Now that rexec is gone...

[Rainer Deyke]

Now that rexec is gone, is there any code or information available on
executing Python in a restricted environment? And before I roll my own
solution, exactly where the security holes in rexec anyway?

(I know one way of getting a restricted environment: butcher the Python
interpreter by removing everything that's even remotely dangerous, use
Python only for restricted execution, and do everything else in a C++
program that embeds the butchered Python interpreter. I'd like to avoid
doing that, for obvious reasons.)
--
Rainer Deyke - ra*****@eldwood .com - http://eldwood.com

[Terry Reedy]

"Rainer Deyke" <ra*****@eldwoo d.com> wrote in message
news:XA8db.5972 31$o%2.276974@s ccrnsc02...

Now that rexec is gone, is there any code or information available on executing Python in a restricted environment? And before I roll my own solution, exactly where the security holes in rexec anyway?

Suggest you google last year of c.l.py for 'rexec'. Also check out
py-dev summaries of last fall for discussion of why removed.

TJR

[Michael Hudson]

"Rainer Deyke" <ra*****@eldwoo d.com> writes:

Now that rexec is gone, is there any code or information available on
executing Python in a restricted environment?
There was a thread on python-dev about Zope's version of rexec
(RestrictedPyth on?) which looked promising on casual inspection.

Cheers,
mwh

-- It might get my attention if you'd spin around in your chair,
spoke in tongues, and puked jets of green goblin goo.

I can arrange for this. ;-) -- Barry Warsaw & Fred Drake

[Alex Martelli]

Rainer Deyke wrote:

Now that rexec is gone, is there any code or information available on
executing Python in a restricted environment? And before I roll my own
solution, exactly where the security holes in rexec anyway?

(I know one way of getting a restricted environment: butcher the Python
interpreter by removing everything that's even remotely dangerous, use
Python only for restricted execution, and do everything else in a C++
program that embeds the butchered Python interpreter. I'd like to avoid
doing that, for obvious reasons.)

Actually, such a "butchered" Python interpreter might be a fun and
useful project indeed. You would have to add programmable limits on
resource consumptions -- e.g., memory allocatable by the script[s],
time (CPU or maybe elapsed) usable thereby, etc. And you should rename
everything, say to use Qy instead of Py, so that a normal and a
butchered interpreter could easily be embedded in the same program.

Once the hard work of "butchering " is done, you might in fact quite
easily expose "the butchered interpreter" via an extension module for
Python proper -- no need to do "everything in C++", you'd just have two
separate Pythons, a full-function one and a seriously-hobbled one.

Not *QUITE* as good as running untrusted code in a separate "jail"'d
process, perhaps, but probably the closest you can come to that on
such environments as Windows. Note that the need to add resource
limitations is crucial (and was never addressed by rexec, making it
pretty useless to ward against denial-of-service kinds of attacks!).
Alex

[Rainer Deyke]

Alex Martelli wrote:

Actually, such a "butchered" Python interpreter might be a fun and
useful project indeed. You would have to add programmable limits on
resource consumptions -- e.g., memory allocatable by the script[s],
time (CPU or maybe elapsed) usable thereby, etc. And you should
rename everything, say to use Qy instead of Py, so that a normal and a
butchered interpreter could easily be embedded in the same program.

That might be a useful project, but it also sounds like a lot of work. I
don't think I'll be going that route.

As it turns out, I can solve my security problem in a different way
entirely: by confirming that any Python code I run is from a trusted source.
No need to run untrusted code at all.
--
Rainer Deyke - ra*****@eldwood .com - http://eldwood.com

[Rainer Deyke]

Terry Reedy wrote:

Suggest you google last year of c.l.py for 'rexec'. Also check out
py-dev summaries of last fall for discussion of why removed.

I see... It turns out that, short of modifying the Python interpreter, there
is no way to get real security. '"".__class_ _' gives access to 'str', 'str'
gives access to 'object', and 'object' gives access to 'file'.
--
Rainer Deyke - ra*****@eldwood .com - http://eldwood.com

[Erik Max Francis]

Rainer Deyke wrote:

As it turns out, I can solve my security problem in a different way
entirely: by confirming that any Python code I run is from a trusted
source.
No need to run untrusted code at all.

Yes, that sounds like the most reasonable approach.

--
Erik Max Francis && ma*@alcyone.com && http://www.alcyone.com/max/
__ San Jose, CA, USA && 37 20 N 121 53 W && &tSftDotIotE
/ \ In principle I am against principles.
\__/ Tristan Tzara

[Cameron Laird]

In article <Ih************ **********@news 1.tin.it>,
Alex Martelli <al***@aleax.it > wrote:

[Jacek Generowicz]

"Rainer Deyke" <ra*****@eldwoo d.com> writes:

Terry Reedy wrote:

Suggest you google last year of c.l.py for 'rexec'. Also check out
py-dev summaries of last fall for discussion of why removed.

I see... It turns out that, short of modifying the Python interpreter, there
is no way to get real security. '"".__class_ _' gives access to 'str', 'str'
gives access to 'object', and 'object' gives access to 'file'.

A message-id, or similar, at this point, could save future googlers a
lot of time ...

[Gerrit Holl]

Rob Hunter wrote:

How do I check if a value is a number in Python?

One way is (x == type(1)) and (x == type(1.2)) and (x ==
type(2387482734 274)) and ...

but this seems kludgy. Any better way?

Why do you want to do so? Maybe, it is better in your
case to just run the piece of code using the number, and
if it fails, it fails. However, if you must, you need to
do type(x) is type(1) and ... etc., or isinstance(x, int)
and isinstance(x, float), etc.

Gerrit.

--
Asperger Syndroom - een persoonlijke benadering:
http://people.nl.linux.org/~gerrit/
Het zijn tijden om je zelf met politiek te bemoeien:
http://www.sp.nl/