daveagp / java_jail Goto Github PK
View Code? Open in Web Editor NEWchroot java jail, and JSON java trace printer
License: GNU Affero General Public License v3.0
chroot java jail, and JSON java trace printer
License: GNU Affero General Public License v3.0
java_jail: chroot java jail, and JSON java trace printer David Pritchard ([email protected]), created May 2013 This is the backend for a Java version of Philip Guo's Python visualizer. Try it at: http://cscircles.cemc.uwaterloo.ca/java-visualize/ This directory serves 2 purposes: -- . serves as chroot (changed root) for executing Java programs -- ./cp/traceprinter contains a Java program to print traces of Java programs as they execute, printing the results to the same JSON format used by http://pythontutor.com/ See ./cp/traceprinter/README for documentation on that part. The significant code in this directory is the documentation, and the contents of ./cp/traceprinter. Both are released under the GNU Affero General Public License, versions 3 or later. See LICENSE or visit: http://www.gnu.org/licenses/agpl.html This project would not be possible without the package com.sun.tools.example.trace, written by Robert Field. The traceprinter package was initially created from that package. === Setting up a chroot jail for java === The good news is that java for linux is available as a single self-contained archive (we used jdk-7u21-linux-x64.gz). The bad news is that it also uses various shared object files not contained in there, as well as various pseudo-files. So the chroot jail must also contain these. For chroot jail to work, the full contents of this directory should be: ./java/: copy of unzipped java installation ./{etc,lib64}/: necessary libraries ./{dev,proc}/: necessary pseudo-files ./cp/: we use this to hold application-specific java classpath stuff as well as README, LICENSE, and some .git files. Installation steps: (0) It is highly recommended to NOT put this directory anywhere accessible via http, just for sanity's sake. (1) Get java. As of the time of writing, a suitable link for wget is: wget --no-check-certificate --no-cookies --header "Cookie: oraclelicense=accept-securebackup-cookie" http://download.oracle.com/otn-pub/java/jdk/8u20-b26/jdk-8u20-linux-x64.tar.gz (props to http://stackoverflow.com/questions/10268583) Extract java with gunzip and tar -xvf. Rename that jdk1.8.0_20 to "java" (2) You will need to copy some library files into the jail. The simplest thing would be to make a recursive copy of /lib64 into ./lib64, and likewise with /lib and /usr/lib. This way the libraries available in the system are still available after you chroot. HARD MODE: If you want to copy a minimum number of files, a good start is to run "ldd java/bin/java" from within java_jail. See ./lib64/.gitignore for what we needed on our dev machine. (From Sasha Sirotkin: on Ubuntu, those files might instead need to be in lib/x86_64-linux-gnu instead.) strace -f can be useful to disgnose obscure linker problems. (3) copy /etc/ld.so.cache to ./etc (4) mkdir ./proc, then you will need to mount /proc to ./proc -- use EITHER: To mount once (until reboot or "umount /path/to/chroot/proc") sudo mount --bind -o ro,bind /proc /path/to/chroot/proc To mount permanently, add this to /etc/fstab: proc /path/to/chroot/proc proc defaults 0 0 (this is just a modified version of the normal proc mount line.) (5) Mount necessary devices to /dev sudo mknod -m 0666 ./dev/null c 1 3 sudo mknod -m 0666 ./dev/random c 1 8 sudo mknod -m 0444 ./dev/urandom c 1 9 (6) File system permissions. At a basic level, it is enough to allow everything to be read and executed by everyone, and written by nobody. (7) iptables considerations. If you are running arbitrary user code, you probably want to prevent them from accessing the internet. But, the JDI requires access to a local debugging port to communicate between the tracing VM and the traced VM. On our system, all sandboxed executions run with group id 1000, so we have # to allow JDI: -A OUTPUT -p tcp -d 127.0.0.1 --dport 32000:65535 -m owner --gid-owner 1000 -j ACCEPT # to deny everything else: -A OUTPUT -m owner --gid-owner 1000 -j DROP If you want to allow connections to the outgoing