langgenius / langgenius/dify-sandbox

Run failed:error:operation not permitted

Open
#222 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
1.3k
Forks
326
Avg merge
56m
Merged PRs (30d)
3

Description

After configuring the ALLOWED_SYSCALLS permission list in the config.yml file, the original available operation permissions are no longer available. Can you keep the original operation permissions and modify the code as follows?
internal/core/lib/python/add_seccomp.go

allowed_syscall := os.Getenv("ALLOWED_SYSCALLS")
if allowed_syscall != "" {
nums := strings.Split(allowed_syscall, ",")
for num := range nums {
syscall, err := strconv.Atoi(nums[num])
if err != nil {
continue
}
allowed_syscalls = append(allowed_syscalls, syscall)
}
}
allowed_syscalls = append(allowed_syscalls, python_syscall.ALLOW_SYSCALLS...)
if enable_network {
allowed_syscalls = append(allowed_syscalls, python_syscall.ALLOW_NETWORK_SYSCALLS...)
}

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with internal/core/lib/python/add_seccomp.go and trace how ALLOWED_SYSCALLS is parsed and combined with the existing Python syscall lists. Verify the behavior with the sandbox's relevant test or execution path. Done means configuring the environment variable preserves the original operation permissions while also accepting the configured syscall values and network permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, python
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.