feat : dynamically set system calls

internal/core/runner/python/python.go

@@ -5,6 +5,7 @@ import (
 	_ "embed"
 	"fmt"
 	"io"
+	"log/slog"
 	"os"
 	"os/exec"
 	"path"
@@ -85,6 +86,28 @@ func (p *PythonRunner) Run(
 		}
 	}
 
+	if configuration.AllowedSyscallFilePath != "" {
+		if _, err := os.Stat(configuration.AllowedSyscallFilePath); err == nil {
+			content, _ := os.ReadFile(configuration.AllowedSyscallFilePath)
+
+			parts := strings.Split(strings.TrimSpace(string(content)), ",")
+			var numbers []int
+			for _, part := range parts {
+				if part == "" {
+					continue
+				}
+				num, _ := strconv.Atoi(strings.TrimSpace(part))
+				numbers = append(numbers, num)
+			}
+			if len(numbers) > 0 {
+				configuration.AllowedSyscalls = append(configuration.AllowedSyscalls, numbers...)
+				slog.Info("config syscall length", "info", len(configuration.AllowedSyscalls))
+			}
+		} else {
+			slog.Error("file not exists", "err", err, "file path", configuration.AllowedSyscallFilePath)
+		}
+	}
+
 	if len(configuration.AllowedSyscalls) > 0 {
 		cmd.Env = append(cmd.Env,
 			fmt.Sprintf("ALLOWED_SYSCALLS=%s",

internal/types/config.go

@@ -17,10 +17,11 @@ type DifySandboxGlobalConfigurations struct {
 	EnableNetwork            bool     `yaml:"enable_network"`
 	EnablePreload            bool     `yaml:"enable_preload"`
 	AllowedSyscalls          []int    `yaml:"allowed_syscalls"`
+	AllowedSyscallFilePath   string   `yaml:"allowed_syscall_filepath"`
 	LogPath                  string   `yaml:"log_path"`
 	Proxy                    struct {
 		Socks5 string `yaml:"socks5"`
 		Https  string `yaml:"https"`
 		Http   string `yaml:"http"`
 	} `yaml:"proxy"`
-}
+}