Restricted Access

**Tim Chase** · Jul 10 '06, 09:25 PM

Re: Restricted Access

1. How can i disable some of the modules without deleting. e.g I wish

to disable "os" module.

If you're prepared for the massive breakage that will ensue, you can

chmod go-rwx /usr/lib/python2.3/os.*

(assuming *nix as you later detail).

2. How can i force user code to access only his particular folder, I
dont want to create uses in unix, e.g

Well, you can create a chroot jail for each user that contains a
clone of your /usr/{lib/python2.3/,bin/,usr/bin/} directories.
You'd have to include any other executables that the user would
need (important stuff like ls, cp, mv, mkdir, rmdir,
cvs/ci/co/rcs/svn, etc) This would ensure that each user doesn't
access anything that you haven't explicitly copied in to their
jail. Another alternative might just be to copy the python
libraries to some place in the user's homedir (whatever their
original library path was), revoke execute non-user execute privs
from the python executable ("chmod go-x `which python`), and then
change python to be a script that runs something like "chroot
$HOME/ python $@". Allow per-user access to this script via sudo.

Just a couple ideas you might try.

-tkc

**iapain** · Jul 10 '06, 09:55 PM

Re: Restricted Access

Tim Chase wrote:

If you're prepared for the massive breakage that will ensue, you can
>
chmod go-rwx /usr/lib/python2.3/os.*

No, I cant change permission or delete the module, the best would be
something to detect 'import os' in user code .. but If i go with chroot
jail approch then everything will be like what i want. But chroot jail
approch would take much space on webserver, what would happen if number
of users are large.

Another alternative might just be to copy the python
libraries to some place in the user's homedir (whatever their
original library path was), revoke execute non-user execute privs
from the python executable ("chmod go-x `which python`), and then
change python to be a script that runs something like "chroot
$HOME/ python $@". Allow per-user access to this script via sudo.

Its having the same problem. The idea on which i am working is a
webide(which i already created) and a user file system(on which i am
working now) so that each user can access python globally and files
from his own folder, without adding them in unix user list.

Best!

**Fredrik Lundh** · Jul 11 '06, 08:25 AM

Re: Restricted Access

"iapain" wrote:

No, I cant change permission or delete the module, the best would be
something to detect 'import os' in user code ..

trust me, implementing a restricted execution model for Python that actually
works is a *lot* harder than that.

googling for "python restricted execution" might give you some clues.

</F>

**iapain** · Jul 11 '06, 12:55 PM

Re: Restricted Access

googling for "python restricted execution" might give you some clues.

I've already assumed that there is no rexec for me as i am using python
2.4. Yeah its much more difficult that my imagination. Should I go for
alternatives like
1. Assume every one who is using this webide, wont corrupt system
2. Use some tricks to encrypt the user path and do lots of replacement
on user code and o/p.

or something else?

Best!
iapain

**Fredrik Lundh** · Jul 11 '06, 01:05 PM

Re: Restricted Access

"iapain" wrote:

I've already assumed that there is no rexec for me as i am using python
2.4. Yeah its much more difficult that my imagination. Should I go for
alternatives like
1. Assume every one who is using this webide, wont corrupt system
2. Use some tricks to encrypt the user path and do lots of replacement
on user code and o/p.
>
or something else?

unless you're willing to build a restricted runtime that runs on top of the core inter-
preter, you should assume that anyone writing a Python script that's executed by
your program has access to everything that your Python process has access to...

</F>

**iapain** · Jul 11 '06, 01:15 PM

Re: Restricted Access

unless you're willing to build a restricted runtime that runs on top of the core inter-

preter, you should assume that anyone writing a Python script that's executed by
your program has access to everything that your Python process has access to...

I think using replacements I can ban atleast OS module and about files,
either i should ban file open or write my own module something like
rexec, truefully i dont know if I can write that one or not. I was
thinking that this gonna take few days but looking much more difficult.
Thanks Fred! for nice tutorials on www.

**Steven D'Aprano** · Jul 11 '06, 02:15 PM

Re: Restricted Access

On Tue, 11 Jul 2006 06:21:39 -0700, iapain wrote:

>unless you're willing to build a restricted runtime that runs on top of the core inter-
>preter, you should assume that anyone writing a Python script that's executed by
>your program has access to everything that your Python process has access to...

