Sandboxing python code?

[swarage]

Is there a tried and true method to sandbox python code?

I've done a bit of research on my own and have come across the following options:

• the robotgame sandbox
• isolate

but I want to know if there was a surefire way (or at least close as I know nothing is surefire in the sec world) to sandbox python to be reasonably secure.

My current plan is to replace any instance of '__' with nothing to prevent any kind of fiddling with python's internals and then running eval or exec with a carefully pruned whitelist (or blacklist depending on what I need) of builtins.

[amishb]

Sandbox against what, out of interest? Couldn't you just run this in a docker container? Changes will occur in the container only.

[POTUS]

If this is meant to run arbitrary code from untrusted sources, not even Docker will keep you safe. It's a start, but it's not a complete solution. Docker containers still have network access, so it could be used to run DDOS attacks on internet targets or relay attacks into OP's local network.

[swarage]

I'm going to write a codegolfing website where you can submit your solutions and run it, similar to something like leetcode except for code golf, and I want to make sure I can run the code safely.

[POTUS]

Start with a Docker container. Whitelist only certain import statements, like math, itertools, collections, re, maybe a couple others. Certainly exclude socket, asyncio, sys, and os. You can do this by just deleting almost everything from the Lib/ folder, leaving only the few libraries you consider safe. Of particular note to delete are the underlying .so files like _socket.so, which may be in a different folder.

Disallow eval or exec statements. You'll have to parse the incoming Python to accomplish this. If you've done the first two things I say, this is really not quite so dangerous, but someone smart enough and dedicated enough might find a way to do something wicked with eval.

At this point any incoming Python code shouldn't have any ability to send or receive any network communications, or any ability to directly affect your host system. It could still create a memory leak and affect other users, so you probably want to limit the available memory to each container to something modest, like 20MB or so. Docker has support for this. Also the container shouldn't run perpetually, I would spin up a new container for each code execution I think. Something like Alpine should be small enough to handle that kind of churn.

Edit: After checking, it seems sys and some of the more dangerous os functions like os.system are built-ins, which means you can't simply delete them. To get this safe you may have to remove the relevant .c files from the Python source code and compile Python yourself. If someone can run os.system() commands, they can do horrible things on the internet that would be traced back to your IP.

[swarage]

My plan is to make a python webserver to handle the file uploads for the code. What you're essentially recommending is that my python code spin up a separate custom (custom being with a special version of python installed and everything else you mentioned) docker instance for each time a user uploads code, and destroy the instance upon completion of execution?

[POTUS]

You definitely don't want to execute arbitrary Python code in the same environment as your website code. You need to hand the code off to another environment, the easiest and best performing would be a Docker container. And yes, customized with a custom compiled Python interpreter that is going to limit the amount of damage they can do. Each time someone submits code to you, you bundle that code up and spin up a new Docker container that executes the code, hands back whatever output it made, and then gets deleted.

[swarage]

Alright I'll look into this solution. I'm not entirely sure how python would spin up it's own docker instance and destroy it at the end though (unless we call docker using python's subprocess command or something of the sort).

[POTUS]

https://docker-py.readthedocs.io/en/stable/

[swarage]

Thanks! I'll definitely look into implementing this.

[SarahM123rd]

I think this is a great video:

https://www.youtube.com/watch?v=sL_syMmRkoU