Improve the project structure, update the protocol5.0.5

13 files changed, 406 insertions, 236 deletions

diff --git a/.gitignore b/.gitignore
index cd47243..ea0f573 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,13 @@
+# IDE
+/.project
+/.cproject
+/.vscode/
+/.settings/
+
 # environment
 /.build_env
 
 # binary
 /qalculate-helper
+/target/
+/.debug/
diff --git a/Makefile b/Makefile
index 794f9ed..85e2be4 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,13 @@ include .build_env
 export
 
 NAME='qalculate-helper'
-FLAGS+=-I${QALCULATE_INCLUDE_PATH}
-FLAGS+=-L${QALCULATE_LIBRARY_PATH}
+FLAGS+=-Iinclude/
+ifneq ($(origin QALCULATE_INCLUDE_PATH), undefined)
+        FLAGS+=-I${QALCULATE_INCLUDE_PATH}
+endif
+ifneq ($(origin QALCULATE_LIBRARY_PATH), undefined)
+        FLAGS+=-L${QALCULATE_LIBRARY_PATH}
+endif
 FLAGS+=-Wl,-Bstatic
 FLAGS+=-lqalculate
 FLAGS+=-Wl,-Bdynamic
@@ -24,7 +29,7 @@ FLAGS+=-ansi
 FLAGS+=-O3
 FLAGS+=-D_FORTIFY_SOURCE=2
 FLAGS+=-fPIE
-FLAGS+=-std=c++2a
+FLAGS+=-std=c++17
 FLAGS+=-o $(NAME)
 FLAGS+=-march=native
 ifneq ($(origin SETUID), undefined)
@@ -35,5 +40,5 @@ ifneq ($(origin SECCOMP), undefined)
 endif
 
 all:
-        g++ qalculate-helper.cpp $(FLAGS)
+        g++ src/security_util.cpp src/exchange_update_exception.cpp src/qalculate_exception.cpp src/qalculate-helper.cpp src/timeout_exception.cpp $(FLAGS)
         strip $(NAME)
diff --git a/include/config.h b/include/config.h
new file mode 100644
index 0000000..b624351
--- /dev/null
+++ b/include/config.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#define PRECISION_DEFAULT 20
+#define PRECISION_HIGH 900
+
+#define MIN_DECIMALS 20
+#define TIMEOUT_CALC 2000
+#define TIMEOUT_PRINT 2000
+#define TIMEOUT_UPDATE 30
diff --git a/include/exchange_update_exception.h b/include/exchange_update_exception.h
new file mode 100644
index 0000000..4adab32
--- /dev/null
+++ b/include/exchange_update_exception.h
@@ -0,0 +1,10 @@
+//SPDX-License-Identifier: GPL-3.0
+#pragma once
+
+#include <qalculate_exception.h>
+
+class exchange_update_exception : public qalculate_exception {
+        public:
+                exchange_update_exception();
+};
+
diff --git a/include/qalculate_exception.h b/include/qalculate_exception.h
new file mode 100644
index 0000000..c7e042b
--- /dev/null
+++ b/include/qalculate_exception.h
@@ -0,0 +1,15 @@
+//SPDX-License-Identifier: GPL-3.0
+#pragma once
+
+#include <stdexcept>
+
+class qalculate_exception : public std::runtime_error {
+        protected:
+                int code;
+
+                qalculate_exception(int code);
+
+        public:
+                int getCode() const;
+};
+
diff --git a/include/security_util.h b/include/security_util.h
new file mode 100644
index 0000000..a6b24f1
--- /dev/null
+++ b/include/security_util.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#include <libqalculate/Calculator.h>
+
+void do_setuid();
+
+void do_defang_calculator(Calculator *calc);
+
+void do_seccomp();
diff --git a/include/timeout_exception.h b/include/timeout_exception.h
new file mode 100644
index 0000000..de2d628
--- /dev/null
+++ b/include/timeout_exception.h
@@ -0,0 +1,10 @@
+//SPDX-License-Identifier: GPL-3.0
+#pragma once
+
+#include <qalculate_exception.h>
+
+class timeout_exception : public qalculate_exception {
+        public:
+                timeout_exception();
+};
+
diff --git a/qalculate-helper.cpp b/qalculate-helper.cpp
deleted file mode 100644
index 4437476..0000000
--- a/qalculate-helper.cpp
+++ /dev/null
@@ -1,232 +0,0 @@
-#include <sstream>
-#include <libqalculate/qalculate.h>
-#ifdef UID
-        #include <grp.h>
-        #include <cap-ng.h>
-#else
-        #warning "Not doing setuid/setgid, do not use in production!"
