1

I have a program that can get code from a user as input (This question is language-agnostic, though I am primarily interested in answers for Java and Python). Usually, this code is going to be useful, but I don't have a guarantee that the user isn't making a mistake, or even deliberately giving malicious code.

I want to be able to execute this code safely, i.e. without harmful side effects if it turns out to be faulty or malicious.

More specifically:

  • the user specifies that the input code should operate on some objects that exist in the primary program (the program that gets the code from the user and executes it). Optimally, it should be able to access these objects directly, but sending them over to the child program through some communication protocol or a file is also fine.

  • in the same way, the code should generate some output that is transmitted back to the parent program.

  • the user can specify whether the code should be allowed to access any other data, whether it should be allowed to read or write to files, and whether it should have access to any other interfaces or OS methods.

  • it is possible to specify a maximum runtime after which the code will be interrupted if it hasn't finished executing yet.

  • the parent program and the code to execute may be different languages. You can assume that the programs necessary to compile and execute the given code are installed and available to the parent program. If the languages are different assume that some standard format like JSON can be used for transmitting the data (or is there a way to do this more efficiently?)

I think that this should be doable with a Virtual Machine. However, speed is a concern and I want to be able to execute many code blocks quickly, so that creating and tearing down a VM for each of them may be prohibitively expensive.

Another option is creating a sandbox, which e.g. Java can do, but as far as I am aware only for executing other Java code. I am unable to find a solution to do this with arbitrary languages.

For which languages does this work well, for which is it difficult?

Is this easier on some OS than on others?

Improve this question
2
  • Your specification doesn't seem very clear to me. It seems that you do want the untrusted code to be able to operate on long-lived data structures and files. But how do you define malicious code, then? Let alone hindering it from doing its evil. Locking down what the user-supplied code is able to do might be possible but the restriction will apply to all code, then. Malicious or not.
    – 5gon12eder
    Commented Jun 19, 2017 at 0:47
  • the code should be allowed to do whatever it wants with the files it is provided, but only with those files. It should not be able to break out and alter any other files.
    – Florian Dietz
    Commented Jun 19, 2017 at 19:00

1 Answer 1

Reset to default
3

As you point out, the Java Virtual Machine is capable of sand boxing. Note that this applies not only to programs written in Java but in programs written in any language for which there is a JVM implementation available.

Fortunately for your use case, they is a JVM-based implementation of Python, Jython. As long as the python code you want to execute is compatible with Jython, you can use that in a JVM sand box and all should be OK.

Failing that, if you're working on a Unix-like system, you can use a chroot jail isolate a python process (or any other language) from your system.

You should be aware that both of these approaches rely on the security of complex systems that will have flaws. In particular, you should productively monitor your systems for signs of exploitation and ensure all patches are installed promptly.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.