WebRunner is a service to execute user-supplied untrusted machine code on your server without compromising its security.

Key features:

• REST API (i.e. you communicate with the service through stateless HTTP requests)
• Built-in loader for ELF object files
• Sandboxing of untrusted code through seccomp-bpf mechanism
• Benchmarking and analyzing the code with hardware event counters.
• Self-check command to support automation of service downtime
• Extendable set of supported kernels

• Linux kernel >= 3.17
• Python 2.7
• Ninja build system (sudo apt-get install ninja-build)
• ninja-syntax module (sudo pip install ninja-syntax)

• systemd (WebRunner includes service configuration only for systemd)
• Ubuntu 15.10 (WebRunner was tested only on this distribution)

• PeachPy (required to run the example)

Configure and compile:

./configure.py
ninja

Recommended: install WebRunner to /usr/sbin/webrunner and register as a systemd service:

sudo ninja install

After installation you can start the service with sudo ninja start and terminate it with sudo ninja stop

Alternative: run WebRunner without installation:

./webrunner # webrunner -h to list options

WebRunner commands must follow the pattern http://server[:port]/machine-id/command[?query]

• machine-id is an arbitrary string. It is parsed, but ignored by the WebRunner.
• command is one of the supported commands (monitor or run).
• query is an optional query string with command parameters.

The monitor command is used to check server status.

• Method: HEAD

• URL: http://server[:port]/machine-id/monitor

A server would respond HTTP status ok 200 (OK) to this command.

curl --head "http://localhost:8081/local/monitor"

The run command is used to benchmark and analyze a function in an ELF object. The ELF object must be sent in the request body.

• Method: POST

• Content-Type: application/octet-stream

• URL: http://server[:port]/machine-id/run?kernel=kernel-name&[param1=value1&param2=value2&...]

The kernel parameter specifies kernel type. Query parameters after it depend on the kernel type and specify parameters of the kernel run. Look at XML specifications in the /src/kernels directory for permitted kernel types and their parameters.

The server would respond with a line of names of hardware performance counters and their values (one per line)

wget --header="Content-Type:application/octet-stream" --post-file=sdot.o \
  "http://localhost:8081/local/run?kernel=sdot&n=10000&incx=1&incy=2"