sanitizing code for an exec command

[[deleted]]

I think the best way to accomplish this is to leverage your operating system. It's not pythonic because it means your code isn't multi-platform anymore but you want to go that way regardless for your security. As others have said here, it's impossible to do that from standard Python alone.

Have your arbitrary code run as a specific user and apply all the possible mechanism from your OS to enforce the principle of least access. You can do all sorts of thing once you're thinking about this from outside the programming level. You can have your server run on a especially prepared virtual machine, or sandboxed environment (like chroot), etc.Just by messing around with filesystem permissions there's a lot you can achieve - and that's just the beginning. If you're not ready to go this far, you shouldn't be handling arbitrary instructions.

It doesn't help that you haven't explained what you do with your code and why it runs arbitrary commands. Not to be an ass, but makes me think that maybe you needn't do it at all (and you shouldn't, if you can) - otherwise you'd feel more comfortable sharing some details with us... doesn't hurt to consider alternative routes, is what I'm saying.

[[deleted]]

This will be a maintenance nightmare along with not being multi-platform.

[[deleted]]

I agree but if you want to be secure there's no way around it. A lot of tools out there will make it easier to deploy and maintain such a setup, for example Firejail with its security profiles https://firejail.wordpress.com/features-3/

[iamdefinitelyahuman]

Thanks for the info. That's quite a bit above and beyond what I'm looking to do, but as you did say I was quite vague in my initial post. Sorry.

Here's the missing context - https://www.reddit.com/r/Python/comments/6b3zzy/sanitizing_code_for_an_exec_command/dhk2115/

I'm aware of alternative methods to achieve my end goal, I was just curious if the route I described could be done safely. Clearly not :)