From 42f9140c413aba70b62c085f1d1f6b5356a684a0 Mon Sep 17 00:00:00 2001 From: Christopher Goes Date: Tue, 19 Mar 2019 18:48:33 -0600 Subject: Add docstrings --- snekbox.py | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) (limited to 'snekbox.py') diff --git a/snekbox.py b/snekbox.py index 37d7993..5f7b42f 100644 --- a/snekbox.py +++ b/snekbox.py @@ -7,14 +7,16 @@ import sys from rmq import Rmq -class Snekbox(object): +class Snekbox: + """Core snekbox functionality, providing safe execution of Python code.""" + def __init__(self, nsjail_binary='nsjail', python_binary=os.path.dirname(sys.executable)+os.sep+'python3.6'): self.nsjail_binary = nsjail_binary self.python_binary = python_binary - self.nsjail_workaround() + self._nsjail_workaround() env = { 'PATH': ( @@ -27,13 +29,23 @@ class Snekbox(object): 'PYTHONDONTWRITEBYTECODE': '1', } - def nsjail_workaround(self): + def _nsjail_workaround(self): dirs = ['/sys/fs/cgroup/pids/NSJAIL', '/sys/fs/cgroup/memory/NSJAIL'] for d in dirs: if not os.path.exists(d): os.makedirs(d) def python3(self, cmd): + """ + Execute Python 3 code in a isolated environment. + + The value of ``cmd`` is passed using '-c' to a Python + interpreter that is started in a ``nsjail``, isolating it + from the rest of the system. + + Returns the output of executing the command (stdout) if + successful, or a error message if the execution failed. + """ args = [self.nsjail_binary, '-Mo', '--rlimit_as', '700', '--chroot', '/', @@ -87,6 +99,15 @@ class Snekbox(object): return output def execute(self, body): + """ + Handles execution of a raw JSON-formatted RMQ message, contained in ``body``. + + The message metadata, including the Python code to be executed, is + extracted from the message body. The code is then executed in the + isolated environment, and the results of the execution published + to RMQ. Once published, the system exits, since the snekboxes + are created and disposed of per-execution. + """ msg = body.decode('utf-8') result = '' snek_msg = json.loads(msg) @@ -102,6 +123,7 @@ class Snekbox(object): exit(0) def message_handler(self, ch, method, properties, body, thread_ws=None): + """Spawns a daemon process that handles RMQ messages.""" p = multiprocessing.Process(target=self.execute, args=(body,)) p.daemon = True p.start() -- cgit v1.2.3 From 1f49e3edd7a1167eb81438c57dc1dd3789bb0b3b Mon Sep 17 00:00:00 2001 From: Christopher Goes Date: Sun, 24 Mar 2019 17:35:43 -0600 Subject: More formatting fixes --- config.py | 1 + rmq.py | 1 + snekbox.py | 6 ++++-- snekweb.py | 2 ++ 4 files changed, 8 insertions(+), 2 deletions(-) (limited to 'snekbox.py') diff --git a/config.py b/config.py index 5ca23bb..5e4f648 100644 --- a/config.py +++ b/config.py @@ -6,6 +6,7 @@ from docker.errors import NotFound def autodiscover(): """Search for the snekbox container and return its IPv4 address.""" + container_names = ["rmq", "pdrmq", "snekbox_pdrmq_1"] client = docker.from_env() diff --git a/rmq.py b/rmq.py index b4cb90a..919ef19 100644 --- a/rmq.py +++ b/rmq.py @@ -25,6 +25,7 @@ class Rmq: def consume(self, queue=QUEUE, callback=None, thread_ws=None, run_once=False): """Subscribe to read from a RMQ channel.""" + while True: try: connection = pika.BlockingConnection(self.con_params) diff --git a/snekbox.py b/snekbox.py index a5cebde..f8d7c31 100644 --- a/snekbox.py +++ b/snekbox.py @@ -12,8 +12,7 @@ class Snekbox: def __init__(self, nsjail_binary='nsjail', - python_binary=os.path.dirname(sys.executable)+os.sep+'python3.6'): - + python_binary=os.path.dirname(sys.executable) + os.sep + 'python3.6'): self.nsjail_binary = nsjail_binary self.python_binary = python_binary self._nsjail_workaround() @@ -46,6 +45,7 @@ class Snekbox: Returns the output of executing the command (stdout) if successful, or a error message if the execution failed. """ + args = [self.nsjail_binary, '-Mo', '--rlimit_as', '700', '--chroot', '/', @@ -108,6 +108,7 @@ class Snekbox: to RMQ. Once published, the system exits, since the snekboxes are created and disposed of per-execution. """ + msg = body.decode('utf-8') result = '' snek_msg = json.loads(msg) @@ -124,6 +125,7 @@ class Snekbox: def message_handler(self, ch, method, properties, body, thread_ws=None): """Spawns a daemon process that handles RMQ messages.""" + p = multiprocessing.Process(target=self.execute, args=(body,)) p.daemon = True p.start() diff --git a/snekweb.py b/snekweb.py index 3e20fda..ff1a72c 100644 --- a/snekweb.py +++ b/snekweb.py @@ -22,12 +22,14 @@ log = app.logger @app.route('/') def index(): """Root path returns standard index.html.""" + return render_template('index.html') @sockets.route('/ws/') def websocket_route(ws, snekboxid): """Opens a websocket that spawns and connects to a snekbox daemon.""" + localdata = threading.local() localdata.thread_ws = ws -- cgit v1.2.3