4 ms·

Interesting. Rust has two playgrounds (official: https://play.rust-lang.org/ https://play.rust-lang.org/, unofficial: http://play.integer32.com/ http://play.in

Interesting. Rust has two playgrounds (official: https://play.rust-lang.org/ https://play.rust-lang.org/, unofficial: http://play.integer32.com/ http://play.integer32.com/), and each is a completely different bit of open-source software (https://github.com/rust-lang/rust-playpen https://github.com/rust-lang/rust-playpen , https://github.com/integer32llc/rust-playground https://github.com/integer32llc/rust-playground) They both use docker for isolation, with a bunch of things to make it work. IIRC we haven't had any issues with this. Furthermore, the official playground used to be a third completely different bit of software until it was rewritten in Rust. It also used to use https://github.com/thestinger/playpen https://github.com/thestinger/playpen. I'm skeptical that the problem will take that much effort since Rust has solved it (to some degree) twice. At the same time, it's likely that Go's playpen does a lot more mitigation, e.g. the time.Now() probably futzes timing attacks. Though in that case they would need to mess with mutexes or scheduling as well (since you can use shared memory to build a timer), which complicates things. (For timing attacks I still think the solution still lies in how you set up the container, specifically isolating its memory accesses -- instead of tweaking the compiler itself)

remus 10y ago
Andrew Gerrand wrote a nice overview of how the go playground works: https://blog.golang.org/playground https://blog.golang.org/playground Im pretty sure the source code is available somewhere, though usage isn't very well documented. There's periodic requests on golang-nuts about how to get your own version up and running.
- Manishearth 10y ago
  Thanks. Looks like the reason the time functionality is restricted is to avoid DOSes and server load, not to prevent against side channel attacks (which like I said are possible anyway with mutexes and channels). The rest could be pretty easily implemented via docker or some other sandboxing method (the time stuff sort of can be handled too, but it's trickier). It might be more vulnerable to load, but it will be able to work with a pristine Go toolchain and provide options like switching between versions; much like the Rust playground.
  - fjl 10y ago
    faketime is very useful on its own. We use it to run network simulations in accelerated time. https://github.com/ethereum/go-ethereum/blob/master/p2p/discv5/sim_test.go#L37 https://github.com/ethereum/go-ethereum/blob/master/p2p/disc...
Merovius 10y ago
> They both use docker for isolation Docker isn't really meant as a security mechanism. Among other things, you still expose the full kernel API as an attack surface. I can't imagine that they only use Docker, at the very least they'll probably have some dedicated machines for the playgrounds. Even then, this is probably not a great idea. The playground uses NaCl (and AFAIK that includes seccomp), restricting both the instructions that you can use and the set of system calls that you can make (basically just read/write on fds 0-3 and exit). It's what chromes sandbox is based upon. There are a couple of implications from this (most are described in the blog post linked elsewhere), e.g. that time is faked and that playground-code runs single-threaded. A great consequence, though, is that playground code is 100% deterministic, meaning it can be cached (and it is cached pretty aggressively), reducing the load for popular snippets.
- Manishearth 10y ago
  Hm, seems like they both just use docker's sandboxing parameters (https://github.com/rust-lang/rust-playpen/blob/master/src/docker.rs#L20 https://github.com/rust-lang/rust-playpen/blob/master/src/do... , https://github.com/integer32llc/rust-playground/blob/master/ui/src/sandbox.rs#L211 https://github.com/integer32llc/rust-playground/blob/master/... ). The official one used to use libseccomp, but it doesn't anymore. They probably should use https://github.com/servo/gaol https://github.com/servo/gaol (should be drop-in) or seccomp , I'll file issues. IIRC they're on their own dedicated instances.

remus 10y ago

Andrew Gerrand wrote a nice overview of how the go playground works: https://blog.golang.org/playground https://blog.golang.org/playground Im pretty sure the source code is available somewhere, though usage isn't very well documented. There's periodic requests on golang-nuts about how to get your own version up and running.

Manishearth 10y ago
Thanks. Looks like the reason the time functionality is restricted is to avoid DOSes and server load, not to prevent against side channel attacks (which like I said are possible anyway with mutexes and channels). The rest could be pretty easily implemented via docker or some other sandboxing method (the time stuff sort of can be handled too, but it's trickier). It might be more vulnerable to load, but it will be able to work with a pristine Go toolchain and provide options like switching between versions; much like the Rust playground.
- fjl 10y ago
  faketime is very useful on its own. We use it to run network simulations in accelerated time. https://github.com/ethereum/go-ethereum/blob/master/p2p/discv5/sim_test.go#L37 https://github.com/ethereum/go-ethereum/blob/master/p2p/disc...

Merovius 10y ago

> They both use docker for isolation Docker isn't really meant as a security mechanism. Among other things, you still expose the full kernel API as an attack surface. I can't imagine that they only use Docker, at the very least they'll probably have some dedicated machines for the playgrounds. Even then, this is probably not a great idea. The playground uses NaCl (and AFAIK that includes seccomp), restricting both the instructions that you can use and the set of system calls that you can make (basically just read/write on fds 0-3 and exit). It's what chromes sandbox is based upon. There are a couple of implications from this (most are described in the blog post linked elsewhere), e.g. that time is faked and that playground-code runs single-threaded. A great consequence, though, is that playground code is 100% deterministic, meaning it can be cached (and it is cached pretty aggressively), reducing the load for popular snippets.

Manishearth 10y ago
Hm, seems like they both just use docker's sandboxing parameters (https://github.com/rust-lang/rust-playpen/blob/master/src/docker.rs#L20 https://github.com/rust-lang/rust-playpen/blob/master/src/do... , https://github.com/integer32llc/rust-playground/blob/master/ui/src/sandbox.rs#L211 https://github.com/integer32llc/rust-playground/blob/master/... ). The official one used to use libseccomp, but it doesn't anymore. They probably should use https://github.com/servo/gaol https://github.com/servo/gaol (should be drop-in) or seccomp , I'll file issues. IIRC they're on their own dedicated instances.