world, particularly in Java, you will have to copy /etc/resolv.conf into the etc of the jail. === Testing === Assuming you have CEMC safeexec (https://github.com/cemc/safeexec) installed, here is a way how to test whether things are installed correctly. (0) Go in to ./cp and run "make" there (1) Run this command (from java_jail): ./java/bin/java -cp .:cp:cp/javax.json-1.0.jar:java/lib/tools.jar traceprinter.InMemory < cp/traceprinter/test-input.txt The expected output is at cp/traceprinter/expected-output.txt (2) Try with safeexec (from java_jail): /path/to/safeexec --chroot_dir . --exec_dir / --share_newnet --nproc 50 --mem 3000000 --nfile 30 --env_vars CLASSPATH=/cp/:/cp/javax.json-1.0.jar:/java/lib/tools.jar --exec /java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt Notes from different machines: on at least one machine, nfile and nproc needed to be set to 100. === I found these links useful at some point: http://www.cyberciti.biz/faq/howto-run-nginx-in-a-chroot-jail/ http://interreality.org/~reed/java-chroot.html
(1) Run this command (from java_jail):
./java/bin/java -cp .:cp:cp/javax.json-1.0.jar:java/lib/tools.jar traceprinter.InMemory < cp/traceprinter/test-input.txt
(2) Try with safeexec (from java_jail):
/path/to/safeexec --chroot_dir . --exec_dir / --share_newnet --nproc 50 --mem 3000000 --nfile 30 --env_vars CLASSPATH=/cp/:/cp/javax.json-1.0.jar:/java/lib/tools.jar --exec /java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt
(1) working fine but when i am running safexec i am getting below error. unable to debug it.
error 2 (No such file or directory): execve error
Command exited with non-zero status (1)
elapsed time: 0 seconds
memory usage: 0 kbytes
cpu usage: 0.000 seconds
Hi,
I am using java_jail to install on my linux 64bit machine having cent OS 5.0 version
I used the same procedure which is given in readme file. just not added iptable
entry and It fails in both the cases when
1>run the java class InMemory by given java file as input parameter it gives null pointer exception.I think in run method of the "JSONTracingThread" JVM doesnt starts
2>in compile file given in java_jail/cp/traceprinter it is written that for testing use
following command "java traceprinter.JSONTrace Filename" but on running this it shows exception of class not found JSONTrace.
3>I have used safeexec and followed the same procedure what was given but after run it gives exception of file not found execve error
I did the same thing except one thing of IPTABLES setting.
so I want to ask
is it showing null pointer exception because of blocking of port which JVM is using while running
OR other reason?
thanks
Hi,
I am having an issue with safeexec and java_jail. I'm on CentOS release 5.8 (Final)
When I try this command from java_jail (i.e. without chroot):
/home/ssad1/safeexec/safeexec --share_newnet --nproc 50 --mem 30000000 --nfile 30 --env_vars CLASSPATH=./cp/:./cp/javax.json-1.0.jar:./java/lib/tools.jar --exec ./java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt
Output is:
Exception in thread "event-handler" java.lang.OutOfMemoryError: unable to create new native thread
at java.lang.Thread.start0(Native Method)
at java.lang.Thread.start(Thread.java:714)
at traceprinter.JSONTracingThread.handleEvent(JSONTracingThread.java:221)
at traceprinter.JSONTracingThread.run(JSONTracingThread.java:136)
OK
elapsed time: 2 seconds
memory usage: 5092524 kbytes
cpu usage: 1.585 seconds
When I run this:
/home/ssad1/safeexec/safeexec --chroot_dir . --exec_dir / --share_newnet --nproc 50 --mem 3000000 --nfile 30 --env_vars CLASSPATH=/cp/:/cp/javax.json-1.0.jar:/java/lib/tools.jar --exec /java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt
Output is:
Error occurred during initialization of VM
Could not allocate metaspace: 1073741824 bytes
Command exited with non-zero status (1)
elapsed time: 0 seconds
memory usage: 0 kbytes
cpu usage: 0.000 seconds
When I subsequently increase --mem, here is what i get:
1. 4000000
/home/ssad1/safeexec/safeexec --chroot_dir . --exec_dir / --share_newnet --nproc 50 --mem 4000000 --nfile 30 --env_vars CLASSPATH=/cp/:./cp/javax.json-1.0.jar:/java/lib/tools.jar --exec /java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt
