Security in an process started with exec

[a]

Hi,

The php script that processes user input from a form, starts a new process
using exec. In my case, the process may contain arbitrary, user defined
functionality. How do I ensure that that process doesn't do any harm? Is
there a way to define a sort of sandbox that the process can run in, so it
won't be able to access any unauthorized resources, or do some other damage
to the server?

I am running PHP 5.1.2 on Apache 2, on Win XP Pro.

Thanks,

A

[NC]

a wrote:

The php script that processes user input from a form, starts a new process
using exec. In my case, the process may contain arbitrary, user defined
functionality. How do I ensure that that process doesn't do any harm? Is
there a way to define a sort of sandbox that the process can run in, so it
won't be able to access any unauthorized resources, or do some other
damage to the server?

If your process contains arbitrary user-defined functionality, there's
nothing you can do to define a sandbox for it. Arbitrary user-defined
functionality may include switching to the superuser mode (e.g., su on
Unix), which renders any sandbox meaningless.

Cheers,
NC

[Iván Sánchez Ortega]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

a wrote:

Is there a way to define a sort of sandbox that the process can run in, so
it won't be able to access any unauthorized resources, or do some other
damage to the server?

You may want to evaluate chroot jails, xen virtual machines, and other ways
of running processes within a different enviroment.

- --
- ----------------------------------
Iván Sánchez Ortega -i-punto-sanchez--arroba-mirame-punto-net

Un ordenador no es un televisor ni un microondas, es una herramienta
compleja.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDzr823jcQ2mg3Pc8RAiAXAJ9N3unVw1t4IX6srErQyO WF8FKuhQCePzbJ
U+TweXdejY8dPTNnti880VU=
=QZ3u
-----END PGP SIGNATURE-----

[a]

>

You may want to evaluate chroot jails, xen virtual machines, and other
ways
of running processes within a different enviroment.

The solutions you mention are not available for Windows (the exec-ed
processes must run on Windows), but I'll check other solutions like VMWare.

Thanks,

A

[a]

>

If your process contains arbitrary user-defined functionality, there's
nothing you can do to define a sandbox for it. Arbitrary user-defined
functionality may include switching to the superuser mode (e.g., su on
Unix), which renders any sandbox meaningless.

I don't know how things work on Unix, but at least on Windows I think there
is a solution. Instead of calling exec to run the process that does the
actual work (P1), I create a thin executable (P2) that runs my process using
CreateProcessAsUser. This will run a process in the context of a specific
Windows user and which can be different from the user that is calling it.
Then in my php script I use exec to start P2, which will start P1 in a safe
context, assuming that the user in whose context is running has the
appropriate rights on the server.

I still have to try it, but it seems like a safe solution to me.

A