Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rumur-run: avoid using file system if possible #154

Open
Smattr opened this issue Sep 14, 2019 · 3 comments
Open

rumur-run: avoid using file system if possible #154

Smattr opened this issue Sep 14, 2019 · 3 comments
Labels
enhancement

Comments

@Smattr
Copy link
Owner

Smattr commented Sep 14, 2019

Sometimes you have no access to the file system (nothing mounted, you're chrooted, ro mounts, ...). It would be nice if rumur-run still worked in such cases. This looks achievable on Linux using memfd_create and fexecve. I don't know how we can achieve this on other platforms, but Linux may be the only one where this situation regularly arises.
@Smattr
Copy link
Owner Author

Smattr commented Sep 19, 2019

This is somewhat harder than expected because memfd_create was only exposed in Python in 3.8. For the fexecve part, it looks like we can simply call os.execve with a file descriptor.

@Smattr
Copy link
Owner Author

Smattr commented Oct 5, 2019

We could also do some of this in the test suite, to use pipes instead of disk where possible.

Smattr added a commit that referenced this issue Nov 17, 2019
@Smattr
simplify rumur-run's --help check and execv early
c3e7335 
This not only simplifies this detection but allows us to more freely assume that
we are generating a verifier later on.

Github: related to #154 "rumur-run: avoid using file system if possible"
Smattr added a commit that referenced this issue Nov 17, 2019
@Smattr
avoid writing checker.c to disk in rumur-run
bace3a8 
Github: related to #154 "rumur-run: avoid using file system if possible"
@Smattr
Copy link
Owner Author

Smattr commented Jan 10, 2020

The rewritten test suite does this about as extensively as possible without resorting to the memfd_create tricks described above.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@Smattr