-#endif
-
-#ifdef SECCOMP
-        #include <seccomp.h>
-#else
-        #warning "Not doing seccomp, do not use in production!"
-#endif
-
-#define PRECISION_DEFAULT 20
-#define PRECISION_HIGH 900
-
-#define MIN_DECIMALS 20
-#define TIMEOUT_CALC 2000
-#define TIMEOUT_PRINT 2000
-#define TIMEOUT_UPDATE 30
-
-#define TYPE_MESSAGE putchar(1)
-#define TYPE_RESULT putchar(2)
-
-#define RESULT_APPROXIMATION_NO putchar(1);
-#define RESULT_APPROXIMATION_YES putchar(2);
-
-#define LEVEL_INFO putchar(1)
-#define LEVEL_WARNING putchar(2)
-#define LEVEL_ERROR putchar(3)
-#define LEVEL_UNKNOWN putchar(4)
-#define SEPARATOR putchar(0)
-
-#define COMMAND_UPDATE "update"
-
-#define MODE_HIGH_PRECISION 2
-#define MODE_EXACT 3
-
-#define ENOARG 101;
-#define ETIMEOUT 102;
-#define ECANTFETCH 103;
-
-using std::string;
-using std::stringstream;
-using std::getline;
-using std::atoi;
-
-int evaluate_single(EvaluationOptions *eo, MathStructure *result, int line_number, string expression) {
-        if (!CALCULATOR->calculate(result, CALCULATOR->unlocalizeExpression(expression), TIMEOUT_CALC, *eo))
-                return ETIMEOUT;
-
-        CalculatorMessage* message;
-        while ((message = CALCULATOR->message())) {
-                TYPE_MESSAGE;
-                switch (message->type()) {
-                        case MESSAGE_INFORMATION:
-                                LEVEL_INFO;
-                                break;
-                        case MESSAGE_WARNING:
-                                LEVEL_WARNING;
-                                break;
-                        case MESSAGE_ERROR:
-                                LEVEL_ERROR;
-                                break;
-                        default:
-                                LEVEL_UNKNOWN;
-                                break;
-                }
-                printf("line %d: ", line_number);
-                fputs(message->c_message(), stdout); SEPARATOR;
-                CALCULATOR->nextMessage();
-        }
-        return 0;
-}
-
-int evaluate(char *expression, char *mode, char *base) {
-        CALCULATOR->setExchangeRatesWarningEnabled(false);
-        CALCULATOR->loadExchangeRates();
-        CALCULATOR->loadGlobalDefinitions();
-
-        CALCULATOR->getActiveFunction("command")->destroy(); // rce
-#ifdef HAS_PLOT
-        CALCULATOR->getActiveFunction("plot")->destroy(); // no use
-#endif
-        CALCULATOR->getActiveVariable("uptime")->destroy(); // why would you
-
-        PrintOptions po;
-
-        po.base = atoi(base);
-
-        po.number_fraction_format = FRACTION_DECIMAL;
-        po.interval_display = INTERVAL_DISPLAY_PLUSMINUS;
-        po.use_unicode_signs = true;
-        //po.min_decimals = MIN_DECIMALS;
-        po.time_zone = TIME_ZONE_UTC;
-        po.abbreviate_names = true;
-        po.show_ending_zeroes = false;
-        //po.preserve_precision = true;
-        //po.restrict_to_parent_precision = false;
-
-        bool approximate = false;
-        po.is_approximate = &approximate;
-        CALCULATOR->setMessagePrintOptions(po);
-
-        EvaluationOptions eo;
-
-        eo.approximation = APPROXIMATION_TRY_EXACT;
-        eo.parse_options.unknowns_enabled = false;
-        eo.sync_units = false;
-
-#ifdef SECCOMP
-        scmp_filter_ctx ctx;
-        ctx = seccomp_init(SCMP_ACT_KILL);
-    /*   0 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
-    /*   1 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
-    /*   9 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
-    /*  10 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 0);
-    /*  11 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(munmap), 0);
-    /*  13 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 0);
-    /*  14 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 0);
