Path: csiph.com!fu-berlin.de!uni-berlin.de!not-for-mail
From: Random832 <random832@fastmail.com>
Newsgroups: comp.lang.python
Subject: Re: Untrusted code execution
Date: Wed, 06 Apr 2016 09:14:56 -0400
Lines: 36
Message-ID: <mailman.129.1459948499.32530.python-list@python.org>
References: <slrnng31v9.19u.jon+usenet@wintry.unequivocal.co.uk> <slrnng7gj4.19u.jon+usenet@wintry.unequivocal.co.uk> <58de161a-ecdb-4ada-aab5-871876ea1574@googlegroups.com> <slrnng7tgu.19u.jon+usenet@wintry.unequivocal.co.uk> <CAPTjJmrHWFHY5CdUBj_GYRCgnAWjAJ0mvtTj0_wC8O8rfzwZFA@mail.gmail.com> <mailman.84.1459878492.32530.python-list@python.org> <570469d7$0$1598$c3e8da3$5496439d@news.astraweb.com> <1459948496.786520.570667177.4C7E8044@webmail.messagingengine.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
In-Reply-To: <570469d7$0$1598$c3e8da3$5496439d@news.astraweb.com>
Precedence: list
Xref: csiph.com comp.lang.python:106572

On Tue, Apr 5, 2016, at 21:43, Steven D'Aprano wrote:
> As Zooko says, Guido's "best argument is that reducing usability (in
> terms
> of forbidding language features, especially module import) and reducing
> the
> usefulness of extant library code" would make the resulting interpreter
> too
> feeble to be useful.

You don't have to forbid module import. The sandbox could control what
modules can be loaded, and what happens when you try to load a module.

import sys
module = type(sys)
fm = {}

def fimp(name, *etc):
    # In a real implementation, this could also load whitelisted modules
    try:
        return fm[name]
    except KeyError:
        raise ImportError("Tried to load restricted module " + name)

fm['builtins'] = fb = module('builtins')
fb.int = int
fb.str = str
fb.len = len
fb.print = print
fb.__import__ = fimp
fm['sys'] = fsys = module('sys')
fsys.modules = fm

exec("""
import sys
print(sys.modules.keys())
""", {'__builtins__': fb})