返回题库

seccomp 沙箱

Seccomp Sandbox

专题
Systems & Architecture / 系统与架构
难度
L3
来源
MyntBit

题目详情

高频交易系统常采用进程沙箱化降低失控算法执行未授权系统操作（如打开网络连接或访问敏感文件）的风险。Seccomp-BPF 允许在内核层限制进程可用的系统调用。

任务：实现 SeccompSandbox 类，使用 seccomp() 设置严格模式。定义允许的系统调用白名单（read、write、epoll_wait、clock_gettime 等），拒绝所有其他调用。违规调用导致进程被 SIGKILL 终止。

英文原题

High-frequency trading systems often employ process sandboxing to mitigate the risk of rogue algorithms executing unauthorized system operations, such as opening network connections or accessing sensitive files. Seccomp-BPF (Secure Computing with Berkeley Packet Filter) provides a mechanism to strictly filter system calls at the kernel level, ensuring strategies operate within a defined safety perimeter.
Task
Implement the StrategySandbox class with a method enforce() that installs a Seccomp-BP

解析

问题分析

seccomp（安全计算模式）限制进程可执行的系统调用。交易策略沙箱中，可限制策略代码只能进行数学计算，禁止文件 I/O、网络和 fork——防止恶意策略影响系统。

实现

#include <seccomp.h>
void enableStrategySandbox() {
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);  // 默认禁止
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
                     SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO));
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_load(ctx);
    seccomp_release(ctx);
}

复杂度与边界

  • 时间复杂度：load O(规则数)，后续每次系统调用 O(1) BPF 检查
  • 空间复杂度：O(规则数)
  • 边界条件：(1) 规则必须在任何不可信代码执行前加载 (2) SCMP_ACT_KILL 直接终止进程 (3) libseccomp 需要在目标环境安装

英文解析

Analysis

seccomp (Secure Computing Mode) restricts the system calls a process can execute. In strategy sandboxes, strategy code can be limited to math computation only, forbidding file I/O, networking, and fork - preventing malicious strategies from affecting the system.

Solution

#include <seccomp.h>
void enableStrategySandbox() {
    scmp_filter_ctx ctx = seccomp_init(SCMP_ACT_KILL);  // Default: deny all
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 1,
                     SCMP_A0(SCMP_CMP_EQ, STDOUT_FILENO));
    seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
    seccomp_load(ctx);
    seccomp_release(ctx);
}

Complexity & Edge Cases

  • Time complexity: load O(rule count), subsequent syscalls O(1) BPF check
  • Space complexity: O(rule count)
  • Edge cases: (1) Rules must be loaded before any untrusted code executes (2) SCMP_ACT_KILL terminates process immediately (3) libseccomp must be installed on target environment

Verification

Load seccomp sandbox, verify allowed syscalls work. Test that forbidden syscalls (open, socket, fork) trigger process kill. Confirm sandbox cannot escape via allowed syscall loopholes.

Key Considerations

seccomp provides kernel-level sandboxing that cannot be bypassed by user-space code. In multi-strategy trading platforms, each strategy runs in a seccomp-restricted process - even if a strategy contains malicious code, it cannot open network connections, read files, or spawn processes. This is the strongest isolation available on Linux without virtualization.