-    /*  24 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sched_yield), 0);
-    /* 230 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clock_nanosleep), 0);
-    /* 231 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
-    /* 262 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat), 0);
-    /* 273 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(set_robust_list), 0);
-    /* 334 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rseq), 0);
-    /* 435 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clone3), 0);
-        int err = seccomp_load(ctx);
-        if (err) {
-                printf("couldn't seccomp: %d\n", err);
-                abort();
-        }
-#endif
-
-        int precision = PRECISION_DEFAULT;
-        switch (atoi(mode)) {
-                case MODE_EXACT:
-                        eo.approximation = APPROXIMATION_EXACT;
-                        po.number_fraction_format = FRACTION_DECIMAL_EXACT;
-                        break;
-
-                case MODE_HIGH_PRECISION:
-                        precision = PRECISION_HIGH;
-                        po.indicate_infinite_series = false;
-                        break;
-        }
-
-        CALCULATOR->setPrecision(precision);
-
-        MathStructure result;
-    stringstream expressions(expression);
-    string single_expression;
-    int line_number = 1;
-    int return_value;
-    while (getline(expressions, single_expression, '\n')) {
-        if ((return_value = evaluate_single(&eo, &result, line_number, single_expression)))
-                return return_value;
-        line_number++;
-    }
-
-        string string_result = CALCULATOR->print(result, TIMEOUT_PRINT, po, false, 1, TAG_TYPE_TERMINAL);
-
-        if (string_result.ends_with(CALCULATOR->timedOutString())) {
-                return ETIMEOUT;
-
-        } else {
-                TYPE_RESULT;
-                if (approximate) {
-                        RESULT_APPROXIMATION_YES;
-                } else {
-                        RESULT_APPROXIMATION_NO;
-                }
-
-                fputs(string_result.c_str(), stdout);
-        }
-        SEPARATOR;
-        return 0;
-}
-
-int update() {
-        if (!CALCULATOR->canFetch())
-                return ECANTFETCH;
-        CALCULATOR->fetchExchangeRates(TIMEOUT_UPDATE);
-        // for some reason this returns false even when it's successful so I'm not going to check it
-        return 0;
-}
-
-int main(int argc, char** argv) {
-#ifdef UID
-        if (setgroups(0, {})) {
-                perror("couldn't remove groups");
-                abort();
-        }
-
-        if (setresgid(UID, UID, UID)) {
-                perror("couldn't set gid");
-                abort();
-        }
-
-        if (setresuid(UID, UID, UID)) {
-                perror("couldn't set uid");
-                abort();
-        }
-
-        capng_clear(CAPNG_SELECT_BOTH);
-        if (capng_update(CAPNG_DROP, (capng_type_t)(CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SETGID)) {
-                printf("couldn't drop caps: can't select\n");
-                abort();
-        }
-        int err = capng_apply(CAPNG_SELECT_BOTH);
-        if (err) {
-                printf("couldn't drop caps: %d\n", err);
-                abort();
-        }
-#endif
-
-        if (argc < 2)
-                return ENOARG;
-
-        new Calculator(true);
-        if (argc == 2) {
-                if (strcmp(argv[1], COMMAND_UPDATE) == 0)
-                        return update();
-                else
-                        return 1;
-        } else {
-                return evaluate(argv[1], argv[2], argv[3]);
-        }
-}
-
diff --git a/src/exchange_update_exception.cpp b/src/exchange_update_exception.cpp
new file mode 100644
index 0000000..125ed21
--- /dev/null
+++ b/src/exchange_update_exception.cpp
@@ -0,0 +1,7 @@
+//SPDX-License-Identifier: GPL-3.0
