2

I would like to set up an app that allows users to send their code and execute it on my server. The thought of running untrusted code makes me cringe, so I am trying to set up an exhaustive list of security threats that should be addressed.

I am assuming I should strip down certain features of the language executed, like file access or (maybe) networking. I also come across terms like sandboxing or chroot. I know what they mean, but how should I actually use them?

In short: What security threats should I address before allowing users to run their code on my machine, and how do I do it?

4
  • 2
    Basically, if someone can run arbitary code on your server, it's not, in fact, your server anymore. Nov 2, 2012 at 10:23
  • @MichaelBorgwardt: as long as the arbitrary code doesn't have full access to the server's resources, I'd argue otherwise.
    – tdammers
    Nov 2, 2012 at 10:32
  • 1
    @tdammers: privilege escalation vulnerabilities are so numerous that I wouldn't put too much faith in anything below full virtualization. Nov 2, 2012 at 10:41
  • possible cross site duplicate of: stackoverflow.com/questions/792764/…. Aug 5, 2014 at 21:46

1 Answer 1

6

The most important concerns include:

  • System resources (DoS). If you allow arbitrary code execution on your systems, then it is easy to deplete system resources on that machine, on purpose or by accident. Writing code that fills the entire hdd with garbage is easy, preventing it without severely crippling the system is much harder. The same goes for other system resources, such as CPU cycles, RAM, network bandwidth, etc.
  • Data breaches. If other users are on the same server, and an attacker manages to read their data, you have a problem. If that data is confidential, you have an elephant-sized problem.
  • Network integrity. Allowing arbitrary code execution means users can initiate and accept network connections from your server, and depending on your network configuration, this may allow them to access things inside your network that aren't supposed to be reachable from the outside.
  • Illegal activity. A server that allows arbitrary code is an invitation for shady things: your machine could be used to store offending data, hide communication, or, more likely, perform attacks on other targets.

IMO, the easiest way to defend against these and mitigate the risks is by using virtual machines: give each user a dedicated VM with a stripped-down OS and no root access; lock down network access (ideally, the machine accepts incoming ssh connections and nothing else, and cannot initiate any outgoing connections - if you have to allow anything else, keep it as restrictive as possible), limit host resource usage, and regularly restore the machine to a blank state. Additionally, you may want to monitor VM activity from the outside.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.