langgenius / langgenius/dify-sandbox
Run failed:error:operation not permitted
- Dominant language
- Go
- Stars
- 1.3k
- Forks
- 326
- Avg merge
- 56m
- Merged PRs (30d)
- 3
Description
After configuring the ALLOWED_SYSCALLS permission list in the config.yml file, the original available operation permissions are no longer available. Can you keep the original operation permissions and modify the code as follows?
internal/core/lib/python/add_seccomp.go
allowed_syscall := os.Getenv("ALLOWED_SYSCALLS")
if allowed_syscall != "" {
nums := strings.Split(allowed_syscall, ",")
for num := range nums {
syscall, err := strconv.Atoi(nums[num])
if err != nil {
continue
}
allowed_syscalls = append(allowed_syscalls, syscall)
}
}
allowed_syscalls = append(allowed_syscalls, python_syscall.ALLOW_SYSCALLS...)
if enable_network {
allowed_syscalls = append(allowed_syscalls, python_syscall.ALLOW_NETWORK_SYSCALLS...)
}
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with internal/core/lib/python/add_seccomp.go and trace how ALLOWED_SYSCALLS is parsed and combined with the existing Python syscall lists. Verify the behavior with the sandbox's relevant test or execution path. Done means configuring the environment variable preserves the original operation permissions while also accepting the configured syscall values and network permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100