Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!1.eu.feeder.erje.net!lightspeed.eweka.nl!lightspeed.eweka.nl!newsfeed.xs4all.nl!newsfeed3.news.xs4all.nl!xs4all!post.news.xs4all.nl!not-for-mail
Return-Path: <python-python-list@m.gmane.org>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.000
X-Spam-Evidence: '*H*': 1.00; '*S*': 0.00; 'python,': 0.02; 'url:pypi': 0.03; 'api.': 0.04; 'subject:Python': 0.05; 'nicely': 0.07; 'attempted': 0.09; 'objects.': 0.09; 'received:80.91': 0.09; 'received:80.91.229': 0.09; 'received:gmane.org': 0.09; 'received:list': 0.09; 'runtime': 0.09; 'python': 0.11; 'from:addr:behnel.de': 0.16; 'from:addr:stefan_ml': 0.16; 'from:name:stefan behnel': 0.16; 'lookups.': 0.16; 'received:80.91.229.3': 0.16; 'received:plane.gmane.org': 0.16; 'attribute': 0.18; 'stefan': 0.18; 'language': 0.19; 'library': 0.20; '(or': 0.21; 'so.': 0.22; 'oriented': 0.22; "i've": 0.24; 'header:In-Reply-To:1': 0.24; 'script': 0.25; 'header:User- Agent:1': 0.26; 'header:X-Complaints-To:1': 0.26; 'small,': 0.27; "doesn't": 0.28; 'this.': 0.28; 'embed': 0.29; "i'd": 0.31; 'code': 0.31; 'anyone': 0.32; '[1]': 0.32; 'url:python': 0.33; 'lets': 0.33; 'add': 0.34; 'gives': 0.35; 'to:addr:python-list': 0.35; 'really': 0.35; 'list': 0.35; 'but': 0.36; 'url:org': 0.36; 'quite': 0.37; 'subject:: ': 0.37; 'level': 0.37; 'received:org': 0.38; 'application': 0.39; 'to:addr:python.org': 0.39; 'easily': 0.39; 'received:de': 0.40; 'some': 0.40; 'your': 0.60; 'even': 0.61; 'hear': 0.62; 'email addr:gmail.com': 0.64; 'whitelist': 0.84; 'approach.': 0.91; 'serious': 0.97
X-Injected-Via-Gmane: http://gmane.org/
To: python-list@python.org
From: Stefan Behnel <stefan_ml@behnel.de>
Subject: Re: Creating a reliable sandboxed Python environment
Date: Thu, 28 May 2015 20:41:05 +0200
References: <60b424a2-2273-42b2-b60c-92656af0afa5@googlegroups.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-Gmane-NNTP-Posting-Host: dslb-088-067-186-115.088.067.pools.vodafone-ip.de
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.6.0
In-Reply-To: <60b424a2-2273-42b2-b60c-92656af0afa5@googlegroups.com>
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.20+
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.138.1432838475.5151.python-list@python.org>
Lines: 20
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1432838475 news.xs4all.nl 2935 [2001:888:2000:d::a6]:47041
X-Complaints-To: abuse@xs4all.nl
X-Received-Bytes: 3979
X-Received-Body-CRC: 2340490301
Xref: csiph.com comp.lang.python:91381

davidfstr@gmail.com schrieb am 26.05.2015 um 04:24:
> Has anyone on this list attempted to sandbox Python programs in a
> serious fashion? I'd be interested to hear your approach.

Not quite sandboxing Python, but I've seen people use my Lupa [1] library
for this. They're writing all their code in Python, and then let users
embed their own Lua code into it to script their API. The Lua runtime is
apparently quite good at sandboxing, and it's really small, just some 600KB
or so. Lupa then lets you easily control the access to your Python code at
a whitelist level by intercepting all Python attribute lookups.

It doesn't add much to your application to embed Lua (or even LuaJIT) in
Python, and it gives users a nicely object oriented language to call and
orchestrate your Python objects.

Stefan


[1] https://pypi.python.org/pypi/lupa