Re: [Python-Dev] Assign(expr* targets, expr value) - why targetS?
2013/11/12 anatoly techtonik : > On Sun, Nov 10, 2013 at 8:34 AM, Benjamin Peterson > wrote: >> 2013/11/10 anatoly techtonik : >>> http://hg.python.org/cpython/file/1ee45eb6aab9/Parser/Python.asdl >>> >>> In Assign(expr* targets, expr value), why the first argument is a list? >> >> x = y = 42 > > Thanks. > > Speaking of this ASDL. `expr* targets` means that multiple entities of > `expr` under the name 'targets' can be passed to Assign statement. > Assign uses them as left value. But `expr` definition contains things > that can not be used as left side assignment targets: > > expr = BoolOp(boolop op, expr* values) > | BinOp(expr left, operator op, expr right) > ... > | Str(string s) -- need to specify raw, unicode, etc? > | Bytes(bytes s) > | NameConstant(singleton value) > | Ellipsis > > -- the following expression can appear in assignment context > | Attribute(expr value, identifier attr, expr_context ctx) > | Subscript(expr value, slice slice, expr_context ctx) > | Starred(expr value, expr_context ctx) > | Name(identifier id, expr_context ctx) > | List(expr* elts, expr_context ctx) > | Tuple(expr* elts, expr_context ctx) > > If I understand correctly, this is compiled into C struct definitions > (Python-ast.c), and there is a code to traverse the structure, but > where is code that validates that the structure is correct? Is it done > on the first level - text file parsing, before ASDL is built? If so, > then what is the role of this ADSL exactly that the first step is > unable to solve? Only valid expression targets are allowed during AST construction. See set_expr_context in ast.c. > > Is it possible to fix ADSL to move `expr` that are allowed in Assign > into `expr` subset? What effect will it achieve? I mean - will ADSL > compiler complain about wrong stuff on the left side, or it will still > be a role of some other component. Which one? I'm not sure what you mean by an `expr` subset. -- Regards, Benjamin ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
[Python-Dev] The pysandbox project is broken
Hi, After having work during 3 years on a pysandbox project to sandbox untrusted code, I now reached a point where I am convinced that pysandbox is broken by design. Different developers tried to convinced me before that pysandbox design is unsafe, but I had to experience it myself to be convineced. It would also be nice to help developers looking for a sandbox for their application. Please tell me if you know sandbox projects for Python so I can redirect users of pysandbox to a safer solution. I already know PyPy sandbox. I would like to share my experience because I know that other developers are using sandboxes in production and that there is a real need for sandboxing. Origin of pysandbox === In 2010, a developper called Tav wrote a sandbox called "safelite.py": the sandbox hides sensitive attributes to separate a trusted namespace and an untrusted namespace. Tav challenged Python core developers to break his sandbox and... the sandbox was quickly broken. Even if it was quickly broken, I was conviced that Tav found something interesting and that there is a real need for sandboxing Python. I continued his work by putting more protections on the untrusted namespace. I published pysandbox 1.0 in june 2010. History of pysandbox pysandbox was used to build an IRC bot on a french Python channel. The bot executed Python code in the sandbox. The bot was mainly used by hackers to test the sandbox to try to find a vulnerability. It was nice to have such IRC bot on an Python help channel. Three month later after the release of pysandbox 1.0, the first vulnerability was found: it was possible to modify the __builtins__ dictionary to hack the sandbox functions and so escape from the sandbox. I had to blacklist common instructions like "dict.pop()" or "del dict[key]" to protect the __builtins__ dictionary. I had prefer to use a custom type for __builtins__ but CPython requires a real dictionary: Python/ceval.c has inlined version of PyDict_GetItem. For your information, I modified CPython 3.3 to accept arbitrary mapping types for __builtins__. Just after this fix, another vulnerability was found: it was still possible to modify __builtins__ using dict.