test(rsjudge-runner): ✅ add exploit code to verify robustness

.vscode/settings.json

@@ -5,7 +5,8 @@
     "xtask",
     "actions",
     "rsjudge-rest",
-    "rsjudge-judger"
+    "rsjudge-judger",
+    "rsjudge-runner"
   ],
   "editor.defaultFormatter": "dprint.dprint",
   "[dockerfile]": {

crates/rsjudge-runner/Cargo.toml

@@ -9,6 +9,7 @@ description = "Command runner for rsjudge"
 
 [dependencies]
 anyhow = "1.0.79"
+caps = "0.5.5"
 nix = { version = "0.28.0", features = ["user"] }
 once_cell = "1.19.0"
 uzers = "0.11.3"

crates/rsjudge-runner/examples/exploit.rs

@@ -0,0 +1,31 @@
+use std::{path::PathBuf, process::Command};
+
+use caps::{read, CapSet};
+use rsjudge_runner::{user::builder, RunAs};
+
+fn main() -> anyhow::Result<()> {
+    dbg!(read(None, CapSet::Ambient).unwrap());
+    dbg!(read(None, CapSet::Effective).unwrap());
+    dbg!(read(None, CapSet::Inheritable).unwrap());
+    dbg!(read(None, CapSet::Permitted).unwrap());
+    let examples = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .and_then(|p| p.parent())
+        .ok_or_else(|| anyhow::anyhow!("cannot find crate root"))?
+        .join("target/debug/examples");
+
+    let exploit_inner = examples.join("exploit-inner");
+
+    let status = Command::new(exploit_inner).run_as(builder()?).output()?;
+    assert!(status.status.success());
+    println!("{}", String::from_utf8_lossy(&status.stdout));
+    println!("{}", String::from_utf8_lossy(&status.stderr));
+
+    let normal = examples.join("normal");
+    let status = Command::new(normal).run_as(builder()?).output()?;
+    assert!(status.status.success());
+    println!("{}", String::from_utf8_lossy(&status.stdout));
+    println!("{}", String::from_utf8_lossy(&status.stderr));
+
+    Ok(())
+}

crates/rsjudge-runner/examples/exploit_inner.rs

@@ -0,0 +1,14 @@
+use caps::{read, CapSet};
+use nix::unistd::{setuid, Uid};
+
+fn main() {
+    dbg!(read(None, CapSet::Ambient).unwrap());
+    dbg!(read(None, CapSet::Effective).unwrap());
+    dbg!(read(None, CapSet::Inheritable).unwrap());
+    dbg!(read(None, CapSet::Permitted).unwrap());
+    eprintln!("Starting setuid syscall.");
+    let result = setuid(Uid::from_raw(0)).expect_err("Should fail to set UID");
+    dbg!(result.desc());
+    dbg!(read(None, CapSet::Permitted).unwrap());
+    eprintln!("Failed calling setuid, test pass.");
+}

crates/rsjudge-runner/examples/normal.rs

@@ -0,0 +1,9 @@
+use caps::{read, CapSet};
+
+fn main() {
+    dbg!(read(None, CapSet::Ambient).unwrap());
+    dbg!(read(None, CapSet::Effective).unwrap());
+    dbg!(read(None, CapSet::Inheritable).unwrap());
+    dbg!(read(None, CapSet::Permitted).unwrap());
+    println!("Hello, world!");
+}