>
I think using replacements I can ban atleast OS module and about files,

How are you planning on banning the module? Are you thinking about using
source code scanning to detect risky code?

What about modules which export os? It's one thing to "ban" os, but
did you remember to ban glob.os? How about site.os? And netrc.os? And and
and and...

What about this line of code?

my_innocent_obj ect = __import__(''.j oin([chr(110+x) for x in [1, 5]]))

Creating a restricted execution environment is *hard*. As far as I know,
even Microsoft has never attempted it. And for all of Sun's resources and
talent, security holes are sometimes found even in Java.

--
Steven

**iapain** · Jul 11 '06, 02:55 PM

Re: Restricted Access

my_innocent_obj ect = __import__(''.j oin([chr(110+x) for x in [1, 5]]))

Thats really smart way, yeah i had plan to scan and detect but I think
its not gonna work.

Creating a restricted execution environment is *hard*. As far as I know,
even Microsoft has never attempted it. And for all of Sun's resources and
talent, security holes are sometimes found even in Java.

Does that mean there is no way to implement restricted enviorment?

Best!
iapain

**Diez B. Roggisch** · Jul 11 '06, 03:25 PM

Re: Restricted Access

iapain wrote:

>

>my_innocent_ob ject = __import__(''.j oin([chr(110+x) for x in [1, 5]]))

>
Thats really smart way, yeah i had plan to scan and detect but I think
its not gonna work.
>

>Creating a restricted execution environment is *hard*. As far as I know,
>even Microsoft has never attempted it. And for all of Sun's resources and
>talent, security holes are sometimes found even in Java.

>
Does that mean there is no way to implement restricted enviorment?

In a nutshell: yes, especially if not designed from ground up that way. If
you need it, the best thing to do is to put some distance between your code
and the possibly malicious one, using some RPC.

Diez

**Cameron Laird** · Jul 11 '06, 04:05 PM

Re: Restricted Access

In article <1152629752.824 822.147230@b28g 2000cwb.googleg roups.com>,
iapain <iapain@gmail.c omwrote:

**K.S.Sreeram** · Jul 11 '06, 04:35 PM

Re: Restricted Access

Steven D'Aprano wrote:

Creating a restricted execution environment is *hard*. As far as I know,
even Microsoft has never attempted it. And for all of Sun's resources and
talent, security holes are sometimes found even in Java.

Java is not the only restricted execution environment around.
Javascript, as implemented by most browsers, is an excellent lightweight
restricted execution environment, and there are many browsers which have
good implementations .

Regards
Sreeram

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEs9RGrgn 0plK5qqURAnjvAK C/0kaWmWFI8un4016 RGsNgm+3bggCgnh gh
P3NgiQD1zTVcqaz wkr/qNEc=
=FBpd
-----END PGP SIGNATURE-----

**iapain** · Jul 11 '06, 05:05 PM

Re: Restricted Access

The most knowledgeable people have effectively given up, in

regard to Python.

I guess now I am up with only one option, i.e hope that user input code
wont be evil to the system. **which is rarely possible**

**Paul Rubin** · Jul 11 '06, 05:15 PM

Re: Restricted Access

"K.S.Sreera m" <sreeram@tachyo ntech.netwrites :

Java is not the only restricted execution environment around.
Javascript, as implemented by most browsers, is an excellent lightweight
restricted execution environment, and there are many browsers which have
good implementations .

And we hear about browser security bugs all the time, for which the
workaround is "shut off javascript".

**Georg Brandl** · Jul 11 '06, 06:28 PM

Re: Restricted Access

Cameron Laird wrote:

In article <1152629752.824 822.147230@b28g 2000cwb.googleg roups.com>,
iapain <iapain@gmail.c omwrote:
.
.
.

>>Does that mean there is no way to implement restricted enviorment?

.
.
.
The most knowledgeable people have effectively given up, in
regard to Python.

Brett Cannon is currently trying to come up with a comprehensive spec
and implementation of a sandboxed Python interpreter, for use in
Mozilla as a JavaScript replacement. (look in the python-dev archives
for more)

Georg