edx-platform

Files

Kyle McCormick 758c2b02a1 Pass course-run-specific resource limits to codejail

The limits can be defined in settings.CODE_JAIL['limits_overrides'],
which is a dict mapping context ids (generally, course run keys)
to overrides to be applied to settings.CODE_JAIL['limits'].

This will allow us to temporarily alter the codejail limits
for certain contexts in order to enable, for example,
a certain course run's tasks to run longer while a large exam's
grades are recomputed.

TNL-7649

2020-11-05 11:53:16 -05:00

tests

Pass course-run-specific resource limits to codejail

2020-11-05 11:53:16 -05:00

__init__.py

From code review: the hash was shallow, so nested objects could have hashed differently when they didn't need to.

2013-05-16 13:58:05 -04:00

lazymod.py

Fix Pylint: E1121(too-many-function-args)

2015-03-13 20:20:04 -07:00

README.rst

PLAT-2060 Use pip-tools to manage requirements files (take 2)

2018-04-12 17:22:48 -04:00

safe_exec.py

Pass course-run-specific resource limits to codejail

2020-11-05 11:53:16 -05:00

README.rst

Configuring Capa sandboxed execution
====================================

Capa problems can contain code authored by the course author.  We need to
execute that code in a sandbox.  We use CodeJail as the sandboxing facility,
but it needs to be configured specifically for Capa's use.

As a developer, you don't have to do anything to configure sandboxing if you
don't want to, and everything will operate properly, you just won't have
protection on that code.

If you want to configure sandboxing, you're going to use the `README from
CodeJail`__, with a few customized tweaks.

__ https://github.com/edx/codejail/blob/master/README.rst


1. At the instruction to install packages into the sandboxed code, you'll 
   need to install the requirements from requirements/edx-sandbox::

    $ pip install -r requirements/edx-sandbox/base.txt

2. At the instruction to create the AppArmor profile, you'll need a line in
   the profile for the sandbox packages.  <EDXPLATFORM> is the full path to
   your edx_platform repo::

    <EDXPLATFORM>/common/lib/sandbox-packages/** r,

3. You can configure resource limits in settings.py.  A CODE_JAIL setting is
   available, a dictionary.  The "limits" key lets you adjust the limits for
   CPU time, real time, and memory use.  Setting any of them to zero disables
   that limit::

    # in settings.py...
    CODE_JAIL = {
        # Configurable limits.
        'limits': {
            # How many CPU seconds can jailed code use?
            'CPU': 1,
            # How many real-time seconds will a sandbox survive?
            'REALTIME': 1,
            # How much memory (in bytes) can a sandbox use?
            'VMEM': 30000000,
        },
    }


That's it.  Once you've finished the CodeJail configuration instructions,
your course-hosted Python code should be run securely.