Security in an process started with exec

[a]

Hi,

The php script that processes user input from a form, starts a new process
using exec. In my case, the process may contain arbitrary, user defined
functionality. How do I ensure that that process doesn't do any harm? Is
there a way to define a sort of sandbox that the process can run in, so it
won't be able to access any unauthorized resources, or do some other damage
to the server?

I am running PHP 5.1.2 on Apache 2, on Win XP Pro.

Thanks,

A

[NC]

Re: Security in an process started with exec

a wrote:[color=blue]
>
> The php script that processes user input from a form, starts a new process
> using exec. In my case, the process may contain arbitrary, user defined
> functionality. How do I ensure that that process doesn't do any harm? Is
> there a way to define a sort of sandbox that the process can run in, so it
> won't be able to access any unauthorized resources, or do some other
> damage to the server?[/color]

If your process contains arbitrary user-defined functionality, there's
nothing you can do to define a sandbox for it. Arbitrary user-defined
functionality may include switching to the superuser mode (e.g., su on
Unix), which renders any sandbox meaningless.

Cheers,
NC

[Iván Sánchez Ortega]

Re: Security in an process started with exec

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

a wrote:
[color=blue]
> Is there a way to define a sort of sandbox that the process can run in, so
> it won't be able to access any unauthorized resources, or do some other
> damage to the server?[/color]

You may want to evaluate chroot jails, xen virtual machines, and other ways
of running processes within a different enviroment.

- --
- ----------------------------------
Iván Sánchez Ortega -i-punto-sanchez--arroba-mirame-punto-net

Un ordenador no es un televisor ni un microondas, es una herramienta
compleja.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDzr823jc Q2mg3Pc8RAiAXAJ 9N3unVw1t4IX6sr ErQyOWF8FKuhQCe PzbJ
U+TweXdejY8dPTN nti880VU=
=QZ3u
-----END PGP SIGNATURE-----

[a]

Re: Security in an process started with exec

>[color=blue]
> You may want to evaluate chroot jails, xen virtual machines, and other
> ways
> of running processes within a different enviroment.
>[/color]
The solutions you mention are not available for Windows (the exec-ed
processes must run on Windows), but I'll check other solutions like VMWare.

Thanks,

A

[a]

Re: Security in an process started with exec

>[color=blue]
> If your process contains arbitrary user-defined functionality, there's
> nothing you can do to define a sandbox for it. Arbitrary user-defined
> functionality may include switching to the superuser mode (e.g., su on
> Unix), which renders any sandbox meaningless.
>[/color]

I don't know how things work on Unix, but at least on Windows I think there
is a solution. Instead of calling exec to run the process that does the
actual work (P1), I create a thin executable (P2) that runs my process using
CreateProcessAs User. This will run a process in the context of a specific
Windows user and which can be different from the user that is calling it.
Then in my php script I use exec to start P2, which will start P1 in a safe
context, assuming that the user in whose context is running has the
appropriate rights on the server.

I still have to try it, but it seems like a safe solution to me.

A