Better handling of submissions that fail virus scan

Author: jmgasper

README.md

@@ -158,7 +158,7 @@ The ECS task still needs trusted outbound access to fetch challenge config, down
 - The parent launches a separate child JVM through `mm-runner-isolate` with a scrubbed environment, so submission processes do not inherit the bearer token or other runner env vars.
 - Generic submitted solution commands run through `mm-scorer-isolate` as the separate non-root `scorer` user. Downloaded tester JARs and serialized scorer config are kept runner-owned mode `0400`, so submitted code cannot read or modify them from `/tmp`.
 - Standard generic-runner seed execution asks `mm-scorer-isolate` to reset scorer-owned writable state before and after each test case. The cleanup helper only scans fixed writable roots such as `/tmp`, `/var/tmp`, `/dev/shm`, and the scorer home, and only removes entries owned by the scorer UID.
-- Generic submitted solution commands also run under a filesystem allowlist that permits runtime/toolchain reads and scorer temp writes but does not permit reading infrastructure paths such as `/etc/hostname`, `/etc/resolv.conf`, `/proc/self/cgroup`, `/proc/self/mounts`, or proc network tables.
+- Generic submitted solution commands also run under a filesystem allowlist that permits runtime/toolchain reads, `/proc/self/maps` for glibc/Mono stack introspection, and scorer temp writes but does not permit reading infrastructure paths such as `/etc/hostname`, `/etc/resolv.conf`, `/proc/self/cgroup`, `/proc/self/mounts`, or proc network tables.
 - Native wrappers block `io_uring` and creation of non-`AF_UNIX` sockets for submitted solution processes and their fork/exec children, so submissions cannot open live outbound network connections.
 - Standard Topcoder Marathon testers run through the generic runner flow, which creates the callback score payload from trusted runner code. Custom tester `runTester(...)` result maps remain supported for advanced cases.
 

ecs-runner/README.md

@@ -22,7 +22,7 @@ This image is the runtime container for marathon match scoring tasks launched by
 - Generic submitted solution commands execute through the setuid-root `mm-scorer-isolate` bridge as uid/gid `10002` (`scorer`). The bridge drops its supervisor back to the invoking `runner` uid after it forks the solution child, retaining only `CAP_KILL` so tester timeouts can still terminate the lower-privilege solution process group.
 - Downloaded tester JARs are mode `0400` runner-owned files. The serialized scorer config starts as a mode `0400` runner-owned handoff file and the child JVM deletes it immediately after loading it, before tester or submitted solution code executes.
 - Generic Marathon seed execution resets scorer-owned writable state before and after every test case, so files written by one seed are not visible to later seeds in the same submission run. The Java child invokes the setuid `mm-scorer-isolate --cleanup-scorer-state` mode, which scans only fixed writable roots such as `/tmp`, `/var/tmp`, `/dev/shm`, and the scorer home, and removes only entries owned by uid `10002`.
-- Generic submitted solution commands run under a Landlock filesystem allowlist. Runtime and toolchain files are readable, `/tmp` and the scorer home are writable, and infrastructure-revealing paths such as `/etc/hostname`, `/etc/resolv.conf`, `/proc/self/cgroup`, `/proc/self/mounts`, and proc network tables are not readable by submitted code.
+- Generic submitted solution commands run under a Landlock filesystem allowlist. Runtime and toolchain files are readable, `/proc/self/maps` is readable for glibc/Mono stack introspection, `/tmp` and the scorer home are writable, and infrastructure-revealing paths such as `/etc/hostname`, `/etc/resolv.conf`, `/proc/self/cgroup`, `/proc/self/mounts`, and proc network tables are not readable by submitted code.
 - Artifact previews and artifact zip uploads include only non-symlink regular files from the runner artifact directories. Submitted symlinks are ignored instead of being dereferenced by the trusted parent runner.
 - Submitted solution processes and their fork/exec children cannot use `io_uring` and can create only `AF_UNIX` sockets. These restrictions are kernel seccomp filters inherited across fork/exec, so clearing `LD_PRELOAD` in a spawned child process does not restore INET or INET6 socket access. Outbound network access from the submission itself is therefore blocked even though the parent runner still has the trusted egress it needs.
 - The child JVM runs standard Topcoder Marathon testers through the generic runner flow. Custom tester `runTester(...)` result maps remain supported for advanced cases, but standard testers do not need ECS-specific code.

ecs-runner/scripts/mm-net-isolate.c

@@ -647,9 +647,11 @@ static int add_landlock_paths(
 
 /**
  * Restricts submitted solution filesystem access to runtime/toolchain files and
- * scorer-owned writable locations. Infrastructure-revealing files such as
- * /etc/hostname, /etc/resolv.conf, /proc/self/cgroup, /proc/self/mounts, and
- * proc network tables are intentionally omitted from the allowlist.
+ * scorer-owned writable locations. /proc/self/maps is narrowly readable
+ * because glibc pthread_getattr_np opens it while Mono discovers the main
+ * thread stack bounds. Infrastructure-revealing files such as /etc/hostname,
+ * /etc/resolv.conf, /proc/self/cgroup, /proc/self/mounts, and proc network
+ * tables are intentionally omitted from the allowlist.
  */
 static int install_filesystem_filter(void) {
     static const char *const read_execute_paths[] = {
@@ -670,7 +672,8 @@ static int install_filesystem_filter(void) {
         "/etc/passwd",
         "/etc/protocols",
         "/etc/services",
-        "/etc/ssl/certs"
+        "/etc/ssl/certs",
+        "/proc/self/maps"
     };
     static const char *const read_write_paths[] = {
         "/dev/null",

