Restricted Access

[iapain]

Re: Restricted Access

Brett Cannon is currently trying to come up with a comprehensive spec

and implementation of a sandboxed Python interpreter, for use in
Mozilla as a JavaScript replacement. (look in the python-dev archives
for more)

I'm not sure he is working or not, latest i read was he purposed new
restricted enviornment for python.

Best!

[gene tani]

Re: Restricted Access


Georg Brandl wrote:

Cameron Laird wrote:

In article <1152629752.824 822.147230@b28g 2000cwb.googleg roups.com>,
iapain <iapain@gmail.c omwrote:
.
.
.

>Does that mean there is no way to implement restricted enviorment?

.
.
.
The most knowledgeable people have effectively given up, in
regard to Python.

>

also relevant is the 2 "Try python" online shells that were discussed
last January or so

http://groups.google.com/group/comp.lang.python/browse_frm/thread/66e659942f95b1a0?q=trypython&

[Dave Hansen]

Re: Restricted Access

On 11 Jul 2006 10:19:22 -0700 in comp.lang.pytho n, Paul Rubin
<http://phr.cx@NOSPAM.i nvalidwrote:

>"K.S.Sreeram " <sreeram@tachyo ntech.netwrites :

>Java is not the only restricted execution environment around.
>Javascript, as implemented by most browsers, is an excellent lightweight
>restricted execution environment, and there are many browsers which have
>good implementations .

>
>And we hear about browser security bugs all the time, for which the
>workaround is "shut off javascript".

And Java...

Regards,

-=Dave

--
Change is inevitable, progress is not.

[K.S.Sreeram]

Re: Restricted Access

Paul Rubin wrote:

"K.S.Sreera m" <sreeram@tachyo ntech.netwrites :

>Java is not the only restricted execution environment around.
>Javascript, as implemented by most browsers, is an excellent lightweight
>restricted execution environment, and there are many browsers which have
>good implementations .

And we hear about browser security bugs all the time, for which the
workaround is "shut off javascript".

They all have bugs (including java), but atleast the architecture itself
isnt flawed (unlike say, ActiveX).

Anyways, the point I was trying to make is that, Sun is not the only one
to have implemented a restricted execution environment. Opera, Mozilla,
Safari etc,have all done it.

Regards
Sreeram




-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFEtDp/rgn0plK5qqURAo6 gAJ496tWGJmmKTg a2MtscI41uiL6+W ACaA7C5
DxcvH4TIwQEQBCE ZuPXA95Y=
=X1ju
-----END PGP SIGNATURE-----

[iapain]

Re: Restricted Access

Do you have an IBM s/370 running VM/CMS? VM was sort of an OS for

running multiple OSs, so it would be the "restricted environment" <G>

I'm having currently working on OS/2 and Linux platform, I've designed
a web based ide for python and i wish to restrict some commands and
user can only access i.e rwx in his folder.

Best!

[Maric Michaud]

Re: Restricted Access

Le mercredi 12 juillet 2006 08:17, iapain a écrit :

>
I'm having currently working on OS/2 and Linux platform, I've designed
a web based ide for python and i wish to restrict some commands

There is a restricted environment in Zope for TTW python scripts and
ZPT/DTML .

These scripts are run in the Zope process in a very restricted environment
which forbid the use of most builtins and allow the import of a limited list
of modules.

Why don't use the RestrictedPytho n module from Zope (2.8 and up) and adapt it
a bit. It seems loose coupled to the Zope internals (except for the
multimapping class which is an extension class, but I doubt it's really a
problem). It shouldn't be a too hard.

You'll need to make your own AccessControl/ZopeGuards.py-like module, and
probably subclass the RestrictionMuta tor to enable/disable certain
functionnality (interdiction of names beginning by '_' for example is hard
coded).
At last, you will get a simple example of the usage of the whole beast from
your own interpreter in Products/PythonScripts.

and
user can only access i.e rwx in his folder.
>

This should be possible by providing a wrapper function for file and open (see
the Guards.py module).

IMO, it worth to be tried, and I don't see any other short-term, less hacky,
solution.

regards,

--
_____________

Maric Michaud
_____________

Aristote - www.aristote.info
3 place des tapis
69004 Lyon
Tel: +33 426 880 097

[iapain]

Re: Restricted Access

You'll need to make your own AccessControl/ZopeGuards.py-like module, and

probably subclass the RestrictionMuta tor to enable/disable certain
functionnality (interdiction of names beginning by '_' for example is hard
coded).

Your reply is pretty hopeful, I saw that one, its the only fractional
part. I'm agree with others that I need to setup a safe runtime
enviornment rather than detecting harmful code.

This should be possible by providing a wrapper function for file and open (see
the Guards.py module).

Thats a nice idea, I guess it should work. I should try it really
quick! Thanks!

Best!
iapain