-
Notifications
You must be signed in to change notification settings - Fork 79
Description
If codejail is not configured with a user to run commands as, jailed code execution will fail. Effectively, this makes the user config option mandatory rather than optional.
This probably hasn't come up much because most users would configure it with a user. One possibility is to just make the option mandatory.
Details:
jail_code.py builds up a list to pass to subprocess.Popen. This is run as a command with arguments, rather than a shell command string. However, one of the arguments is 'TMPDIR=tmp', a construction to set an environment variable for a process in Bash. TMPDIR=tmp python ... works fine in Bash, but subprocess.Popen(['TMPDIR=tmp', 'python', ...]) does not work because TMPDIR=tmp is not a valid executable.
The reason it works with a user configured is that the command array will then first be prefixed with ['sudo', '-u', user]. The sudo command interprets the remainder of its arguments as a shell string rather than a command and arguments.