__init__() method. The access to this method was also blocked. Seven months later, new vulnerabilities. The "timeout" protection was removed because it is not effective on CPU intensive functions implemented in C. And to workaround a known bug in CPython crashing the interpreter, the access to the type.__bases__ attribute was also blocked. But this protection has to be disabled on CPython 2.5 because of another CPython bug... The access to func_defaults/__defaults__ attributes of a function was also blocked to protect the sandbox, even if it was not exploitable to escape from the sandbox. Recent events == A few weeks ago, a security challenge targeted pysandbox. In less then one day, two vulnerabilities were found. First, the compile() builtin function was used to read line by line of an arbitrary file on the disk using a syntax error: the line is displayed in the traceback. Second, a context manager was used to retrieve a traceback object: from traceback.tb_frame, it was possible to navigate in the frames (using frame.f_back) to retrieve a frame of the trusted namespace, and then use f_globals attribute of the frame to retrieve a global name. Game over. I fixed these two vulnerabilities in pysandbox 1.5.1: compile() is now blocked by default, and the access to traceback.tb_frame, frame.f_back and frame.f_globals has been blocked. I also started to work on a new design of pysandbox (version currently called "pysandbox 1.6", might become pysandbox 2.0 later): run untrusted code in a subprocess to have a safer design. Using a subprocess, it becomes easier to limit the memory usage, setup a real timeout, limit bytes written to stdout, limit the size of data send to and received from the child process, etc. But my main motivation was to not crash the whole application if the untrusted code exploits a know Python bug to crash the process. They are (too) many ways to crash Python using common types and functions... The problem is that after each release it becomes harder to write Python code in the sandbox. For example it becomes very hard to give access to objects from the trusted namespace to the untrusted namespace, because the whole object must be serialized to be passed to the child process. It becomes also harder to debug bugs in the sandboxeded code because the traceback feature doesn't work well in the sandbox. Pysandbox is broken === In my opinion, the compile() vulnerabilty is the proof that it is not possible to put a sandbox in CPython. Blocking access to the open() builtin function and the file type constructor are not enough if unrelated functions can give access indirectly to the file system. Having read access on the file system is a critical vulnerability in pysandbox and
Re: [Python-Dev] [Python-checkins] cpython: Provide a more readable representation of socket on repr().
Hi Giampaolo,
You forgot to update tests after your change in repr(socket). Tests
are failing on buildbots, just one example:
==
FAIL: test_repr (test.test_socket.GeneralModuleTests)
--
Traceback (most recent call last):
File "/var/lib/buildslave/3.x.murray-gentoo/build/Lib/test/test_socket.py",
line 653, in test_repr
self.assertIn('family=%i' % socket.AF_INET, repr(s))
AssertionError: 'family=2' not found in ""
--
Victor
2013/11/12 giampaolo.rodola :
> http://hg.python.org/cpython/rev/c5751f01b09b
> changeset: 87074:c5751f01b09b
> parent: 85942:0d079c66dc23
> user:Giampaolo Rodola'
> date:Thu Oct 03 21:01:43 2013 +0200
> summary:
> Provide a more readable representation of socket on repr().
>
> Before:
>
>
> Now:
> type=SocketType.SOCK_STREAM, proto=0, laddr=('0.0.0.0', 0)>
>
> files:
> Lib/socket.py | 2 +-
> 1 files changed, 1 insertions(+), 1 deletions(-)
>
>
> diff --git a/Lib/socket.py b/Lib/socket.py
> --- a/Lib/socket.py
> +++ b/Lib/socket.py
> @@ -136,7 +136,7 @@
> address(es).
