtable3.c: In function ‘arg_print_syntax’:
/home/mrpython/Desktop/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object ‘syntax’ of size 200
4669 | char syntax[200]="";
| ^~~~~~
In function ‘arg_cat’,
inlined from ‘arg_cat_option’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4438:17,
inlined from ‘arg_print_syntax’ at /home/mrpython/Desktop/Judger/src/argtable3.c:4681:9:
/home/mrpython/Desktop/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
4406 | *dest = 0;
| ~~~~~~^~~
/home/mrpython/Desktop/Judger/src/argtable3.c: In function ‘arg_print_syntax’:
/home/mrpython/Desktop/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object ‘syntax’ of size 200
4669 | char syntax[200]="";
| ^~~~~~
cc1: all warnings being treated as errors
make[2]: *** [CMakeFiles/libjudger.so.dir/build.make:76：CMakeFiles/libjudger.so.dir/src/argtable3.o] 错误 1
make[1]: *** [CMakeFiles/Makefile2:83：CMakeFiles/libjudger.so.dir/all] 错误 2
make: *** [Makefile:136：all] 错误 2

Ubuntu18.04中Java使用Process调用命令行执行有错误

Python3和Python2的编译和跑测试点操作正常，
Java调用沙盒编译正常，但是跑测试点一直RE，所有测试点的输出报错日志都是：Could not reserve enough space for code cache

C和C++编译一直失败，错误提示是：collect2: fatal error: cannot find 'ld'

是不是无法用Java调用？我测试环境是Ubuntu18.04，程序不在docker容器里面的，g++ gcc openjdk-8都是正常用apt下载

关于rusage的值

您好，最近我也在做一个oj，在获取资源的时候出现了一些问题，看到您的项目，想要请教一下您，问题如下：
1、我使用struct rusage* rus和strucet rusage rus两种方式来创建rusage，并通过rus和&rus的方式传入wait4()，获取到了不同的结果，使用指针创建时结果较为正常，但是使用您代码中的方式时，ru_stime.tv_sec出现了一个非常大的值，且ru_stime.tv_usec始终为9.
2、在获取maxrss时也出现了一些问题，您的文档中似乎提到了有一些坑并给出了链接，但是链接好像过期了。我的问题是得到的maxrss非常大，即使是运行int main(){return 0;}也有2400多（linux中maxrss的单位应该是kb),显然是错误的值。

谢谢您的帮助，希望您可以指教

Question: Do we really need root user privileges to run this Judger?

Cloud providers like AWS provides default user with the container instance (means not a root user and with limited privileges required). Because of this I'm unable to run this judger on cloud environments (always giving ROOT_REQUIRED error)

如何允许网络访问

期望能使用requests包，进行网络访问后进行判断

对于不同语言（python2、3，java）给libjudger.so的参数应该是怎样的

在项目中似乎只有c语言的demo，在尝试python时我将python代码编译为main.pyc并chmod +x，demo.py中更改exe_path为main.pyc,将seccomp_rule_name设置为general，但这样仍然不能运行，
log显示：FATAL [2019-02-13 15:06:17] [/root/judger/Judger/src/child.c:159]Error: System errno: Exec format error; Internal errno: EXECVE_FAILED
请问python或java的参数应该怎样写才能正确运行

Python writing file returns Runtime Error in File IO mode

The "Signal" is 31 on the status page. I believe there is no file IO rule for Python (Java has the same problem)

Arm64 需要额外的系统调用

c_cpp 在 arm64 上需要额外的系统调用，看起来是 ld 的逻辑不太一样，用了别的系统调用

SCMP_SYS(faccessat), SCMP_SYS(newfstatat),
                                SCMP_SYS(set_tid_address), SCMP_SYS(set_robust_list),
                                SCMP_SYS(rseq), SCMP_SYS(prlimit64),
                                SCMP_SYS(getrandom), SCMP_SYS(fadvise64),

系统版本信息：

No LSB modules are available.
Distributor ID: Debian
Description:    Armbian 23.08.0-trunk bookworm
Release:        12
Codename:       bookworm

内存进制转换问题

runner.c line 111
_result->memory = resource_usage.ru_maxrss * 1024;
根据 http://man7.org/linux/man-pages/man2/getrusage.2.html
maxrss应为kilobytes
根据 SI 1kilobytes = 10^3 bytes
这里使用1024是否准确