Error occurred during initialization of VM
Could not allocate metaspace: 1073741824 bytes
Command exited with non-zero status (1)
elapsed time: 0 seconds
memory usage: 0 kbytes
cpu usage: 0.004 seconds
2. 5000000
/home/ssad1/safeexec/safeexec --chroot_dir . --exec_dir / --share_newnet --nproc 50 --mem 5000000 --nfile 30 --env_vars CLASSPATH=/cp/:./cp/javax.json-1.0.jar:/java/lib/tools.jar --exec /java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt
#
[thread 139926425515776 also had an error]
Command exited with non-zero status (1)
elapsed time: 1 seconds
memory usage: 4824000 kbytes
cpu usage: 1.353 seconds
3. 6000000
/home/ssad1/safeexec/safeexec --chroot_dir . --exec_dir / --share_newnet --nproc 50 --mem 6000000 --nfile 30 --env_vars CLASSPATH=/cp/:./cp/javax.json-1.0.jar:/java/lib/tools.jar --exec /java/bin/java traceprinter.InMemory < cp/traceprinter/test-input.txt
Exception in thread "event-handler" java.lang.OutOfMemoryError: unable to create new native thread
at java.lang.Thread.start0(Native Method)
at java.lang.Thread.start(Thread.java:714)
at traceprinter.JSONTracingThread.handleEvent(JSONTracingThread.java:221)
at traceprinter.JSONTracingThread.run(JSONTracingThread.java:136)
OK
elapsed time: 2 seconds
memory usage: 5092532 kbytes
cpu usage: 1.482 seconds
Going above 6000000 produces the same result over and over again
Hi,
I followed all the steps on my RHEL 7 64 bit OS to install Java Visualizer, but still it is not working.
safeexec is working properly.
In Java jail when I execute below command ,
./java/bin/java -cp .:cp:cp/javax.json-1.0.jar:java/lib/tools.jar traceprinter.InMemory < cp/traceprinter/test-input.txt
it gives me below output.
{"code":"public class Test { public static void main(String[] args) { int x = 3; x += x; } }","stdin":"","trace":[{"stdout":"","event":"call","line":1,"stack_to_render":[{"func_name":"main:1","encoded_locals":{},"ordered_varnames":[],"parent_frame_id_list":[],"is_highlighted":true,"is_zombie":false,"is_parent":false,"unique_hash":"1","frame_id":1}],"globals":{},"ordered_globals":[],"func_name":"main","heap":{}},{"stdout":"","event":"step_line","line":1,"stack_to_render":[{"func_name":"main:1","encoded_locals":{},"ordered_varnames":[],"parent_frame_id_list":[],"is_highlighted":true,"is_zombie":false,"is_parent":false,"unique_hash":"2","frame_id":2}],"globals":{},"ordered_globals":[],"func_name":"main","heap":{}},{"stdout":"","event":"step_line","line":1,"stack_to_render":[{"func_name":"main:1","encoded_locals":{"x":3},"ordered_varnames":["x"],"parent_frame_id_list":[],"is_highlighted":true,"is_zombie":false,"is_parent":false,"unique_hash":"4","frame_id":4}],"globals":{},"ordered_globals":[],"func_name":"main","heap":{}},{"stdout":"","event":"step_line","line":1,"stack_to_render":[{"func_name":"main:1","encoded_locals":{"x":6},"ordered_varnames":["x"],"parent_frame_id_list":[],"is_highlighted":true,"is_zombie":false,"is_parent":false,"unique_hash":"8","frame_id":8}],"globals":{},"ordered_globals":[],"func_name":"main","heap":{}},{"stdout":"","event":"return","line":1,"stack_to_render":[{"func_name":"main:1","encoded_locals":{"x":6,"return":["VOID"]},"ordered_varnames":["x","return"],"parent_frame_id_list":[],"is_highlighted":true,"is_zombie":false,"is_parent":false,"unique_hash":"9","frame_id":9}],"globals":{},"ordered_globals":[],"func_name":"main","heap":{}}],"userlog":"Debugger VM maxMemory: 3513M\n"}
everything is blank inside {}.
I also tried accessing Java Visualizer by http://localhost/java_visualize. but its not working.
Please help.
Thanks.
I am getting the following error when running the main method from InMemory and inputting the text from test-input.txt.
I notice if I remove the highlighted line, I get output similar to the expected output, but it differs in the that there is an exception message as shown below.
I have tried changing the classpath manually in the program to a few things, but not much changes. I am not very experienced in programming, so this may be a small error I don't see.
While debugging the java program , VMDisconnectedException happening frequently Even before the program getting started to debugged.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.