Creating a secure environment for untrusted python code

Question

I'm writing an application where we need to execute untrusted python code. (i.e. an application similar to a homework submission server, where student input is untrusted)

Thinking about it, my first thought is that by disabling the file I/O capabilities of the language (and thus, restrict code to using stdin/stdout only), a program couldn't do much harm to the system.

Is this correct, or are there attack vectors that I haven't thought of?

Is there some kind of python flag or compiler option that I can pass to isolate the code?

Years ago there was a try to implement such an environment as part of standard library. It was abandoned because it seems that even the Python developers were unable to make it really secure. See docs.python.org/2/library/rexec.html — Michael Butscher
– Michael Butscher, Commented Oct 31, 2018 at 3:38
Does this answer your question? How can I sandbox Python in pure Python? — ggorlen
– ggorlen, Commented Jan 8, 2024 at 1:59

Horkrine · Accepted Answer · 2018-10-31 10:35:46Z

8

Run them in docker containers!

As with anything about security, there is no silver bullet. Your mileage may vary.

edited Oct 31, 2018 at 10:35

Horkrine

1,42713 silver badges24 bronze badges

answered Oct 31, 2018 at 3:52

Charles Landau

4,2751 gold badge13 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Dani G · Accepted Answer · 2018-11-01 04:27:09Z

2

I wouldn't execute arbitrary code on your machine using any of the python sandboxing methods since security professional demonstrated several time how they are escapable. Escaping the python sandbox

I would suggest running the code inside a docker container with a new user with restricted permissions.

Hardening Linux Containers

Lastly, you can try to parse the python code into an AST and go down the levels to make sure that dangerous actions are not present.

My choice would be using a docker container, preferably an Alpine version with restricted access.

answered Nov 1, 2018 at 4:27

Dani G

1,2409 silver badges16 bronze badges

Comments

Mohammad Ahtasham · Accepted Answer · 2022-10-27 06:55:18Z

0

You might want to take a look at https://github.com/openedx/codejail. This package is also available on PyPI and is used and maintained by tech giants like Open edX and AWS

answered Oct 27, 2022 at 6:55

Mohammad Ahtasham

212 bronze badges

Collectives™ on Stack Overflow

Creating a secure environment for untrusted python code

3 Answers 3

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related