Skip to content

Better nsjail #53

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
EnderHubris wants to merge 3 commits into
base: develop
Choose a base branch
from
Draft

Better nsjail #53

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
42b8727
Syncing better-nsjail with develop
EnderHubris Jul 28, 2026
14e4a50
Minor adjustments post-integration with in-transit flag handling
EnderHubris Jul 28, 2026
303cfc1
General run-time fixes
EnderHubris Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@ services:
MIN_PORT: ${MIN_PORT}
MAX_PORT: ${MAX_PORT}
BIN_UPLOADS_DIR: /app/ctf
JAIL_CONF_DIR: /app/nsjail_confs
cap_add:
- SYS_ADMIN
security_opt:
Expand Down Expand Up @@ -146,6 +147,8 @@ services:

UPLOADS_DIR: /app/uploads
BIN_UPLOADS_DIR: /app/ctf
JAIL_CONF_DIR: /app/nsjail_confs

CHALLENGE_HOST: ${CHALLENGE_HOST:-ctf.hacksu.com}
FLAG_ENCRYPTION_KEY: ${FLAG_ENCRYPTION_KEY}
TESTING_READ: "C++ is the Best Language, the very best."
Expand Down
3 changes: 2 additions & 1 deletion handler/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,9 +55,10 @@ RUN echo "www-data:99999:1" >> /etc/subuid && \
RUN mkdir -p /jail
RUN mkdir -p /app/ctf
RUN mkdir -p /app/jobs
RUN mkdir -p /app/nsjail_confs

# move node application code and install needed dependencies
COPY ./handler/server.js ./handler/handler.js ./handler/package.json ./handler/bun.lock /app
COPY ./handler/server.js ./handler/handler.js ./handler/utils_h.js ./handler/package.json ./handler/bun.lock /app
RUN bun install --frozen-lockfile

# allow www-data to rw /app and /jail
Expand Down
16 changes: 10 additions & 6 deletions handler/HANDLER.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ of challenges to be hosted compared to being stuck running a single binary.

These configurations are linked to challenge entries following the rule that one challenge gets at most one
configuration reference. These configurations allow easy handling of controlling what files are read-only
mounted in the jail along with configuring the entrypoint executable that is initially propogated via socat.
mounted in the jail along with configuring the entrypoint executable that is initially propogated via nsjail.

## Documentation
These files are written in JSON
Expand All @@ -15,16 +15,20 @@ These files are written in JSON
| `name` | Name of the configuration. |
| `author` | Creator meta-data. |
| `files` | List of files contained in the generated jail. |
| `entrypoint` | Executable initially executed by socat. |
| `entrypoint` | Executable initially executed by nsjail. |

The `files` attribute when parsed will automatically append `entrypoint` within the list if it is not present.
The `files` attribute when parsed will automatically append `entrypoint` within the list if it is not present. For challenge files (excludes natural system files) within the jail, they will always exist at the root of the jail.

### Example Configation
```json
{
"name":"n0Auth",
"author":"g3ne1c",
"files":[],
"entrypoint":"vuln",
"files":[
"/vuln_comp",
"/lib/x86_64-linux-gnu/libc.so.6"
],
"entrypoint":"/vuln",
}
```
```
As you can see the files `vuln` and `vuln_comp` are ctf challenge files, thus exist within the root directory, while natural files like `libc.so.6` use the absolute system path because these files are aquired from the jail host file-system.
Loading