Graph/af601622-e1a4-4b8e-adc0-db5deb6d321d

Domainunvalidated

Process Isolation

af601622-e1a4-4b8e-adc0-db5deb6d321d

Process Isolation

Node Details

Public graph metadata

Updated4/30/2026

PageRank0.0002

Effectiveness0.000

Connections

30 linked nodes

PERTAIN_TOProblem

Memory usage remained high even after deletion. — FastAPI service that fetches data from Trino, processes it using PyArrow and Polars, and uploads the result to AWS S3 in Parquet format. Tension: We've tried: Using del to delete large objects Deleted PyArrow tables and Polars DataFrames after upload.

PERTAIN_TOSolution

use subprocess for each requests — each time a the subprocess exists memory will be released by the os. Tension: once the subprocess exist memory will be released. Outcome: Launch subprocess.

PERTAIN_TOProblem

as soon as RAM utilisation hits ~4-5GB, the child process dies — If I run the fastapi server with workers ( `fastapi start src/api.py --port 3000 --workers 2` ). Tension: The machine has 8 cores and 64GB of RAM. Outcome: The behavior is consistent irrespective of the number of workers ( workers > 1 ).

PERTAIN_TOProblem

old model is currently being replaced by a newer one

PERTAIN_TOSolution

Check the shared model iteration in the model-runner method before using the model

PERTAIN_TOSolution

Use multiprocessing.Manager objects to share update state with ProcessPool workers

PERTAIN_TOProblem

an attacker has the possibility to launch 2 thread that will update `var` at the same time — This is a result of the design of the virtual platform/environment being used. Tension: both threads would read the value of `var` at the same time and set it to the same decreased value. Outcome: the payment would be indeed sent twice.

PERTAIN_TOSolution

you have such an id that is called transaction id. Tension: If none of that is available either. Outcome: you can create a (sort of) mutex variable (let's call it `lock`).

PERTAIN_TOSolution

In general this calls for a mutex. — If the language does not provide mutexes out of the box. Outcome: you can create a mutex.

PERTAIN_TORootCause

my own testing code runs in the same program as the student code. Outcome: A general-purpose multiuser operating system segregates the memory of different processes.

PERTAIN_TOProblem

Outcome: The established method to prevent improper memory access is to use processes.

PERTAIN_TOSolution

The established method to prevent improper memory access is to use processes. — The student code being tested should be compiled and linked into its own program. Outcome: The testing program would execute the subject code, feed it whatever input is desired, and examine its output.

PERTAIN_TOProblem

is it possible to forbid (via gcc/any other compiler options, valgrind-like tool or anything else you can think of) the function `foo_written_by_student` to do illegal memory access — in a code like this. Tension: to recover a variable `token`.

PERTAIN_TOSolution

it is possible, if you will run the suspicious application on a virtual machine — for the described attack. Tension: you would be able to notice all kinds of issues. Outcome: QEMU - an existing open source virtual machine.

PERTAIN_TOProblem

the students are still able to guess the correct file descriptor of stdout and write to it. Tension: this is not secure as a student can do `int student_function(int foo) { printf("OK"); exit(1) }` and pass all tests. Outcome: would it make sense to fork the process, and use some magic based on seccomp etc?

PERTAIN_TOSolution

Run the student code in a restricted environment while the verification code runs in a separate un-restricted environment. Tension: there's no trust boundary between the student's function and the verification code. Outcome: Untrusted or unreliable code runs in a separate process with limited access.

PERTAIN_TOProblem

`load` is still available. — if I set `os` and `io` to `nil` before running the script. Tension: This will allow loading malicious bytecode. Outcome: Likewise, the `debug` library is still available as an attack vector too.

PERTAIN_TOProblem

Even if you think 'Than i set `package` to `nil`' — In Lua. Tension: will work. Outcome: require("os").execute('echo "Oups - Didnt mentioned that"').

PERTAIN_TOSolution

In Lua all unwanted References (especially in `package.loaded`) should be set to `nil` — If you only set a "pointer" to nil this will still be possible... Outcome: then it is ready for: `collectgarbage()`.

PERTAIN_TOProblem

it fails with `0x5 (Access denied)` — attempting to call `SetTokenInformation` on a duplicate primary token of the current process. Tension: I'm trying to create a child process with no privileges. Then I want to adjust the integrity level of the token to low. Outcome: the RID you are really looking for is SECURITY_MANDATORY_LOW_RID.

PERTAIN_TOSolution

if (AllocateAndInitializeSid(&SIDAuth, 1, SECURITY_MANDATORY_LOW_RID, 0, 0, 0, 0, 0, 0, 0, &tml.Label.Sid)). Tension: SetTokenInformation failed, %u\n. Outcome: if (!SetTokenInformation(hPrimTok, TokenIntegrityLevel, &tml, sizeof(tml))).

PERTAIN_TOSolution

What’s the correct way to bundle JavaFX dependencies into an executable `.jar` (or `.exe`) file — so that it runs on any system without requiring external JavaFX setup. Tension: the `.jar` fails to run independently. Outcome: Used IntelliJ’s “Build Artifacts → JAR → From modules with dependencies”.

PERTAIN_TOSolution

add a conditional breakpoint on a few jdk classes that can create tmp files — If you are capable of a debugging session. Tension: you need to edit the webserver launcher script. Outcome: instrument those call sites; write a pure java agent to load on the java.exe command line.

PERTAIN_TOProblem

after I use jpackage to make an .exe file I can launch more than one instances of the app at a time — when I try to launch two instances af the jar file from the command line.

PERTAIN_TOSolution

The proper way to do this is to create a file in a known, stable location — There are a few different ways to let other attempts to open the program instead message the currently running instance. Outcome: One of the simplest is a local socket.

PERTAIN_TOProblem

I want to write unit tests for each stage of `processData()` independently, rather than testing the entire pipeline as one monolithic function. — using `std::variant` and `std::visit`. Tension: `processData()` is the common interface required for polymorphic behavior. Outcome: It is possible, naive approach would be to just define additional public methods.

PERTAIN_TOSolution

naive approach would be to just define additional public methods — write unit tests for each stage of `processData()` independently. Tension: the common interface required for polymorphic behavior. Outcome: Another way could be a classic dependency injection of your "stages" operations.

PERTAIN_TOProblem

this does not happen — whenever the tracee creates a new thread. Tension: I must also follow all threads created by the traced program.

PERTAIN_TOSolution

To get the effect you want. Tension: you're not resuming the parent before you wait for the child!

IMPLEMENTATION_OFComponent

qemu

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Process Isolation - inErrata Knowledge Graph | Inerrata