-
Notifications
You must be signed in to change notification settings - Fork 40
legacy: add testcases #83
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
b9eab68
79025ed
0d42407
ead7813
994dd29
728933b
f10ae7b
3b3f0d8
9c07e6c
6d1dc53
b56a64c
50482f4
7b5115c
064e11b
0ab9f4a
4c91d52
e8450bb
1a6bcd3
61364e0
efd451e
99d1895
ce6d8e8
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,3 +1,77 @@ | ||||||||||
| {% set challenge_image = "pwncollege/challenge-legacy:latest" %} | ||||||||||
| {% set challenge_path = "fundamentals-dojo/talking-web/http-browser" %} | ||||||||||
| {% include "common/Dockerfile.j2" %} | ||||||||||
| # syntax=docker/dockerfile:1 | ||||||||||
|
|
||||||||||
| ARG CHALLENGE_IMAGE="pwncollege/challenge-legacy:latest" | ||||||||||
| FROM "${CHALLENGE_IMAGE}" | ||||||||||
|
|
||||||||||
| # Save the base image's .init if it exists (will be run later) | ||||||||||
| RUN if [ -x /challenge/.init ]; then mv /challenge/.init /challenge/.init.base; fi | ||||||||||
|
|
||||||||||
| # https://github.com/pwncollege/official-dojos | ||||||||||
| WORKDIR /opt/dojos | ||||||||||
|
|
||||||||||
| ADD https://github.com/pwncollege/fundamentals-dojo.git ./fundamentals-dojo | ||||||||||
|
|
||||||||||
| WORKDIR / | ||||||||||
|
|
||||||||||
| COPY --chmod=755 <<'EOF' /challenge/.init | ||||||||||
| #!/bin/bash | ||||||||||
| set -eou pipefail | ||||||||||
|
|
||||||||||
| # Add challenge.localhost to /etc/hosts for Flask server binding | ||||||||||
| echo "127.0.0.1 challenge.localhost" >> /etc/hosts | ||||||||||
|
||||||||||
| echo "127.0.0.1 challenge.localhost" >> /etc/hosts | |
| if ! grep -q '127.0.0.1 challenge.localhost' /etc/hosts 2>/dev/null; then | |
| echo "127.0.0.1 challenge.localhost" >> /etc/hosts | |
| fi |
Copilot
AI
Feb 6, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same symlink-follow issue: find -L will dereference any symlinks placed in /challenge and chmod the targets outside /challenge. Remove -L and limit the chmod to the intended subset (e.g., -type f, optionally only executable files).
| find -L /challenge -exec chmod 4755 {} \; | |
| find /challenge -type f -exec chmod 4755 {} \; |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -1,3 +1,77 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| {% set challenge_image = "pwncollege/challenge-legacy:latest" %} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| {% set challenge_path = "fundamentals-dojo/talking-web/http-comment" %} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| {% include "common/Dockerfile.j2" %} | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # syntax=docker/dockerfile:1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ARG CHALLENGE_IMAGE="pwncollege/challenge-legacy:latest" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| FROM "${CHALLENGE_IMAGE}" | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # Save the base image's .init if it exists (will be run later) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| RUN if [ -x /challenge/.init ]; then mv /challenge/.init /challenge/.init.base; fi | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # https://github.com/pwncollege/official-dojos | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| WORKDIR /opt/dojos | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ADD https://github.com/pwncollege/fundamentals-dojo.git ./fundamentals-dojo | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ADD https://github.com/pwncollege/fundamentals-dojo.git ./fundamentals-dojo | |
| ARG FUNDAMENTALS_DOJO_REF="main" | |
| RUN git clone https://github.com/pwncollege/fundamentals-dojo.git ./fundamentals-dojo \ | |
| && cd ./fundamentals-dojo \ | |
| && git checkout "${FUNDAMENTALS_DOJO_REF}" |
Copilot
AI
Feb 6, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This unconditionally appends to /etc/hosts on every init run, which can lead to duplicated lines across restarts. Mirror the guard used in challenges/legacy/common/Dockerfile.j2 (check with grep -q before appending) to keep the file stable.
| echo "127.0.0.1 challenge.localhost" >> /etc/hosts | |
| grep -q 'challenge\.localhost' /etc/hosts || echo "127.0.0.1 challenge.localhost" >> /etc/hosts |
Copilot
AI
Feb 6, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
find -L follows symlinks; since this init script creates symlinks for large files (ln -sf {} /challenge/), this can chmod the symlink targets outside /challenge (e.g., under /opt/dojos/...) to mode 4755. Drop -L here (don’t follow symlinks) and restrict the chmod to the intended file set (typically regular files, and often only executables).
