I've been working on a personal project in C# that allows the user to execute scripts written by other users and restrict the permissions of that script. I can use .NET Code Access Security mechanisms to sandbox user scripts and make sure that they have only those permissions that the user wants to give them.

Broadly speaking, my security requirements are:

• the user should be able to restrict the untrusted script's access to only certain parts of the filesystem, including forbidding all filesystem access
• the user should be able to restrict the untrusted script's network connections to only certain IP addresses or hostnames, including forbidding all network connections
• it is okay if the user script manages to hang or terminate the host application, but the user script must not be able to circumvent the permission restrictions (i.e. denial of service is okay, breach isn't)

I'm contemplating trying to do something similar in C++, as a sort of a personal exercise. Obviously, things are more complicated when running native code directly, even if the user scripts are written in a scripting language like Lua.

The first approach I can think of is to insert my own hooks in the scripting environments standard library functions. For example, if the scripting language is Lua, instead of exposing io.open normally, I would have to expose a wrapper that checked the arguments against the script's permissions before passing them to the original implementation.

My concern with this approach is that it drastically increases the amount of my own code that is in charge of security and, therefore, a potential security vulnerability that I wrote myself. In other words, when working with .NET CAS, I can trust that Microsoft did its job well in the sandboxing code, as opposed to having to trust my own sandboxing code.

Are there any alternatives I'm unaware of?

I've been working on a personal project in C# whose purpose is more or less to allow the user to execute scripts written by other users and restrict the permissions of that script. My program compiles the scripts using a third-party library, sandboxes them using the .NET Code Access Security mechanisms and makes sure that they have only those permissions that the user wants to give them.

Broadly speaking, my security requirements are:

• the user should be able to restrict the untrusted script's access to only certain parts of the filesystem, including forbidding all filesystem access
• the user should be able to restrict the untrusted script's network connections to only certain IP addresses or hostnames, including forbidding all network connections
• it is okay if the user script manages to hang or terminate the host application, but the user script must not be able to circumvent the permission restrictions (i.e. denial of service is okay, breach isn't)

I'm contemplating trying to do something similar in C++, as a sort of a personal exercise. Obviously, things are more complicated when running native code directly, even if the user scripts are written in a scripting language like Lua.

The first approach I can think of is to insert my own hooks in the scripting environments standard library functions. For example, if the scripting language is Lua, instead of exposing io.open normally, I would have to expose a wrapper that checked the arguments against the script's permissions before passing them to the original implementation.

My concern with this approach is that it drastically increases the amount of my own code that is in charge of security and, therefore, a potential security vulnerability that I wrote myself. In other words, when working with .NET CAS, I can trust that Microsoft did its job well in the sandboxing code, as opposed to having to trust my own sandboxing code.

Are there any alternatives I'm unaware of?