3 ms·
Tl;dr do not try to create a Python sandbox it is not a good language for it.
by justincormack 14y ago
Tl;dr do not try to create a Python sandbox it is not a good language for it.
- lucian1900 14y agoOr create a real sandbox, with interpreter support, like the PyPy one.
- deleted 14y ago[deleted]
- chubot 14y agoHm how new is this? Any projects using it? It looks pretty good from the docs: http://pypy.readthedocs.org/en/latest/sandbox.html http://pypy.readthedocs.org/en/latest/sandbox.html
- pekk 14y agoIt's really not new at all. Pretty clear demonstration that Python as a language is not incompatible with sandboxing
- minopret 14y agoBased on this exploit if not on general principle, it seems advisable to wrap a sandboxing runtime in additional protections. For example codepad.org says: "When your app is remote code execution, you have to expect security problems. Rather than rely on just the chroot and ptrace supervisor, I've taken some additional precautions: The supervisor processes run on virtual machines, which are firewalled such that they are incapable of making outgoing connections. The machines that run the virtual machines are also heavily firewalled, and restored from their source images periodically."
- gngeal 14y agoGiven a sane language and a sane exposed API, it's not difficult to limit what the remote code can do. It's just that bolting a software-based isolation layer ("sandbox") on top of something existing can be expected to yield a few holes in the process. If I were to use anything existing, it would be something like Lua. Just strip away the standard library API and replace it with something strictly under your control.
- justincormack 14y agoLua is much more sane because you have much more control of what is accessible to code than you have in Python.
- habitue 14y agoTl;dr if your code takes user input and interprets it as code, you have an inherently insecure program. Dynamic languages with lots of introspection made their work easier here, but the whole reason it was possible is because the program was intentionally insecure. The "restricted environment" was a few small hacks on top of eval, it wasn't a serious attempt to make it secure.