easy_install runnable in a sandbox environment?
I am having issues in running easy_install in a sandbox environment (chroot with python2.7 under FreeBSD 9.0-RELASE, without /dev mount). easy_install is sourcing tempfile, which requires /dev/urandom to be present, as seen in the backtrace: brahm# sh -x setuptools-0.6c11-py2.7.egg + basename setuptools-0.6c11-py2.7.egg + [ setuptools-0.6c11-py2.7.egg = setuptools-0.6c11-py2.7.egg ] + exec python2.7 -c 'import sys, os; sys.path.insert(0, os.path.abspath('\''setuptools-0.6c11-py2.7.egg'\'')); from setuptools.command.easy_install import bootstrap; sys.exit(bootstrap())' Traceback (most recent call last): File "<string>", line 1, in <module> File "/usr/local/lib/python2.7/site-packages/setuptools-0.6c11-py2.7.egg/setuptools/command/easy_install.py", line 12, in <module> File "/usr/local/lib/python2.7/tempfile.py", line 34, in <module> from random import Random as _Random File "/usr/local/lib/python2.7/random.py", line 881, in <module> _inst = Random() File "/usr/local/lib/python2.7/random.py", line 97, in __init__ self.seed(x) File "/usr/local/lib/python2.7/random.py", line 111, in seed a = long(_hexlify(_urandom(16)), 16) OSError: [Errno 2] No such file or directory: '/dev/urandom' Quite some time ago, their has been comments in the changelog (06.c4) stating that running easy_install without /dev/urandom should be possible: Fixed not allowing os.open() of paths outside the sandbox, even if they are opened read-only (e.g. reading /dev/urandom for random numbers, as is done by os.urandom() on some platforms). While this was back in 2006, I was wondering what the current state of affairs which regards of requiring the /dev/urandom as of today? Am I looking at a feature request, bug report or design limitation? Br. /Rick -- http://rickvanderzwet.nl
On Wed, May 9, 2012 at 6:42 PM, Rick van der Zwet <info@rickvanderzwet.nl>wrote:
Quite some time ago, their has been comments in the changelog (06.c4) stating that running easy_install without /dev/urandom should be possible: Fixed not allowing os.open() of paths outside the sandbox, even if they are opened read-only (e.g. reading /dev/urandom for random numbers, as is done by os.urandom() on some platforms).
While this was back in 2006, I was wondering what the current state of affairs which regards of requiring the /dev/urandom as of today? Am I looking at a feature request, bug report or design limitation?
You're confusing easy_install's internal sandboxing with running easy_install in a chroot environment. easy_install runs setup scripts in a Python sandbox that disallows certain file accesses in order to handle badly-coded setup.py files that copy files directly to guessed installation locations, instead of relying on the distutils to do the copying. The change notes you're reading are discussing *that* sandbox, which is internal to Python/setuptools and is unrelated to chrooting.
On 10 May 2012 05:30, PJ Eby <pje@telecommunity.com> wrote:
On Wed, May 9, 2012 at 6:42 PM, Rick van der Zwet <info@rickvanderzwet.nl> wrote:
Quite some time ago, their has been comments in the changelog (06.c4) stating that running easy_install without /dev/urandom should be possible: Fixed not allowing os.open() of paths outside the sandbox, even if they are opened read-only (e.g. reading /dev/urandom for random numbers, as is done by os.urandom() on some platforms).
While this was back in 2006, I was wondering what the current state of affairs which regards of requiring the /dev/urandom as of today? Am I looking at a feature request, bug report or design limitation?
You're confusing easy_install's internal sandboxing with running easy_install in a chroot environment. easy_install runs setup scripts in a Python sandbox that disallows certain file accesses in order to handle badly-coded setup.py files that copy files directly to guessed installation locations, instead of relying on the distutils to do the copying. The change notes you're reading are discussing *that* sandbox, which is internal to Python/setuptools and is unrelated to chrooting.
Spot on, nice! Mounting /dev (mount -t devfs devfs /usr/local/sandbox/dev) before entering the sandbox will be the solution then. Thanks for explaining. /Rick -- http://rickvanderzwet.nl
participants (2)
-
PJ Eby -
Rick van der Zwet