> """
> closed = getattr(self, '_closed', False)
> -s = "<%s.%s%s fd=%i, family=%i, type=%i, proto=%i" \
> +s = "<%s.%s%s fd=%i, family=%s, type=%s, proto=%i" \
> % (self.__class__.__module__,
> self.__class__.__name__,
> " [closed]" if closed else "",
>
> --
> Repository URL: http://hg.python.org/cpython
>
> ___
> Python-checkins mailing list
> python-check...@python.org
> https://mail.python.org/mailman/listinfo/python-checkins
>
___
Python-Dev mailing list
Python-Dev@python.org
https://mail.python.org/mailman/listinfo/python-dev
Unsubscribe:
https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 13 Nov 2013 07:18, "Victor Stinner" wrote: > > Please tell me if you know sandbox projects for Python so I can > redirect users of pysandbox to a safer solution. I already know PyPy > sandbox. Sandboxing is hard enough (see also the many JVM vulnerabilities) that the only ones I even remotely trust are the platform level mechanisms that form the foundation of the various PaaS services, including SELinux and Linux containers. Cross platform? In process? Even Lua is hard to secure in that situation, and it has a much smaller attack surface than CPython or Java. Cheers, Nick. ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 11/12/2013 4:16 PM, Victor Stinner wrote: It would also be nice to help developers looking for a sandbox for their application. Please tell me if you know sandbox projects for Python so I can redirect users of pysandbox to a safer solution. I already know PyPy sandbox. There are several websites running submitted Python code (and in some cases, many other languages). ProjectEuler CodeAcademy (I think they use someone else's code box) CheckIO.org - python only other coding challenge sites I suspect they use sandboxed processes but have not seen anyone talk about what they are doing. -- Terry Jan Reedy ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
Python-dev is for the development of the Python core language, the CPython runtime, and libraries. Your sandbox, despite using and requiring deep knowledge of the runtime, is not developing those things. If you had a series of requests for the language or runtime that would make your job easier, then your thread would be on-topic. I replied off-list because I didn't want to contribute to the off-topic posting, but if posting on-list is required for you to pay attention, so be it. - Josiah On Nov 12, 2013 2:51 PM, "Victor Stinner" wrote: > 2013/11/12 Josiah Carlson : > > I'm replying off-list because I didn't want to bother the other folks in > > python-dev (also, your post might have been better on python-list, but I > > digress). > > I don't understand why you are writing to me directly. I won't reply > if you don't write publicly on python-dev. > > Summary of my email: it's not possible to write a sandbox in CPython. > So it's very specific to CPython internals. I'm not subscribed to > python-list. > > Victor > > > > > Long story short, I think that you are right, and I think that you are > > wrong. > > > > I think that you are right that your current pysandbox implementation is > > likely broken by design. You are starting from a completely working > Python > > runtime, then eliminating/hiding/blocking certain features. This makes > it a > > game of whack-a-mole, for every vulnerability you fix, a new one comes up > > later. The only way to fix this problem is to change your design. > > > > If you wanted to do it right, instead of removing things that are > > vulnerable, start by defining what is safe, and expose only those safe > > things. As an example, you did the right thing by splitting your main and > > subprocess into two pieces. But you don't need to serialize your objects > > from the trusted namespace to give access to the sandbox (that exposes > your > > "trusted" objects to the sandbox in a raw manner, in obvious preparation > for > > exploitation). Instead you would just expose a proxy object whose method > > calls/attribute references are made across your pipe (or socket, or > > whatever) to the trusted controlling process. Is it slower? Yes. Does it > > matter? Not if it keeps the sandbox secure. > > > > Now if you start by saying, "what is allowed?", the most obvious > destination > > is that you will more or less end up writing your own Python runtime. > That's > > not necessarily a bad thing, as if you know that a new runtime is your > > destination, you can look for a viable alternate-language runtime to > begin > > with to short-circuit your work. The best option that I can come up with > at > > this point is Javascript as a destination language, as there are several > > Python to Javascript compilers out there, Javascript is sandboxed by > design, > > and you can arbitrarily eliminate portions of the py->js compilation > > opportunities to eliminate attack vectors (specifically keeping only > those > > that you know won't lead to an attack). > > > > Another option is Lua, though I don't really know of any viable Python to > > Lua transpilers out there. > > > > Good luck with whatever you decide to do. > > > > Regards, > > - Josiah > > > > > > > > On Tue, Nov 12, 2013 at 1:16 PM, Victor Stinner < > victor.stin...