diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9cbe03a1..a2c99a7b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,26 +12,25 @@ jobs: strategy: fail-fast: false matrix: + python_version: ['3.11', '3.12'] + ubuntu_version: ['20.04','22.04','24.04'] include: - - python_version: '3.11' - ubuntu_version: '20.04' + - ubuntu_version: '20.04' os: "ubuntu-20.04" - - python_version: '3.11' - ubuntu_version: '22.04' + - ubuntu_version: '22.04' os: "ubuntu-22.04" - - python_version: '3.11' - ubuntu_version: '24.04' + - ubuntu_version: '24.04' os: "ubuntu-24.04" steps: - uses: actions/checkout@v4 - name: Parse custom apparmor profile with default feature ABI if: ${{ matrix.ubuntu_version == '20.04' }} - run: sudo apparmor_parser -r -W apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-default-abi + run: sudo apparmor_parser -r -W apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-default-abi - name: Parse custom apparmor profile with ABI 3.0 if: ${{ matrix.ubuntu_version != '20.04' }} - run: sudo apparmor_parser -r -W apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-abi3 + run: sudo apparmor_parser -r -W apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-abi3 - name: Build latest code changes into CI image run: | diff --git a/Dockerfile b/Dockerfile index 08fca2be..3df3cc93 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,21 +10,27 @@ ENV TZ=Etc/UTC ENV DEBIAN_FRONTEND=noninteractive RUN apt-get update && apt-get install -y software-properties-common RUN add-apt-repository -y ppa:deadsnakes/ppa && apt-get update && apt-get upgrade -y -RUN apt-get install -y vim python${python_version} python${python_version}-dev python${python_version}-distutils -RUN apt-get install -y sudo git make curl build-essential -RUN curl -sS https://bootstrap.pypa.io/get-pip.py | python${python_version} -RUN pip install virtualenv +RUN apt-get install -y \ + vim \ + python${python_version} \ + python${python_version}-dev \ + python${python_version}-venv \ + sudo \ + git \ + make \ + curl \ + build-essential # Define Environment Variables ENV CODEJAIL_GROUP=sandbox ENV CODEJAIL_SANDBOX_CALLER=ubuntu ENV CODEJAIL_TEST_USER=sandbox -ENV CODEJAIL_TEST_VENV=/home/sandbox/codejail_sandbox-python${python_version} +ENV CODEJAIL_TEST_VENV=/home/sandbox/codejail-sandbox-venv # Create Virtualenv for sandbox user -RUN virtualenv -p python${python_version} --always-copy $CODEJAIL_TEST_VENV +RUN python${python_version} -m venv --copies $CODEJAIL_TEST_VENV -RUN virtualenv -p python${python_version} venv +RUN python${python_version} -m venv venv ENV VIRTUAL_ENV=/venv # Add venv/bin to path @@ -51,6 +57,7 @@ RUN chown -R $CODEJAIL_TEST_USER:$CODEJAIL_GROUP $CODEJAIL_TEST_VENV WORKDIR /codejail # Clone Requirement files +COPY ./requirements/pip.txt /codejail/requirements/pip.txt COPY ./requirements/sandbox.txt /codejail/requirements/sandbox.txt COPY ./requirements/testing.txt /codejail/requirements/testing.txt @@ -58,13 +65,15 @@ COPY ./requirements/testing.txt /codejail/requirements/testing.txt RUN source $CODEJAIL_TEST_VENV/bin/activate && pip install -r /codejail/requirements/sandbox.txt && deactivate # Install testing requirements in parent venv -RUN pip install -r /codejail/requirements/sandbox.txt && pip install -r /codejail/requirements/testing.txt +RUN pip install -r /codejail/requirements/pip.txt && \ + pip install -r /codejail/requirements/sandbox.txt && \ + pip install -r /codejail/requirements/testing.txt # Clone Codejail Repo COPY . /codejail # Setup sudoers file -COPY sudoers-file/01-sandbox-python-${python_version} /etc/sudoers.d/01-sandbox +COPY sudoers-file/01-sandbox-python /etc/sudoers.d/01-sandbox # Change Sudoers file permissions RUN chmod 0440 /etc/sudoers.d/01-sandbox diff --git a/Makefile b/Makefile index ef5e78d0..3af129f9 100644 --- a/Makefile +++ b/Makefile @@ -47,5 +47,7 @@ isort: ## apply automatic import sorting requirements: dev-requirements dev-requirements: + pip install -q -r requirements/pip.txt + pip install -q -r requirements/pip_tools.txt pip install -r requirements/sandbox.txt pip install -r requirements/development.txt diff --git a/apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-abi3 b/apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-abi3 similarity index 94% rename from apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-abi3 rename to apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-abi3 index 3183954a..8299f723 100644 --- a/apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-abi3 +++ b/apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-abi3 @@ -1,6 +1,6 @@ abi , #include -profile apparmor_profile /home/sandbox/codejail_sandbox-python{3.[0-9],3.[1-9][0-9]}/bin/python { +profile apparmor_profile /home/sandbox/codejail-sandbox-venv/bin/python { #include #include @@ -42,7 +42,7 @@ profile apparmor_profile /home/sandbox/codejail_sandbox-python{3.[0-9],3.[1-9][0 # Include additions to the abstraction include if exists - /home/sandbox/codejail_sandbox-python{3.[0-9],3.[1-9][0-9]}/** mr, + /home/sandbox/codejail-sandbox-venv/** mr, /tmp/codejail-*/ rix, /tmp/codejail-*/** wrix, diff --git a/apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-default-abi b/apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-default-abi similarity index 94% rename from apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-default-abi rename to apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-default-abi index 5ac108b1..560d4732 100644 --- a/apparmor-profiles/home.sandbox.codejail_sandbox-python3.bin.python-default-abi +++ b/apparmor-profiles/home.sandbox.codejail-sandbox-venv.bin.python-default-abi @@ -1,5 +1,5 @@ #include -profile apparmor_profile /home/sandbox/codejail_sandbox-python{3.[0-9],3.[1-9][0-9]}/bin/python { +profile apparmor_profile /home/sandbox/codejail-sandbox-venv/bin/python { #include #include @@ -41,7 +41,7 @@ profile apparmor_profile /home/sandbox/codejail_sandbox-python{3.[0-9],3.[1-9][0 # Include additions to the abstraction include if exists - /home/sandbox/codejail_sandbox-python{3.[0-9],3.[1-9][0-9]}/** mr, + /home/sandbox/codejail-sandbox-venv/** mr, /tmp/codejail-*/ rix, /tmp/codejail-*/** wrix, diff --git a/sudoers-file/01-sandbox-python-3.11 b/sudoers-file/01-sandbox-python similarity index 50% rename from sudoers-file/01-sandbox-python-3.11 rename to sudoers-file/01-sandbox-python index 46c3cb2a..c3e2112d 100644 --- a/sudoers-file/01-sandbox-python-3.11 +++ b/sudoers-file/01-sandbox-python @@ -1,7 +1,7 @@ -ubuntu ALL=(sandbox) SETENV:NOPASSWD:/home/sandbox/codejail_sandbox-python3.11/bin/python +ubuntu ALL=(sandbox) SETENV:NOPASSWD:/home/sandbox/codejail-sandbox-venv/bin/python ubuntu ALL=(sandbox) SETENV:NOPASSWD:/usr/bin/find ubuntu ALL=(ALL) NOPASSWD:/usr/bin/pkill -Defaults!/home/sandbox/codejail_sandbox-python3.11/bin/python !requiretty +Defaults!/home/sandbox/codejail-sandbox-venv/bin/python !requiretty Defaults!/usr/bin/find !requiretty Defaults!/usr/bin/pkill !requiretty