Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am going to make an online judge platform.

I have looked for some online judge platforms on the Internet for reference (I mean the platforms which have the source code available, and can be hosted my others, not something like Codeforces). Most of them have a web interface written in PHP (or something else).

When users submit the solutions of the problems, the submissions are sent to another programs (a server side program written in C++, Java or something else), which is hosted on or not on the same server, through socket.

What is the benefit of this design? Why not doing so through PHP, with functions like exec()? Which design will you appreciate more?

share|improve this question
    
this post is rather hard to read (wall of text). Would you mind editing it into a better shape? –  gnat Jun 21 '13 at 9:26
    
@gnat Sorry for my bad writing skill, but I don't know how to make it better. –  qpalz Jun 21 '13 at 11:44

1 Answer 1

It can be done for security and to detect or prevent cheating. It's called sandboxing.

Your main server likely has a lot of important things on it: your source code, your database, access to email functions, etc. To exec arbitrary code from an untrusted user on that server is asking for trouble. Even if you sanitized their code (which is a big if, because you can't determine exactly how a program will behave without running it), there may be a PHP bug that they can exploit to take control of the server.

From there they could do anything from downloading the problem answers up to stealing credit card information (if you collect payments), wiping your database, or sending out spam.

If you sandbox and run submissions on another server, you can restrict that server's permissions by turning off modules like curl, mysql, and sendmail. You can limit it to the more basic functions that your users will need for solving coding problems.

share|improve this answer
    
Thanks for your detailed answer. To conclude, using this design is for security reasons. –  qpalz Jun 22 '13 at 11:14
    
But why don't you use chroot to run the users' code? chroot can also work as a sandbox! –  qpalz Jun 22 '13 at 11:17
    
According to Wikipedia, only the root user can run chroot. Your webserver shouldn't be running as root. Wikipedia also mentions that "For a chrooted program to successfully start, the chroot directory must be populated with a minimum set of [configuration files, scratch space, libraries, etc.]. This can make chroot difficult to use as a general sandboxing mechanism." –  Tom Smilack Jun 24 '13 at 0:13
    
There is fakechroot and fakeroot. We can use them with this command fakechroot fakeroot chroot '<dir>' without root permission. But users may break it (for both fakechroot and chroot). It is actually good that library have to be provided separately so that I can control what can be run. –  qpalz Jun 24 '13 at 4:58

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.