@gmail.com> > > wrote: > >> > >> Hi, > >> > >> After having work during 3 years on a pysandbox project to sandbox > >> untrusted code, I now reached a point where I am convinced that > >> pysandbox is broken by design. Different developers tried to convinced > >> me before that pysandbox design is unsafe, but I had to experience it > >> myself to be convineced. > >> > >> It would also be nice to help developers looking for a sandbox for > >> their application. Please tell me if you know sandbox projects for > >> Python so I can redirect users of pysandbox to a safer solution. I > >> already know PyPy sandbox. > >> > >> I would like to share my experience because I know that other > >> developers are using sandboxes in production and that there is a real > >> need for sandboxing. > >> > >> > >> Origin of pysandbox > >> === > >> > >> In 2010, a developper called Tav wrote a sandbox called "safelite.py": > >> the sandbox hides sensitive attributes to separate a trusted namespace > >> and an untrusted namespace. Tav challenged Python core developers to > >> break his sandbox and... the sandbox was quickly broken. Even if it > >> was quickly broken, I was conviced that Tav found something > >> interesting and that there is a real need for sandboxing Python. I > >> continued his work by putting more protections on the untrusted > >> namespace. I published pysandbox 1.0 in june 2010. > >> > >> > >> History of pysandbox > >> > >> > >> pysandbox was used to build an IRC bot on a french Python channel. The > >> bot executed Python code in the sandbox. The bot was mainly used by > >> hackers to test the sandbox to try to find a vulnerability. It
Re: [Python-Dev] The pysandbox project is broken
2013/11/13 Josiah Carlson : > Python-dev is for the development of the Python core language, the CPython > runtime, and libraries. Your sandbox, despite using and requiring deep > knowledge of the runtime, is not developing those things. If you had a > series of requests for the language or runtime that would make your job > easier, then your thread would be on-topic. My initial goal was to put pysandbox directly into CPython when it would be considered safe and stable. The PEP 416 (frozendict) was a first step in this direction, but the PEP was rejected. I now gave up on sandboxing Python. I just would like to warn other core developers that trying to put a sandbox in Python is not a good idea :-) Victor ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
2013/11/13 Terry Reedy : > There are several websites running submitted Python code (and in some cases, > many other languages). > ProjectEuler > CodeAcademy (I think they use someone else's code box) > CheckIO.org - python only > other coding challenge sites > I suspect they use sandboxed processes but have not seen anyone talk about > what they are doing. It's probably a sandbox around the Python process, not inside the process. There is also http://shell.appspot.com/ which uses Google AppEngine. In my opinion, Google AppEngine doesn't use a sandbox in Python, but outside Python. Victor ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On Tue, Nov 12, 2013 at 3:53 PM, Victor Stinner wrote: > 2013/11/13 Terry Reedy : > > There are several websites running submitted Python code (and in some > cases, > > many other languages). > > ProjectEuler > > CodeAcademy (I think they use someone else's code box) > > CheckIO.org - python only > > other coding challenge sites > > I suspect they use sandboxed processes but have not seen anyone talk > about > > what they are doing. > I sure hope so. > > It's probably a sandbox around the Python process, not inside the process. > > There is also http://shell.appspot.com/ which uses Google AppEngine. > In my opinion, Google AppEngine doesn't use a sandbox in Python, but > outside Python. That's not just your opinion, it's a fact. -- --Guido van Rossum (python.org/~guido) ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On Wed, Nov 13, 2013 at 12:58:42AM +0100, Victor Stinner wrote: > I now gave up on sandboxing Python. I just would like to warn other > core developers that trying to put a sandbox in Python is not a good > idea :-) Do you mean CPython? Do you think it would be productive to create an independent Python compiler, designed with sandboxing in mind from the beginning? -- Steven ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 11/12/2013 4:11 PM, Steven D'Aprano wrote: On Wed, Nov 13, 2013 at 12:58:42AM +0100, Victor Stinner wrote: >I now gave up on sandboxing Python. I just would like to warn other >core developers that trying to put a sandbox in Python is