src/api/kafka/marathon-match-submission.handler.spec.ts

@@ -64,12 +64,14 @@ describe('MarathonMatchSubmissionHandler', () => {
   });
 
   it('launches example and provisional scorer tasks when both map to the same open phase', async () => {
-    const { handler, prisma, ecsService } = createHandler();
+    const { handler, prisma, m2mService, httpService, ecsService } =
+      createHandler();
 
     prisma.marathonMatchConfig.findUnique.mockResolvedValue({
       id: 'config-1',
       challengeId: 'challenge-1',
       active: true,
+      submissionApiUrl: 'https://submissions.example.com/v6',
       testerId: 'tester-1',
       taskDefinitionName: 'mm-ecs-runner',
       taskDefinitionVersion: '7',
@@ -106,6 +108,15 @@ describe('MarathonMatchSubmissionHandler', () => {
       phaseIdentifiers: ['submission-phase'],
     });
 
+    m2mService.getM2MToken.mockResolvedValue('m2m-token');
+    httpService.get.mockReturnValue(
+      of({
+        data: {
+          id: 'submission-1',
+          virusScan: true,
+        },
+      }),
+    );
     ecsService.launchScorerTask
       .mockResolvedValueOnce({
         taskArn: 'arn:aws:ecs:task/example',
@@ -254,4 +265,122 @@ describe('MarathonMatchSubmissionHandler', () => {
       }),
     );
   });
+
+  it('marks each matching phase failed without launching when submission has not passed virus scan', async () => {
+    const { handler, prisma, m2mService, httpService, ecsService } =
+      createHandler();
+
+    prisma.marathonMatchConfig.findUnique.mockResolvedValue({
+      id: 'config-1',
+      challengeId: 'challenge-1',
+      active: true,
+      submissionApiUrl: 'https://submissions.example.com/v6',
+      testerId: 'tester-1',
+      reviewScorecardId: 'scorecard-1',
+      taskDefinitionName: 'mm-ecs-runner',
+      taskDefinitionVersion: '7',
+      tester: {
+        compilationStatus: CompilationStatus.SUCCESS,
+      },
+      phaseConfigs: [
+        {
+          id: 'phase-example',
+          configType: 'EXAMPLE',
+          phaseId: 'submission-phase',
+          startSeed: BigInt(1),
+          numberOfTests: 10,
+        },
+        {
+          id: 'phase-provisional',
+          configType: 'PROVISIONAL',
+          phaseId: 'submission-phase',
+          startSeed: BigInt(500),
+          numberOfTests: 20,
+        },
+      ],
+    });
+
+    (handler as any).getOpenPhaseResolution = jest.fn().mockResolvedValue({
+      phaseIds: ['submission-phase'],
+      phaseIdentifiers: ['submission-phase'],
+    });
+    m2mService.getM2MToken.mockResolvedValue('m2m-token');
+    httpService.get
+      .mockReturnValueOnce(
+        of({
+          data: {
+            id: 'submission-1',
+            virusScan: false,
+          },
+        }),
+      )
+      .mockReturnValue(
+        of({
+          data: {
+            data: [],
+          },
+        }),
+      );
+    httpService.post.mockReturnValue(of({ data: { id: 'summation-1' } }));
+
+    await handler.handle({
+      submissionId: 'submission-1',
+      challengeId: 'challenge-1',
+      submissionUrl: 'https://example.com/submission.zip',
+      memberHandle: 'tester',
+      memberId: 'member-1',
+      submittedDate: '2026-03-26T01:27:22.829Z',
+    });
+
+    expect(ecsService.launchScorerTask).not.toHaveBeenCalled();
+    expect(m2mService.getM2MToken).toHaveBeenCalledTimes(1);
+    expect(httpService.post).toHaveBeenCalledTimes(2);
+    expect(httpService.post).toHaveBeenNthCalledWith(
+      1,
+      'https://api.topcoder-dev.com/v6/reviewSummations',
+      expect.objectContaining({
+        aggregateScore: -1,
+        isExample: true,
+        isPassing: false,
+        scorecardId: 'scorecard-1',
+        submissionId: 'submission-1',
+        metadata: expect.objectContaining({
+          challengeId: 'challenge-1',
+          marathonMatchScoringSkipped: true,
+          testProgress: 1,
+          testStatus: 'FAILED',
+          testType: 'example',
+        }),
+      }),
+      expect.objectContaining({
+        headers: {
+          Authorization: 'Bearer m2m-token',
+        },
+      }),
+    );
+    expect(httpService.post).toHaveBeenNthCalledWith(
+      2,
+      'https://api.topcoder-dev.com/v6/reviewSummations',
+      expect.objectContaining({
+        aggregateScore: -1,
+        isPassing: false,
+        isProvisional: true,
+        scorecardId: 'scorecard-1',
+        submissionId: 'submission-1',
+        metadata: expect.objectContaining({
+          challengeId: 'challenge-1',
+          marathonMatchScoringSkipped: true,
+          testProcess: 'provisional',
+          testProgress: 1,
+          testStatus: 'FAILED',
+          testType: 'provisional',
+        }),
+      }),
+      expect.objectContaining({
+        headers: {
+          Authorization: 'Bearer m2m-token',
+        },
+      }),
+    );
+  });
 });