+
+#include <exchange_update_exception.h>
+
+exchange_update_exception::exchange_update_exception() :
+                qalculate_exception(103) {
+}
diff --git a/src/qalculate-helper.cpp b/src/qalculate-helper.cpp
new file mode 100644
index 0000000..3356fb2
--- /dev/null
+++ b/src/qalculate-helper.cpp
@@ -0,0 +1,228 @@
+//SPDX-License-Identifier: GPL-3.0
+/*
+ * qalculate-helper.cpp
+ * Copyright (C) 2024 Marko Zajc
+ *
+ * This program is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU General Public License as published by the Free Software
+ * Foundation, version 3.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE. See the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along with this
+ * program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <config.h>
+#include <exchange_update_exception.h>
+#include <libqalculate/Calculator.h>
+#include <libqalculate/includes.h>
+#include <libqalculate/MathStructure.h>
+#include <security_util.h>
+#include <timeout_exception.h>
+#include <cstddef>
+#include <cstdio>
+#include <cstdlib>
+#include <cstring>
+#include <sstream>
+#include <string>
+#include <vector>
+
+using std::string;
+using std::stringstream;
+using std::getline;
+using std::vector;
+using std::string_view;
+using std::size_t;
+
+#if __cplusplus >= 201703L
+#include <string_view>
+
+static bool ends_with(string_view str, string_view suffix) {
+        return str.size() >= suffix.size() && str.compare(str.size() - suffix.size(), suffix.size(), suffix) == 0;
+}
+
+#endif
+
+const char TYPE_MESSAGE = 1;
+const char TYPE_RESULT = 2;
+
+const char RESULT_APPROXIMATION_NO = 1;
+const char RESULT_APPROXIMATION_YES = 2;
+
+const char LEVEL_INFO = 1;
+const char LEVEL_WARNING = 2;
+const char LEVEL_ERROR = 3;
+const char LEVEL_UNKNOWN = 4;
+const char SEPARATOR = 0;
+
+#define COMMAND_UPDATE "update"
+
+const unsigned long MODE_PRECISION = 1 << 0;
+const unsigned long MODE_EXACT = 1 << 1;
+const unsigned long MODE_NOCOLOR = 1 << 2;
+
+const int ETIMEOUT = 102;
+const int ECANTFETCH = 103;
+
+static MathStructure evaluate_single(Calculator *calc, const EvaluationOptions &eo, unsigned long line_number,
+                                                                         const string &expression) {
+        MathStructure result;
+        if (!calc->calculate(&result, calc->unlocalizeExpression(expression), TIMEOUT_CALC, eo))
+                throw timeout_exception();
+
+        const CalculatorMessage *message;
+        while ((message = CALCULATOR->message())) {
+                putchar(TYPE_MESSAGE);
+                switch (message->type()) {
+                        case MESSAGE_INFORMATION:
+                                putchar(LEVEL_INFO);
+                                break;
+                        case MESSAGE_WARNING:
+                                putchar(LEVEL_WARNING);
+                                break;
+                        case MESSAGE_ERROR:
+                                putchar(LEVEL_ERROR);
+                                break;
+                        default:
+                                putchar(LEVEL_UNKNOWN);
+                                break;
+                }
+                printf("line %lu: ", line_number);
+                fputs(message->c_message(), stdout);
+                putchar(SEPARATOR);
+                calc->nextMessage();
+        }
+        return result;
+}
+
+static bool mode_set(unsigned long mode, unsigned long test) {
+        return mode & test;
+}
+
+static void set_precision(Calculator *calc, unsigned long mode, EvaluationOptions &eo, PrintOptions &po) {
+        int precision = PRECISION_DEFAULT;
+
+        if (mode_set(mode, MODE_EXACT)) {
+                eo.approximation = APPROXIMATION_EXACT;
+                po.number_fraction_format = FRACTION_DECIMAL_EXACT;
+