not a good >idea:-) Do you mean CPython? Do you think it would be productive to create an independent Python compiler, designed with sandboxing in mind from the beginning? In reading this thread, which I took as an on-topic dismissal of an integrated CPython sandbox, I also wondered if it was a CPython implementation issue, or a language design issue. If it is an implementation issue, then perhaps a different implementation would help. Or perhaps a "safe compiler". If it is a language design issue, then a different implementation wouldn't help, it would require a new language, or a restricted subset. I'm not sure whether some of the onerous sounding restrictions result from language or implementation issues; some of them certainly sounded like implementation issues. A restricted subset, compiled by a validating compiler, might still be a useful language, even if the execution speed has to be reduced by a validating runtime. Perhaps exception handling for exceptions hit inside a sandbox need to stop at the sandbox boundary. That is, exceptions within the sandbox stay within the sandbox, and exceptions generated due to sandbox calls to the implementation need to stay outside the sandbox, and then sanitized and limited information passed back in to the sandbox. Perhaps a different/restricted set of builtins must be provided within the sandbox. These ideas may perhaps still allow a CPython sandbox to be written, or may only help a new implementation. Is there technology in the smartphone OSes that could be applied? iOS seems to not even provide a file system to its apps, and there is limited sharing of data from one app to the next. Android provides an explicit subset of system services to its apps. Thanks, Victor, for the update on your sandbox efforts. I was hoping you would be successful, and then I was wondering if you had abandoned the effort, and now I know what the current status is. ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
Am 13.11.2013 01:47, schrieb Glenn Linderman: > If it is an implementation issue, then perhaps a different > implementation would help. Or perhaps a "safe compiler". > > If it is a language design issue, then a different implementation > wouldn't help, it would require a new language, or a restricted subset. > I'm not sure whether some of the onerous sounding restrictions result > from language or implementation issues; some of them certainly sounded > like implementation issues. > > A restricted subset, compiled by a validating compiler, might still be a > useful language, even if the execution speed has to be reduced by a > validating runtime. A limited and well-defined subset of Python may do the trick, perhaps a project based on RPython. Zope has a long history of restricted Python code with safe-guards and security proxies. Any project must start with a proper threat model and goals. Does sandboxed code need to access frame objects and use compile()? Could we perhaps use a limited subinterpreters with reduced / modified builtins to archive isolation? CPython still has a couple of crashers, too. These must be resolved. You don't want sandboxed code to generate a segfault, do you? > Is there technology in the smartphone OSes that could be applied? iOS > seems to not even provide a file system to its apps, and there is > limited sharing of data from one app to the next. Android provides an > explicit subset of system services to its apps. On Linux seccomp may be a feasible way to prevent syscalls. Seccomp basically can limit the capability of a thread so it can no longer do certain syscalls. Chrome uses it for sandboxing. Christian ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 11/12/13 6:48 PM, Terry Reedy wrote: On 11/12/2013 4:16 PM, Victor Stinner wrote: It would also be nice to help developers looking for a sandbox for their application. Please tell me if you know sandbox projects for Python so I can redirect users of pysandbox to a safer solution. I already know PyPy sandbox. There are several websites running submitted Python code (and in some cases, many other languages). ProjectEuler CodeAcademy (I think they use someone else's code box) CheckIO.org - python only other coding challenge sites I suspect they use sandboxed processes but have not seen anyone talk about what they are doing. At edX, we use CodeJail to apply OS-level sandboxing to untrusted Python code: https://github.com/edx/codejail --Ned. ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 13 Nov 2013 13:44, "Ned Batchelder" wrote: > > On 11/12/13 6:48 PM, Terry Reedy wrote: >> >> On 11/12/2013 4:16 PM, Victor Stinner wrote: >> >>> It would also be nice to help developers looking for a sandbox for >>> their application. Please tell me if you know sandbox projects for >>> Python so I can redirect users of pysandbox to a safer solution. I >>> already know PyPy sandbox. >> >> >> There are several websites running submitted Python code (and in some cases, many other languages). >> ProjectEuler >> CodeAcademy (I think they use someone else's code box) >> CheckIO.org - python only >> other coding challenge sites >> I suspect they use sandboxed processes but have not seen anyone talk about what they are doing. >> > > At edX, we use CodeJail to apply OS-level sandboxing to untrusted Python code: https://github.com/edx/codejail A couple of years ago at PyCon AU, Tim Dawborn went over the sandboxing approach used for the National Computer Science School infrastructure: http://m.youtube.com/watch?v=y-WPPdhTKBU&feature=plpp&p=PLpKCScKXUAmerE_uUsImVlPsmhLaYQuQy Cheers, Nick. > > --Ned. > > ___ > Python-Dev mailing list > Python-Dev@python.org > https://mail.python.org/mailman/listinfo/python-dev > Unsubscribe: https://mail.python.org/mailman/options/python-dev/ncoghlan%40gmail.com ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 13 Nov 2013 12:11, "Christian Heimes" wrote: > > Am 13.11.2013 01:47, schrieb Glenn Linderman: > > If it is an implementation issue, then perhaps a different > > implementation would help. Or perhaps a "safe compiler". > > > > If it is a language design issue, then a different implementation > > wouldn't help, it would require a new language, or a restricted subset. > > I'm not sure whether some of the onerous sounding restrictions result > > from language or implementation issues; some of them certainly sounded > > like implementation issues. > > > > A restricted subset, compiled by a validating compiler, might still be a > > useful language, even if the execution speed has to be reduced by a > > validating runtime. > > A limited and well-defined subset of Python may do the trick, perhaps a > project based on RPython. Zope has a long history of restricted Python > code with safe-guards and security proxies. Any project must start with > a proper threat model and goals. Does sandboxed code need to access > frame objects and use compile()? Could we perhaps use a limited > subinterpreters with reduced / modified builtins to archive isolation? Brett Cannon also spent some time exploring exploring the idea of a security capability based model for a Python implementation. > CPython still has a couple of crashers, too. These must be resolved. You > don't want sandboxed code to generate a segfault, do you? Indeed - it would be interesting to see if any of those have been resolved by the various edge case fixes in recent months. > > Is there technology in the smartphone OSes that could be applied? iOS > > seems to not even provide a file system to its apps, and there is > > limited sharing of data from one app to the next. Android provides an > > explicit subset of system services to its apps. > > On Linux seccomp may be a feasible way to prevent syscalls. Seccomp > basically can limit the capability of a thread so it can no longer do > certain syscalls. Chrome uses it for sandboxing. Yeah, there's a reason our standard answer to "How do I sandbox Python code?" has been "Use a subprocess and the OS provided process sandboxing facilities" for quite some time. Sandboxing software *at all* is difficult, doing it cross-platform is even harder. Cheers, Nick. > > Christian > ___ > Python-Dev mailing list > Python-Dev@python.org > https://mail.python.org/mailman/listinfo/python-dev > Unsubscribe: https://mail.python.org/mailman/options/python-dev/ncoghlan%40gmail.com ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On 13 Nov 2013 09:56, "Josiah Carlson" wrote: > > Python-dev is for the development of the Python core language, the CPython runtime, and libraries. Your sandbox, despite using and requiring deep knowledge of the runtime, is not developing those things. If you had a series of requests for the language or runtime that would make your job easier, then your thread would be on-topic. While it may seem off-topic at first glance, pysandbox started out as Victor's attempt to prove those of us that were saying this wouldn't work wrong when he proposed replacing the long dead rexec and Bastion with something more robust. I actually applaud his decision to post his final conclusion to the list, even though it wasn't the outcome he was hoping for. Negative data is still data :) Cheers, Nick. > > I replied off-list because I didn't want to contribute to the off-topic posting, but if posting on-list is required for you to pay attention, so be it. > > - Josiah > > On Nov 12, 2013 2:51 PM, "Victor Stinner" wrote: >> >> 2013/11/12 Josiah Carlson : >> > I'm replying off-list because I didn't want to bother the other folks in >> > python-dev (also, your post might have been better on python-list, but I >> > digress). >> >> I don't understand why you are writing to me directly. I won't reply >> if you don't write publicly on python-dev. >> >> Summary of my email: it's not possible to write a sandbox in CPython. >> So it's very specific