仅含Judger本体的Dockerfile？

是否有一个仅含Judger本体、可以通过_judger.run(...)（Python）语句直接调用Judger的Docker呢？

（我用自己编译的Judger执行这里的Python demo得到的echo.out文件是空的...而且每次把Windows下写的.py文件传到Linux服务器上调试感觉很不方便= =因此问一下有没有现成的；而现有的docker-compose中的judger是server，不能“直接调用”）

php如何调用本项目

本人最近在做一个在线考试的小应用。使用php写的，想请教一下如何使用php调用Judger。感谢。

有没有办法可以给远程进程安装seccomp-filter？

最近在研究seccomp机制，想做一个工具能够根据进程pid号，给远程进程用seccomp限制系统调用，大佬有没有思路。谢谢了！

你好，我正在写一个oj作为我的毕设，想采用你们的judger作为判题机

我最近在毕设上的判题机卡住了，对底层方面不太熟悉，想使用你们的判题机，setup方面碰到了困难

编译时提示'seccomp.h' file not found

想学习一下这个项目down下来以后在
sudo python setup.py install
时提示runner.c:5:10: fatal error: 'seccomp.h' file not found
不太明白这是什么，是否需要安装相关的依赖包？
操作系统是OSX

Alpine环境下编译错误

由于开启了-Werr，alpine在编译时会报出意为“将wait.h重定向至sys/wait.h”的警告而被视为错误

应当在runner.c中使用#include<sys/wait.h>而非wait.h

关于uid和gid的问题

编译之后我尝试在命令行下执行

sudo ./Judger --max_cpu_time=1000 --max_real_time=2000 --max_memory=134217728 --max_process_number=200 --ax_output_size=10000 --max_stack=33554432 --exe_path="../demo/main" --input_path="../demo/1.in" --output_path="../demo/1.out" --error_path="../demo/1.out" --log_path="judger.log" --seccomp_rule_name="c_cpp" --uid=1000 --gid=1000

uid和gid设置为当前系统的用户，结果返回系统错误

{
    "cpu_time": 1,
    "real_time": 114,
    "memory": 2158592,
    "signal": 31,
    "exit_code": 0,
    "error": 0,
    "result": 4
}

然后我又试了其他的uid和gid，发现除了当前用户(1000)，其他都可以正常执行，包括随便一个uid，系统里不存在的用户也可以？，这是什么原理呢？

Document 404 not found

http://docs.onlinejudge.me/#/judger/
404 not found

测试时出现错误

OS: Ubuntu 20.04.2 LTS x86_64
Kernel: 5.4.0-58-generic
Judger version 2.1.1
2.7.18 (default, Aug 4 2020, 11:16:42)
[GCC 9.3.0]

FAIL: test_writev (testcase.integration.test.IntegrationTest)**

Traceback (most recent call last):
File "/home/twist/桌面/Judger-newnew/tests/Python_and_core/testcase/integration/test.py", line 329, in test_writev
self.assertEqual(result["result"], _judger.RESULT_SUCCESS)
AssertionError: 4 != 0

---

Ran 35 tests in 22.413s

FAILED (failures=1)

关于如何使用judge跑nodejs的代码的问题？

judge本身已经提供了nodejs版本的库，但是测试用例run的是c的代码，judge.run如何运行nodejs代码？

我用python的language配置改写的nodejs的，报错result：4即runtime错误，不过我的runtime命令行直接跑是对的

const judger = require("../../bindings/NodeJS/build/Release/judger.node")
const default_env = ["LANG=en_US.UTF-8", "LANGUAGE=en_US:en", "LC_ALL=en_US.UTF-8"]

ret = judger.run({max_cpu_time:1000,
                  max_real_time:2000,
                  max_memory:128 * 1024 * 1024,
                  max_process_number:200,
                  max_output_size:10000,
                  max_stack:32 * 1024 * 1024,
                  exe_path:"/root/bin/node",
                  input_path:"1.in",
                  output_path:"1.out",
                  error_path:"1.out",
                  args:['main.js'],
                  env:default_env,
                  log_path:"judger.log",
                  seccomp_rule_name:"general",
                  uid:0,
                  gid:0})
console.log(ret)

M1 无法正常运行沙盒

在 amd64 机器上正常运行的代码，换到 M1 arm64 后报错，不是特别熟悉这边涉及的内容，忙着处理业务需求，暂时抽不出时间做这个调整，希望有人可以帮忙一起解决。

目前临时解决方案：因为实际服务器都是 amd64 的，我把 rules 目录中的 seccomp_rules 校验全关了，直接 return 0 来支持本地开发。

Import pandas, scipy, numpy

Set "read_only" as false in docker-compose.yml:

  judge-server:
    image: registry.cn-hangzhou.aliyuncs.com/onlinejudge/judge_server
    container_name: judge-server
    restart: always
    read_only: false
    tmpfs:
      - /tmp
    volumes:
      - ./data/backend/test_case:/test_case:ro
      - ./data/judge_server/log:/log
      - ./data/judge_server/run:/judger
    environment:
      - SERVICE_URL=http://judge-server:8080
      - BACKEND_URL=http://oj-backend:8000/api/judge_server_heartbeat/
      - TOKEN=CHANGE_THIS
        #- judger_debug=1

