Mercurial > cpython-lru_cache-weakref

annotate Doc/librestricted.tex @ 5817:48b94de85bf3 legacy-trunk

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Extensive changes by AMK.
author Guido van Rossum <guido@python.org>
date Thu, 17 Jul 1997 16:29:42 +0000
parents ae75d4a1f5dd
children 621440bb98b9
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
1 \chapter{Restricted Execution}
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
2
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
3 In general, Python programs have complete access to the underlying
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
4 operating system throug the various functions and classes, For
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
5 example, a Python program can open any file for reading and writing by
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
6 using the \code{open()} built-in function (provided the underlying OS
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
7 gives you permission!). This is exactly what you want for most
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
8 applications.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
9
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
10 There exists a class of applications for which this ``openness'' is
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
11 inappropriate. Take Grail: a web browser that accepts ``applets'',
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
12 snippets of Python code, from anywhere on the Internet for execution
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
13 on the local system. This can be used to improve the user interface
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
14 of forms, for instance. Since the originator of the code is unknown,
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
15 it is obvious that it cannot be trusted with the full resources of the
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
16 local machine.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
17
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
18 \emph{Restricted execution} is the basic framework in Python that allows
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
19 for the segregation of trusted and untrusted code. It is based on the
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
20 notion that trusted Python code (a \emph{supervisor}) can create a
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
21 ``padded cell' (or environment) with limited permissions, and run the
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
22 untrusted code within this cell. The untrusted code cannot break out
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
23 of its cell, and can only interact with sensitive system resources
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
24 through interfaces defined and managed by the trusted code. The term
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
25 ``restricted execution'' is favored over ``safe-Python''
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
26 since true safety is hard to define, and is determined by the way the
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
27 restricted environment is created. Note that the restricted
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
28 environments can be nested, with inner cells creating subcells of
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
29 lesser, but never greater, privilege.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
30
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
31 An interesting aspect of Python's restricted execution model is that
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
32 the interfaces presented to untrusted code usually have the same names
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
33 as those presented to trusted code. Therefore no special interfaces
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
34 need to be learned to write code designed to run in a restricted
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
35 environment. And because the exact nature of the padded cell is
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
36 determined by the supervisor, different restrictions can be imposed,
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
37 depending on the application. For example, it might be deemed
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
38 ``safe'' for untrusted code to read any file within a specified
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
39 directory, but never to write a file. In this case, the supervisor
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
40 may redefine the built-in
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
41 \code{open()} function so that it raises an exception whenever the
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
42 \var{mode} parameter is \code{'w'}. It might also perform a
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
43 \code{chroot()}-like operation on the \var{filename} parameter, such
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
44 that root is always relative to some safe ``sandbox'' area of the
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
45 filesystem. In this case, the untrusted code would still see an
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
46 built-in \code{open()} function in its environment, with the same
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
47 calling interface. The semantics would be identical too, with
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
48 \code{IOError}s being raised when the supervisor determined that an
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
49 unallowable parameter is being used.
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
50
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
51 The Python run-time determines whether a particular code block is
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
52 executing in restricted execution mode based on the identity of the
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
53 \code{__builtins__} object in its global variables: if this is (the
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
54 dictionary of) the standard \code{__builtin__} module, the code is
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
55 deemed to be unrestricted, else it is deemed to be restricted.
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
56
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
57 Python code executing in restricted mode faces a number of limitations
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
58 that are designed to prevent it from escaping from the padded cell.
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
59 For instance, the function object attribute \code{func_globals} and the
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
60 class and instance object attribute \code{__dict__} are unavailable.
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
61
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
62 Two modules provide the framework for setting up restricted execution
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
63 environments:
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
64
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
65 \begin{description}
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
66
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
67 \item[rexec]
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
68 --- Basic restricted execution framework.
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
69
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
70 \item[Bastion]
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
71 --- Providing restricted access to objects.
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
72
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
73 \end{description}