to CPython internals. I'm not subscribed to >> python-list. >> >> Victor >> >> > >> > Long story short, I think that you are right, and I think that you are >> > wrong. >> > >> > I think that you are right that your current pysandbox implementation is >> > likely broken by design. You are starting from a completely working Python >> > runtime, then eliminating/hiding/blocking certain features. This makes it a >> > game of whack-a-mole, for every vulnerability you fix, a new one comes up >> > later. The only way to fix this problem is to change your design. >> > >> > If you wanted to do it right, instead of removing things that are >> > vulnerable, start by defining what is safe, and expose only those safe >> > things. As an example, you did the right thing by splitting your main and >> > subprocess into two pieces. But you don't need to serialize your objects >> > from the trusted namespace to give access to the sandbox (that exposes your >> > "trusted" objects to the sandbox in a raw manner, in obvious preparation for >> > exploitation). Instead you would just expose a proxy object whose method >> > calls/attribute references are made across your pipe (or socket, or >> > whatever) to the trusted controlling process. Is it slower? Yes. Does it >> > matter? Not if it keeps the sandbox secure. >> > >> > Now if you start by saying, "what is allowed?", the most obvious destination >> > is that you will more or less end up writing your own Python runtime. That's >> > not necessarily a bad thing, as if you know that a new runtime is your >> > destination, you can look for a viable alternate-language runtime to begin >> > with to short-circuit your work. The best option that I can come up with at >> > this point is Javascript as a destination language, as there are several >> > Python to Javascript compilers out there, Javascript is sandboxed by design, >> > and you can arbitrarily eliminate portions of the py->js compilation >> > opportunities to eliminate attack vectors (specifically keeping only those >> > that you know won't lead to an attack). >> > >> > Another option is Lua, though I don't really know of any viable Python to >> > Lua transpilers out there. >> > >> > Good luck with whatever you decide to do. >> > >> > Regards, >> > - Josiah >> >> > >> > >> > >> > On Tue, Nov 12, 2013 at 1:16 PM, Victor Stinner < victor.stin...@gmail.com> >> > wrote: >> >> >> >> Hi, >> >> >> >> After having work during 3 years on a pysandbox project to sandbox >> >> untrusted code, I now reached a point where I am convinced that >> >> pysandbox is broken by design. Different developers tried to convinced >> >> me before that pysandbox design is unsafe, but I had to experience it >> >> myself to be convineced. >> >> >> >> It would also be nice to help developers looking for a sandbox for >> >> their application. Please tell me if you know sandbox projects for >> >> Python so I can redirect users of pysandbox to a safer solution. I >> >> already know PyPy sandbox. >> >> >> >> I would like to share my experience because I know that other >> >> developers are using sandboxes in production and that there is a real >> >> need for sandboxing. >> >> >> >> >> >> Origin of pysandbox >> >> === >> >> >> >> In 2010, a developper called Tav wrote a sandbox called "safelite.py": >> >> the sandbox hides sensitive attributes to separate a trusted namespace >> >> and an untrusted namespace. Tav challenged Python core developers to >> >> break his sandbox and... the sandbox was quickly broken. Even if it >> >
Re: [Python-Dev] The pysandbox project is broken
Am 13.11.2013 00:49, schrieb Josiah Carlson: > Python-dev is for the development of the Python core language, the CPython > runtime, and libraries. Your sandbox, despite using and requiring deep > knowledge > of the runtime, is not developing those things. If you had a series of > requests > for the language or runtime that would make your job easier, then your thread > would be on-topic. Can we please exempt core committers from these misdemeanor notices? Thanks, Georg ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
Re: [Python-Dev] The pysandbox project is broken
On Wed, Nov 13, 2013 at 2:11 AM, Steven D'Aprano wrote: > On Wed, Nov 13, 2013 at 12:58:42AM +0100, Victor Stinner wrote: > >> I now gave up on sandboxing Python. I just would like to warn other >> core developers that trying to put a sandbox in Python is not a good >> idea :-) > > Do you mean CPython? > > Do you think it would be productive to create an independent Python > compiler, designed with sandboxing in mind from the beginning? PyPy sandbox does work FYI It might not do exactly what you want, but it both provides a full python and security. Cheers, fijal ___ Python-Dev mailing list Python-Dev@python.org https://mail.python.org/mailman/listinfo/python-dev Unsubscribe: https://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com