Install packages and dependencies through apt-get

docker exec -it judge-server bash
apt-get update
apt-get install build-essential
apt-get install libncurses5-dev libgdbm-dev libnss3-dev libssl-dev libreadline-dev libffi-dev
apt-get install python3-pandas

Ubuntu 18.04 环境下c_cpp规则运行错误

在ubuntu 18.04环境下使用c_cpp的seccomp_rule_name出错。

在18.04环境下使用gcc编译的程序会执行openat系统调用，查看动态链接库的相关信息。

strace结果

execve("./a.out", ["./a.out"], 0x7ffdcc1b6ac0 /* 68 vars */) = 0
brk(NULL)                               = 0x556a55e84000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=85932, ...}) = 0
mmap(NULL, 85932, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f4629fb8000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\34\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4629fb6000
mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f46299b5000
mprotect(0x7f4629b9c000, 2097152, PROT_NONE) = 0
mmap(0x7f4629d9c000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7f4629d9c000
mmap(0x7f4629da2000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4629da2000
close(3)                                = 0
arch_prctl(ARCH_SET_FS, 0x7f4629fb7500) = 0
mprotect(0x7f4629d9c000, 16384, PROT_READ) = 0
mprotect(0x556a54d80000, 4096, PROT_READ) = 0
mprotect(0x7f4629fcd000, 4096, PROT_READ) = 0
munmap(0x7f4629fb8000, 85932)           = 0
fstat(0, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
brk(NULL)                               = 0x556a55e84000
brk(0x556a55ea5000)                     = 0x556a55ea5000
lseek(0, -1, SEEK_CUR)                  = -1 ESPIPE (Illegal seek)
exit_group(0)                           = ?

解决的方法是使用gcc编译过程中，添加-static选项

Run judger on alpine linux container (for cloud environments)

I'm trying to build a judger on alpine base image for running it on cloud container environments. but I'm getting following errors (I know you have mentioned that it is tested on ubuntu:18.04)

-- The C compiler identification is GNU 11.2.1
-- Detecting C compiler ABI info
-- Detecting C compiler ABI info - done
-- Check for working C compiler: /usr/bin/cc - skipped
-- Detecting C compile features
-- Detecting C compile features - done
-- Configuring done
-- Generating done
-- Build files have been written to: /Judger/build
[  7%] Building C object CMakeFiles/libjudger.so.dir/src/argtable3.o
In function 'arg_cat',
    inlined from 'arg_cat_option' at /Judger/src/argtable3.c:4479:13,
    inlined from 'arg_print_syntax' at /Judger/src/argtable3.c:4680:9:
/Judger/src/argtable3.c:4406:11: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
 4406 |     *dest = 0;
      |     ~~~~~~^~~
/Judger/src/argtable3.c: In function 'arg_print_syntax':
/Judger/src/argtable3.c:4669:14: note: at offset 200 into destination object 'syntax' of size 200
 4669 |         char syntax[200] = "";
      |              ^~~~~~
cc1: all warnings being treated as errors
make[2]: *** [CMakeFiles/libjudger.so.dir/build.make:76: CMakeFiles/libjudger.so.dir/src/argtable3.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:83: CMakeFiles/libjudger.so.dir/all] Error 2
make: *** [Makefile:136: all] Error 2
/Judger/build #

Kindly help

你好，这个 OJ 要怎么用？

你好 这个 东西 我在 centos7 上跑，得到 result= 5 ，我 想了解一下这个 judger 具体的使用方法，希望作者能教教我

判题时报错

我在用您这个沙箱的进行判题时有一个报错日志，说 'child.c' 里面 include 了 'runner.h'，用到了里面的 DUP2_FAILED 常量，但是却说找不到，为什么呢？沙箱我一点都没改过，运行在虚拟机里面的。

编译报错，demo中的main.c

命令sudo /usr/lib/judger/libjudger.so --exe_path=/usr/bin/gcc --args=main.c --args=-o --args=main --input_path=1.in
输出

collect2: fatal error: cannot find 'ld'
compilation terminated.
{
    "cpu_time": 10,
    "real_time": 19,
    "memory": 20480000,
    "signal": 0,
    "exit_code": 1,
    "error": 0,
    "result": 4
}

如果你正在被设置seccomp所困扰

即使没有任何内容，仅仅只有一个main函数和return,按照c_cpp.c中的代码设置好了限制，却发现依旧被kill
这可能是编译器版本或系统版本的原因，新的gcc版本可能会使用更加炫酷的内核函数
我的环境:
gcc version 11.3.0 (Ubuntu 11.3.0-1ubuntu1~22.04)
在我环境下的测试中，我发现对于下面这个简单cpp代码

