4 ms·
It seems a large part of the previous discussion surrounded sandboxing Python; anyone know where the author is with that? I find it hard to believe it would be
by alexchamberlain 13y ago
It seems a large part of the previous discussion surrounded sandboxing Python; anyone know where the author is with that? I find it hard to believe it would be very hard if you just embed the players game in a C++ engine.
- brandonhsiao 13y agoWell, it turns out you can't sandbox Python at the language level. So now each user's code is run (a) in a separate process (b) in a chroot jail (c) as user nobody (d) with umask set to 0 (e) with a time limit of 300ms.
- krallin 13y agoI thought pypy had a sandboxed mode, did you get to experiment with it? if you did, what did you think?
- dbaupp 13y agoHave you experimented with using linux's cgroups for real security? (e.g. you can white/black-list specific syscalls, set time & memory limits etc, all at the kernel level) Example sandbox: https://github.com/thestinger/playpen https://github.com/thestinger/playpen
- jnbiche 13y agopypy has a fairly advanced sandbox, and as a side effect your code will probably run faster.
- brandonhsiao 13y agoAlso, with network connections firewalled via iptables.