tidied more

flake.nix

@@ -21,6 +21,7 @@
       umask 022
       mkdir -p dev proc sys tmp usr nix/store root/student root/project root/results
       chmod 777 tmp
+      chmod 700 root
 
       for FILE in $(cat ${closure}/store-paths) ; do
         cp -a "$FILE" nix/store
@@ -78,6 +79,7 @@
     pigeon = pkgs.writeShellApplication {
       name = "pigeon";
       runtimeInputs = with pkgs; [ coreutils curl diffutils e2fsprogs firecracker git jq sqlite ];
+      excludeShellChecks = [ "SC2016" "SC2030" "SC2031" ];
       text = builtins.replaceStrings
         [ "@kernel@" "@rootfs@" "@toolchain@" ] [ "${kernel}" "${rootfs}" "${toolchain}" ]
         (builtins.readFile ./pigeon.sh);

init.sh

@@ -13,27 +13,30 @@ mount -t ext4 /dev/vdd /root/results
 cp -a /root/student/. /tmp/
 cp -a --remove-destination /root/project/build/. /tmp/
 chmod -R 777 /tmp
-cd /tmp || exit 1
+cd /tmp
+rm -f program
 
-sandbox() {
-  LIMIT="$1" ; shift
-  (
-    ulimit -t "$LIMIT" -u 256 -n 256 -f 2048
+(
+  ulimit -t 30 -u 256 -n 256 -f 2048
+  timeout -s 9 30 \
     setpriv --reuid=1 --regid=1 --clear-groups --no-new-privs --inh-caps=-all \
-      timeout -s 9 "$LIMIT" "$@"
-  )
-}
-
-sandbox 30 make >/root/results/build.log 2>&1
-echo $? >/root/results/build.status
+    make -B >/root/results/build.log 2>&1
+  echo $? >/root/results/build.status
+)
 
 for TEST in /root/project/tests/* ; do
-  [ -f "$TEST" ] || continue
   NAME="$(basename "$TEST")"
 
   ARGS="/root/project/args/$NAME"
   [ -f "$ARGS" ] || ARGS=/dev/null
 
-  sandbox 2 "$TEST" <"$ARGS" >"/root/results/$NAME" 2>/dev/null
-  echo $? >"/root/results/$NAME.status"
+  cp -a --remove-destination "$TEST" /tmp/test
+  chmod 755 /tmp/test
+  (
+    ulimit -t 2 -u 256 -n 256 -f 2048
+    timeout -s 9 2 \
+      setpriv --reuid=1 --regid=1 --clear-groups --no-new-privs --inh-caps=-all \
+      /tmp/test <"$ARGS" >"/root/results/$NAME" 2>/dev/null
+    echo $? >"/root/results/$NAME.status"
+  )
 done

pigeon.sh

@@ -61,16 +61,13 @@ for DIR in "$GRADER"/tests/*/ ; do
   EXPECTED="$(cat "$DIR/status.txt" 2>/dev/null || true)"
   case "$EXPECTED" in '' | *[!0-9]*) EXPECTED=0 ;; esac
 
-  ARGS="project/args/$NAME"
-  [ -f "$ARGS" ] || ARGS=/dev/null
-
   if [ -f "$DIR/output.txt" ] ; then
     cat "$DIR/output.txt"
   elif [ -d canonical ] ; then
     (
       export PATH=@toolchain@/bin
       cd canonical && timeout 2 sh "$DIRECTORY/project/tests/$NAME"
-    ) <"$ARGS" 2>/dev/null || true
+    ) <"project/args/$NAME" 2>/dev/null || true
   fi >expected
 
   if cmp -s scratch expected && [ "$EXIT" -eq "$EXPECTED" ] ; then
@@ -135,4 +132,4 @@ curl -s --show-error --out-null --request PUT \
   --header "PRIVATE-TOKEN: ${TOKEN:?}" \
   --header 'Content-Type: application/json' \
   --data "$(jq -n --arg d "$MESSAGE" '{"description": $d}')" \
-  --url "https://gitlab.com/api/v4/projects/$1/releases/$4"
+  --url "https://gitlab.com/api/v4/projects/$1/releases/$(jq -rn --arg t "$4" '$t|@uri')"