#include<stdio.h>
int main(){
  int a;
  scanf("%d",&a);
  if(a==123)puts("yes");
  else puts("no");
  return 0;
}

我们需要额外允许newfstatat,lseek,rseq,getrandom,prlimit64,set_robust_list,openat,set_tid_address 这几个系统调用
我并不清楚开放这些后是否能保证系统不被恶意代码攻击
此外，如果即使开发了这些系统调用后，你的程序依旧被kill,那么你可以尝试使用trace来检查demo.cpp到底调用了哪些函数。

如果你认为trace很复杂，你也可以打开

/usr/include/x86_64-linux-gnu/asm/unistd_64.h

来获取所有的内核函数名并将其全部加载到代码中，接着使用二分的方法逐步检查出到底是哪些系统调用

很耗时但也很稳妥

Judger的文档网站挂了

关于内存限制的问题

你好，我想问下child.c 45行
max_memory.rlim_cur = max_memory.rlim_max = (rlim_t) (_config->max_memory) * 2;
乘2是什么原因？

Java的网络访问是如何限制的

一个用go调用judger.so的第三方库

可以用go语言调用judger.so的第三方库。https://github.com/jiang4869/go-judger

在此感谢作者开源的这个判题机

libseccomp seems to be not working as expected

When I traced a this project using strace, I got the following output.

6885  15:57:14 seccomp(SECCOMP_SET_MODE_STRICT, 0x1, NULL) = -1 EINVAL (Invalid argument)
6885  15:57:14 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC, NULL) = -1 EFAULT (Bad address)
6885  15:57:14 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_LOG, NULL) = -1 EFAULT (Bad address)
6885  15:57:14 seccomp(SECCOMP_GET_ACTION_AVAIL, 0, [SECCOMP_RET_LOG]) = 0
6885  15:57:14 seccomp(SECCOMP_GET_ACTION_AVAIL, 0, [SECCOMP_RET_KILL_PROCESS]) = 0
6885  15:57:14 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_SPEC_ALLOW, NULL) = -1 EFAULT (Bad address)
6885  15:57:14 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_NEW_LISTENER, NULL) = -1 EFAULT (Bad address)
6885  15:57:14 seccomp(SECCOMP_GET_NOTIF_SIZES, 0, {seccomp_notif=80, seccomp_notif_resp=24, seccomp_data=64}) = 0
6885  15:57:14 seccomp(SECCOMP_SET_MODE_FILTER, SECCOMP_FILTER_FLAG_TSYNC_ESRCH, NULL) = -1 EFAULT (Bad address)
6885  15:57:14 prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) = 0
6885  15:57:14 seccomp(SECCOMP_SET_MODE_FILTER, 0, {len=30, filter=0x55a7aaa8b490}) = 0

Seems like none of the filters are added.
I have tried it on Ubuntu 22 x86_64.
I have tried hard and any help in this regard would really be appreciated.

运行demo时，result=4，请问大佬有解决办法么？

Time limit issues

I have created a problem where time limit is set to 2000ms.

And now i run a simple cpp code as given below -

Inspite of setting only 2000ms as time limit, the for loop runs 10^16 times.
Expected result should be Time limit Exceeded

But the program is running smoothly in only 1 or 2 ms as shown below

On other external platforms like leetcode/codeforces/codechef, such a cpp code gives time limit exceeded
Can you please help me with this issue?

Thank you!

Tip: use native executable with Java JNI

If you provide the binding implementation in java, we can directly incorporate the native judger executable with java jni, which is very fast than call the native execute using process api (like you have mentioned in python binding)

多进程程序运行后内存获取不正确

在 沙箱中运行

stress --vm-bytes 256m --vm-keep --vm 2 --timeout 3s

命令可以发现沙箱输出的内存使用量约为 256m；但是根据命令的帮助，以及使用 cgroup 的辅助统计，在肉眼查看 top 等监控数值，可得出内存使用量应该为 512m 左右，是否是 getrusage 的原因？以及是否有什么方式进行改进？

P.S. Stress 的进程结构为 主进程派生出子进程；主进程在前台运行，负责管理子进程，父子进程之间有心跳，一旦父进程down，子进程会打出错误日志后退出（观察后猜想）

使用沙盒编译时日志输出No such file or directory;

代码文件和输出目录都存在，我是直接在debian 9上运行的，日志输出

FATAL [2019-01-08 23:47:46] [/root/Judger/sandbox/src/child.c:159]Error: System errno: No such file or directory; Internal errno: EXECVE_FAILED

但是并不明确到底是什么文件不存在，希望能予以解答并加一个输出
感谢！

关于setrlimit

为什么这里内存需要乘2呢