| find -L /challenge -exec chmod 4755 {} \; | |
| find /challenge -type f -perm -u=x -exec chmod 4755 {} \; |
Copilot
AI
Feb 6, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
These per-challenge Dockerfiles duplicate the shared legacy image logic that already exists in challenges/legacy/common/Dockerfile.j2 (and is being updated in this PR). To avoid divergence and double-maintenance, prefer keeping these as the small Jinja wrappers ({% set challenge_image %}, {% set challenge_path %}, {% include "common/Dockerfile.j2" %}) unless there’s a concrete need for per-challenge deviations.
| # syntax=docker/dockerfile:1 | |
| ARG CHALLENGE_IMAGE="pwncollege/challenge-legacy:latest" | |
| FROM "${CHALLENGE_IMAGE}" | |
| # Save the base image's .init if it exists (will be run later) | |
| RUN if [ -x /challenge/.init ]; then mv /challenge/.init /challenge/.init.base; fi | |
| # https://github.com/pwncollege/official-dojos | |
| WORKDIR /opt/dojos | |
| ADD https://github.com/pwncollege/fundamentals-dojo.git ./fundamentals-dojo | |
| WORKDIR / | |
| COPY --chmod=755 <<'EOF' /challenge/.init | |
| #!/bin/bash | |
| set -eou pipefail | |
| # Add challenge.localhost to /etc/hosts for Flask server binding | |
| echo "127.0.0.1 challenge.localhost" >> /etc/hosts | |
| if [ ! -d "$CHALLENGE_PATH" ]; then | |
| echo "[*] Challenge path $CHALLENGE_PATH does not exist!" | |
| exit 1 | |
| fi | |
| rm -f /challenge/.init | |
| threshold=$((10 * 1024 * 1024)) # 10 MiB | |
| find -L "$CHALLENGE_PATH" \ | |
| -mindepth 1 -maxdepth 1 ! -name '_*' \ | |
| -size -$((threshold + 1))c \ | |
| -exec cp -aL {} /challenge \; | |
| find -L "$CHALLENGE_PATH" \ | |
| -mindepth 1 -maxdepth 1 ! -name '_*' \ | |
| -type f -size +${threshold}c \ | |
| -exec ln -sf {} /challenge/ \; | |
| instance=$(shopt -s nullglob; set -- "$CHALLENGE_PATH"/_*/; printf '%s' "${1:-}") | |
| if [ -n "$instance" ]; then | |
| cp -aL "$instance"/. /challenge | |
| fi | |
| chown -R 0:0 /challenge | |
| find -L /challenge -exec chmod 4755 {} \; | |
| # Some legacy challenges expect this to exist (e.g. legacy/linux-luminarium/processes/ps) | |
| mkdir -p /run/dojo/var/root | |
| echo "Legacy challenge unpacked." > /run/dojo/var/root/init.log | |
| # Create a user for uid 1000 (used by test runner) | |
| if ! getent passwd 1000 >/dev/null 2>&1; then | |
| echo "hacker:x:1000:1000::/home/hacker:/bin/bash" >> /etc/passwd | |
| echo "hacker:x:1000:" >> /etc/group | |
| mkdir -p /home/hacker | |
| chown 1000:1000 /home/hacker | |
| fi | |
| # Run the base image's .init if it was saved (e.g., for program-misuse challenges) | |
| # Use set +e because the base .init may try to rm files that don't exist | |
| if [ -x /challenge/.init.base ]; then | |
| set +e | |
| /challenge/.init.base | |
| set -e | |
| fi | |
| # Run the challenge-specific .init if one was copied from the dojo | |
| if [ -x /challenge/.init ]; then | |
| exec /challenge/.init | |
| fi | |
| EOF | |
| ARG CHALLENGE_PATH="/opt/dojos/fundamentals-dojo/talking-web/http-comment" | |
| ENV CHALLENGE_PATH="${CHALLENGE_PATH}" | |
| {% set challenge_image = "pwncollege/challenge-legacy:latest" %} | |
| {% set challenge_path = "/opt/dojos/fundamentals-dojo/talking-web/http-comment" %} | |
| {% include "common/Dockerfile.j2" %} |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| privileged: true |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same issue as the http-comment Dockerfile: building from an unpinned remote Git HEAD is non-deterministic and increases supply-chain risk. Pin to a specific commit/ref (ideally via build arg) or vendor the required challenge assets.