如何安全地执行C代码

Question

In this scenario the user will submit his/her C code to my server through a browser. The code will then be compiled and executed on my server and the output will be sent to the user.

Since the user can submit any code (including Viruses, or other malfunctioning code). I will have to take care of that.

So my question is, how can I secure my server from such code?

Answer 1

I cannot answer you for windows -- I can tell you for linux.

This is an extremly complex problem. You need to think to:

• quota limit
• process that compiles/executes the code to be runned as an unprivileged user.
• do not allow the process to run more than N seconds
• do not allow process to allocate too much memory

I can say that this is a long-term project that you can not finish correctly in a few weeks.

Answer 2

Your question is perhaps equivalent to the halting problem , and probably has no bullet proof answer (think of asm in malicious C code, forged function pointers, computed goto, buffer overflow trashing the return address, dlsym & dlopen , etc.).

As mentioned by Shawn in his comment (referring to this question ), you could use sand-boxing techniques. Alinsoar's answer shows you the complexity of the issue.

Answer 3

Other problem to think to : what rights to allow the guest process: is he allowed to open a socket ? If so , what traffic do you allow him ?

In the case you open a socket, then the problem becomes even more complex, because he can deliver an attack over that socket...

Answer 4

您可能会考虑使用ideone API ，某些移动设备软件会这样做（ 例如CodeToGo ）