Mercurial > cpython-lru_cache-weakref

annotate Doc/lib/librestricted.tex @ 25838:8540887bcec6 2.2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Backport of 2.183: Fix memory leak in add_subclass() found by NealN with valgrind.
author Guido van Rossum <guido@python.org>
date Fri, 18 Oct 2002 13:42:21 +0000
parents 873d584c1221
children c5e9655ebed7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
10726
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
1 \chapter{Restricted Execution \label{restricted}}
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
2
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
3 In general, Python programs have complete access to the underlying
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
4 operating system throug the various functions and classes, For
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
5 example, a Python program can open any file for reading and writing by
10726
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
6 using the \function{open()} built-in function (provided the underlying
18574
346dcafc878b Minor changes to match the style guide.
Fred Drake <fdrake@acm.org>
parents: 10726
diff changeset
7 operating system gives you permission!). This is exactly what you want
346dcafc878b Minor changes to match the style guide.
Fred Drake <fdrake@acm.org>
parents: 10726
diff changeset
8 for most applications.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
9
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
10 There exists a class of applications for which this ``openness'' is
18574
346dcafc878b Minor changes to match the style guide.
Fred Drake <fdrake@acm.org>
parents: 10726
diff changeset
11 inappropriate. Take Grail: a Web browser that accepts ``applets,''
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
12 snippets of Python code, from anywhere on the Internet for execution
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
13 on the local system. This can be used to improve the user interface
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
14 of forms, for instance. Since the originator of the code is unknown,
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
15 it is obvious that it cannot be trusted with the full resources of the
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
16 local machine.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
17
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
18 \emph{Restricted execution} is the basic framework in Python that allows
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
19 for the segregation of trusted and untrusted code. It is based on the
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
20 notion that trusted Python code (a \emph{supervisor}) can create a
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
21 ``padded cell' (or environment) with limited permissions, and run the
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
22 untrusted code within this cell. The untrusted code cannot break out
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
23 of its cell, and can only interact with sensitive system resources
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
24 through interfaces defined and managed by the trusted code. The term
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
25 ``restricted execution'' is favored over ``safe-Python''
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
26 since true safety is hard to define, and is determined by the way the
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
27 restricted environment is created. Note that the restricted
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
28 environments can be nested, with inner cells creating subcells of
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
29 lesser, but never greater, privilege.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
30
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
31 An interesting aspect of Python's restricted execution model is that
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
32 the interfaces presented to untrusted code usually have the same names
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
33 as those presented to trusted code. Therefore no special interfaces
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
34 need to be learned to write code designed to run in a restricted
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
35 environment. And because the exact nature of the padded cell is
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
36 determined by the supervisor, different restrictions can be imposed,
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
37 depending on the application. For example, it might be deemed
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
38 ``safe'' for untrusted code to read any file within a specified
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
39 directory, but never to write a file. In this case, the supervisor
10726
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
40 may redefine the built-in \function{open()} function so that it raises
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
41 an exception whenever the \var{mode} parameter is \code{'w'}. It
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
42 might also perform a \cfunction{chroot()}-like operation on the
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
43 \var{filename} parameter, such that root is always relative to some
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
44 safe ``sandbox'' area of the filesystem. In this case, the untrusted
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
45 code would still see an built-in \function{open()} function in its
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
46 environment, with the same calling interface. The semantics would be
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
47 identical too, with \exception{IOError}s being raised when the
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
48 supervisor determined that an unallowable parameter is being used.
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
49
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
50 The Python run-time determines whether a particular code block is
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
51 executing in restricted execution mode based on the identity of the
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
52 \code{__builtins__} object in its global variables: if this is (the
10726
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
53 dictionary of) the standard \refmodule[builtin]{__builtin__} module,
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
54 the code is deemed to be unrestricted, else it is deemed to be
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
55 restricted.
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
56
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
57 Python code executing in restricted mode faces a number of limitations
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
58 that are designed to prevent it from escaping from the padded cell.
10726
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
59 For instance, the function object attribute \member{func_globals} and
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
60 the class and instance object attribute \member{__dict__} are
8de7d90b0b34 Fixed some logical markup nits.
Fred Drake <fdrake@acm.org>
parents: 8716
diff changeset
61 unavailable.
4492
ae75d4a1f5dd Done with this for 1.4.
Guido van Rossum <guido@python.org>
parents: 4432
diff changeset
62
4432
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
63 Two modules provide the framework for setting up restricted execution
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
64 environments:
1ccce5e4f806 Background chapter on restricted execution. Additional sections are
Guido van Rossum <guido@python.org>
parents:
diff changeset
65
8716
760dcf197048 Adjusted to use the new module synopsis support macros.
Fred Drake <fdrake@acm.org>
parents: 7920
diff changeset
66 \localmoduletable
7920
dde0dffb1a08 Added reference to AMK's HOWTO on the topic.
Fred Drake <fdrake@acm.org>
parents: 7361
diff changeset
67
dde0dffb1a08 Added reference to AMK's HOWTO on the topic.
Fred Drake <fdrake@acm.org>
parents: 7361
diff changeset
68 \begin{seealso}
20263
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
69 \seetitle[http://www.python.org/doc/howto/rexec/]
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
70 {Restricted Execution HOWTO}
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
71 {Andrew Kuchling's tutorial on the use of the restricted
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
72 execution facilities in Python.}
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
73 \seetitle[http://grail.sourceforge.net/]{Grail Home Page}
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
74 {Grail, an Internet browser written in Python, uses these
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
75 modules to support Python applets. More
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
76 information on the use of Python's restricted execution
873d584c1221 Update a couple of old addresses that point to CNRI.
Fred Drake <fdrake@acm.org>
parents: 18574
diff changeset
77 mode in Grail is available on the Web site.}
7920
dde0dffb1a08 Added reference to AMK's HOWTO on the topic.
Fred Drake <fdrake@acm.org>
parents: 7361
diff changeset
78 \end{seealso}