+        } else if (mode_set(mode, MODE_PRECISION)) {
+                precision = PRECISION_HIGH;
+                po.indicate_infinite_series = false;
+        }
+
+        calc->setPrecision(precision);
+}
+
+MathStructure evaluate_all(const vector<string> &expressions, const EvaluationOptions &eo, Calculator *calc) {
+        for (size_t i = 0; i < expressions.size() - 1; ++i)
+                evaluate_single(calc, eo, i + 1, expressions[i]);
+        return evaluate_single(calc, eo, expressions.size(), expressions.back());
+}
+
+void print_result(Calculator *calc, const MathStructure &result_struct, const PrintOptions &po, int mode,
+                                  bool approximate) {
+        string result = calc->print(result_struct, TIMEOUT_PRINT, po, false, mode_set(mode, MODE_NOCOLOR) ? 0 : 1,
+                                                                TAG_TYPE_TERMINAL);
+
+        if (ends_with(result, calc->timedOutString())) {
+                throw timeout_exception();
+
+        } else {
+                putchar(TYPE_RESULT);
+                putchar(approximate ? RESULT_APPROXIMATION_YES : RESULT_APPROXIMATION_NO);
+                fputs(result.c_str(), stdout);
+        }
+        putchar(SEPARATOR);
+}
+
+static EvaluationOptions get_evaluationoptions() {
+        EvaluationOptions eo;
+        eo.approximation = APPROXIMATION_TRY_EXACT;
+        eo.parse_options.unknowns_enabled = false;
+        eo.sync_units = false;
+        return eo;
+}
+
+static PrintOptions get_printoptions(int base, bool &approximate) {
+        PrintOptions po;
+        po.base = base;
+        po.number_fraction_format = FRACTION_DECIMAL;
+        po.interval_display = INTERVAL_DISPLAY_PLUSMINUS;
+        po.use_unicode_signs = true;
+        //po.min_decimals = MIN_DECIMALS;
+        po.time_zone = TIME_ZONE_UTC;
+        po.abbreviate_names = true;
+        po.spell_out_logical_operators = true;
+        po.allow_non_usable = true;
+        po.show_ending_zeroes = false;
+        //po.preserve_precision = true;
+        //po.restrict_to_parent_precision = false;
+        po.is_approximate = &approximate;
+        return po;
+}
+
+static void evaluate(Calculator *calc, const vector<string> &expressions, unsigned int mode, int base) {
+        calc->setExchangeRatesWarningEnabled(false);
+        calc->loadExchangeRates();
+        calc->loadGlobalDefinitions();
+
+        bool approximate = false;
+
+        PrintOptions po = get_printoptions(base, approximate);
+        EvaluationOptions eo = get_evaluationoptions();
+        set_precision(calc, mode, eo, po);
+
+        calc->setMessagePrintOptions(po);
+
+        do_seccomp();
+
+        auto result_struct = evaluate_all(expressions, eo, calc);
+
+        print_result(calc, result_struct, po, mode, approximate);
+}
+
+static void update() {
+        if (!CALCULATOR->canFetch())
+                throw exchange_update_exception();
+
+        CALCULATOR->fetchExchangeRates(TIMEOUT_UPDATE);
+        // for some reason this returns false even when it's successful so I'm not going to check it
+}
+
+static vector<string> parseExpressions(stringstream input) {
+        vector<string> result;
+        string expression;
+        while (std::getline(input, expression, '\n'))
+                result.push_back(expression);
+
+        return result;
+}
+
+int main(int argc, char **argv) {
+        do_setuid();
+
+        if (argc < 2)
+                return 1;
+
+        auto *calc = new Calculator(true);
+        do_defang_calculator(calc);
+        try {
+                if (argc == 2) {
+                        if (strcmp(argv[1], COMMAND_UPDATE) == 0)
+                                update();
+                        else
+                                return 1;
+                } else {
+                        evaluate(calc, parseExpressions(stringstream(argv[1])), std::strtoul(argv[2], nullptr, 10),
