general/occlum
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Remove fish and busybox binaries from entrypoints to make it more secure

Browse Source
This commit is contained in:
Hui, Chunyang 2020-06-17 05:28:36 +00:00
parent 92207d5535
commit 6ccd30ee3b
3 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
demos/fish/README.md
View File

@ -21,6 +21,13 @@ inside Occlum. `echo`, `awk`, `cat` here are actually symbolic files linked to b
to write `busybox` prefix. The `command` keyword tells FISH that `echo` is an external command because FISH also provides to write `busybox` prefix. The `command` keyword tells FISH that `echo` is an external command because FISH also provides
builtin `echo` command. builtin `echo` command.
The script can be executed by Occlum directly as shown below:
```
occlum run /bin/fish_script.sh
```
As demonstrated here, Occlum supports executing any script file that begins with a [shebang](https://en.wikipedia.org/wiki/Shebang_(Unix))
at its first line by invoking the interpreter program specified with the shebang.
## Step 1: ## Step 1:
Downlaod FISH and busybox and build them with Occlum tool chain: Downlaod FISH and busybox and build them with Occlum tool chain:
``` ```

2
demos/fish/fish_script.sh
View File

@ -1,3 +1,3 @@
#! /bin/fish #! /usr/bin/fish
command echo "Hello-world-from-fish" | awk '$1=$1' FS="-" OFS=" " > /root/output.txt command echo "Hello-world-from-fish" | awk '$1=$1' FS="-" OFS=" " > /root/output.txt
cat /root/output.txt cat /root/output.txt

15
demos/fish/run_fish_test.sh
View File

@ -4,16 +4,17 @@ set -e
rm -rf occlum-context rm -rf occlum-context
mkdir occlum-context && cd occlum-context mkdir occlum-context && cd occlum-context
occlum init occlum init
mkdir -p image/usr/bin
cp ../Occlum.json . cp ../Occlum.json .
cp ../fish-shell/build/fish image/bin cp ../fish-shell/build/fish image/usr/bin
cp ../busybox/busybox image/bin cp ../busybox/busybox image/usr/bin
cp ../fish_script.sh image cp ../fish_script.sh image/bin
pushd image/bin pushd image/bin
ln -s /bin/busybox cat ln -s /usr/bin/busybox cat
ln -s /bin/busybox echo ln -s /usr/bin/busybox echo
ln -s /bin/busybox awk ln -s /usr/bin/busybox awk
popd popd
occlum build occlum build
echo -e "\nBuild done. Running fish script ..." echo -e "\nBuild done. Running fish script ..."
occlum run /bin/fish /fish_script.sh occlum run /bin/fish_script.sh