+                                         std::strtol(argv[3], nullptr, 10));
+                }
+
+        } catch (const qalculate_exception &e) {
+                return e.getCode();
+        }
+}
+
diff --git a/src/qalculate_exception.cpp b/src/qalculate_exception.cpp
new file mode 100644
index 0000000..db38fa3
--- /dev/null
+++ b/src/qalculate_exception.cpp
@@ -0,0 +1,12 @@
+//SPDX-License-Identifier: GPL-3.0
+
+#include <qalculate_exception.h>
+#include <string>
+
+qalculate_exception::qalculate_exception(int code) :
+                std::runtime_error(std::to_string(code).c_str()), code(code) {
+}
+
+int qalculate_exception::getCode() const {
+        return this->code;
+}
diff --git a/src/security_util.cpp b/src/security_util.cpp
new file mode 100644
index 0000000..33728fc
--- /dev/null
+++ b/src/security_util.cpp
@@ -0,0 +1,82 @@
+//SPDX-License-Identifier: GPL-3.0
+
+#include <libqalculate/Function.h>
+#include <libqalculate/Variable.h>
+#include <security_util.h>
+
+#ifdef UID
+#include <grp.h>
+#include <cap-ng.h>
+#else
+#warning "Not doing setuid/setgid, do not use in production!"
+#endif
+
+#ifdef SECCOMP
+#include <seccomp.h>
+#else
+#warning "Not doing seccomp, do not use in production!"
+#endif
+
+void do_setuid() {
+#ifdef UID
+if (setgroups(0, {})) {
+        perror("couldn't remove groups");
+        abort();
+}
+
+if (setresgid(UID, UID, UID)) {
+        perror("couldn't set gid");
+        abort();
+}
+
+if (setresuid(UID, UID, UID)) {
+        perror("couldn't set uid");
+        abort();
+}
+
+capng_clear(CAPNG_SELECT_BOTH);
+if (capng_update(CAPNG_DROP, (capng_type_t)(CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SETGID)) {
+        printf("couldn't drop caps: can't select\n");
+        abort();
+}
+int err = capng_apply(CAPNG_SELECT_BOTH);
+if (err) {
+        printf("couldn't drop caps: %d\n", err);
+        abort();
+}
+#endif
+}
+
+void do_defang_calculator(Calculator *calc) {
+        calc->getActiveFunction("command")->destroy(); // rce
+#ifdef HAS_PLOT
+        calc->getActiveFunction("plot")->destroy(); // wouldn't work
+#endif
+        calc->getActiveVariable("uptime")->destroy(); // information leakage
+}
+
+void do_seccomp() {
+#ifdef SECCOMP
+scmp_filter_ctx ctx;
+ctx = seccomp_init(SCMP_ACT_KILL);
+/*   0 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(read), 0);
+/*   1 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(write), 0);
+/*   9 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mmap), 0);
+/*  10 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(mprotect), 0);
+/*  11 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(munmap), 0);
+/*  13 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigaction), 0);
+/*  14 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rt_sigprocmask), 0);
+/*  24 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sched_yield), 0);
+/* 230 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clock_nanosleep), 0);
+/* 231 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(exit_group), 0);
+/* 262 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(newfstatat), 0);
+/* 273 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(set_robust_list), 0);
+/* 334 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(rseq), 0);
+/* 435 */ seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(clone3), 0);
+int err = seccomp_load(ctx);
+if (err) {
+        printf("couldn't seccomp: %d\n", err);
+        abort();
+}
+#endif
+}
diff --git a/src/timeout_exception.cpp b/src/timeout_exception.cpp
new file mode 100644
index 0000000..09d4bf3
--- /dev/null
+++ b/src/timeout_exception.cpp
@@ -0,0 +1,7 @@
+//SPDX-License-Identifier: GPL-3.0
+
+#include <timeout_exception.h>
+
+timeout_exception::timeout_exception() :
+                qalculate_exception(102) {
+}