Mailman 3 August 2006 - Python-checkins

r51663 - python/trunk/Doc/lib/libhashlib.tex
by armin.rigo 31 Aug '06

31 Aug '06

Author: armin.rigo Date: Thu Aug 31 10:51:06 2006 New Revision: 51663 Modified: python/trunk/Doc/lib/libhashlib.tex Log: Doc fix: hashlib objects don't always return a digest of 16 bytes. Backport candidate for 2.5. Modified: python/trunk/Doc/lib/libhashlib.tex ============================================================================== --- python/trunk/Doc/lib/libhashlib.tex (original) +++ python/trunk/Doc/lib/libhashlib.tex Thu Aug 31 10:51:06 2006 @@ -86,8 +86,8 @@ \begin{methoddesc}[hash]{digest}{} Return the digest of the strings passed to the \method{update()} -method so far. This is a 16-byte string which may contain -non-\ASCII{} characters, including null bytes. +method so far. This is a string of \member{digest_size} bytes which may +contain non-\ASCII{} characters, including null bytes. \end{methoddesc} \begin{methoddesc}[hash]{hexdigest}{}

1 0

r51657 - python/branches/bcannon-objcap/BRANCHNEWS python/branches/bcannon-objcap/securing_python.txt
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Thu Aug 31 00:05:48 2006 New Revision: 51657 Modified: python/branches/bcannon-objcap/BRANCHNEWS python/branches/bcannon-objcap/securing_python.txt Log: Update status with 'file' initializer removed. Modified: python/branches/bcannon-objcap/BRANCHNEWS ============================================================================== --- python/branches/bcannon-objcap/BRANCHNEWS (original) +++ python/branches/bcannon-objcap/BRANCHNEWS Thu Aug 31 00:05:48 2006 @@ -5,5 +5,17 @@ Core and builtins ----------------- +* rev. 51656: Remove initializer from 'file'. By leaving tp_new alone you can + still subclass 'file' (although its usefulness as a subclass is doubtful when + its tp_init is empty and that is what actually opens the file descriptor). + Created a new function, PyFile_UnsafeOpen() which is what the built-in open() + function is now set to. Also changed the bz2 module to use it. + + Still need to decide how to handle subclasses of 'file' so they are not + totally useless (special function that calls the needed initializer on a + 'file' object?). Also need to come up with C API that opens files through + the built-in open() instead of doing it directly so as to not bypass + security. + * rev. 51392: Introduce objcap module to hold removed functions/methods. Begin with moving object.__subclasses__(). Modified: python/branches/bcannon-objcap/securing_python.txt ============================================================================== --- python/branches/bcannon-objcap/securing_python.txt (original) +++ python/branches/bcannon-objcap/securing_python.txt Thu Aug 31 00:05:48 2006 @@ -7,11 +7,11 @@ + Remove object.__subclasses__ (`Mutable Shared State`_) [done] + Dangerous constructors (`Constructors`_) - file - * Create PyFile_InsecureOpen() + * Create PyFile_UnsafeOpen() [done] * Switch current C-level uses of 'file' constructor to - PyFile_InsecureOpen(). - + built-in open() - + bz2 module + PyFile_UnsafeOpen(). [done] + + built-in open() [done] + + bz2 module [done] * Create PyFile_Safe*() version of C API that goes through open() built-in. + Convert C strings to Python objects and do a direct

1 0

r51656 - in python/branches/bcannon-objcap: Include/fileobject.h Lib/test/test_descr.py Modules/bz2module.c Objects/fileobject.c Python/bltinmodule.c
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Wed Aug 30 23:52:22 2006 New Revision: 51656 Modified: python/branches/bcannon-objcap/Include/fileobject.h python/branches/bcannon-objcap/Lib/test/test_descr.py python/branches/bcannon-objcap/Modules/bz2module.c python/branches/bcannon-objcap/Objects/fileobject.c python/branches/bcannon-objcap/Python/bltinmodule.c Log: Remove tp_init from 'file'. Left tp_new so as to continue to allow subclassing, although mostly useless since without tp_init you cannot actually open any file. Added PyFile_UnsafeOpen() and set built-in open to that. Also changed bz2 module to use it as well. Still need to make C API calls go through built-in open() so that if it is overridden that is used instead of blindly opening any file. Will most likely require a new set of APIs for that. Modified: python/branches/bcannon-objcap/Include/fileobject.h ============================================================================== --- python/branches/bcannon-objcap/Include/fileobject.h (original) +++ python/branches/bcannon-objcap/Include/fileobject.h Wed Aug 30 23:52:22 2006 @@ -45,6 +45,8 @@ PyAPI_FUNC(int) PyFile_WriteString(const char *, PyObject *); PyAPI_FUNC(int) PyObject_AsFileDescriptor(PyObject *); +PyAPI_FUNC(PyObject *) PyFile_UnsafeOpen(PyObject *, PyObject *, PyObject *); + /* The default encoding used by the platform file system APIs If non-NULL, this is different than the default encoding for strings */ Modified: python/branches/bcannon-objcap/Lib/test/test_descr.py ============================================================================== --- python/branches/bcannon-objcap/Lib/test/test_descr.py (original) +++ python/branches/bcannon-objcap/Lib/test/test_descr.py Wed Aug 30 23:52:22 2006 @@ -2452,10 +2452,14 @@ lineno = 0 ateof = 0 + + def __init__(self, path): + self.__file = open(path) + def readline(self): if self.ateof: return "" - s = file.readline(self) + s = file.readline(self.__file) # Next line works too. # s = super(CountedInput, self).readline() self.lineno += 1 @@ -2500,7 +2504,7 @@ # note: as of Python 2.3, dict() no longer has an "items" keyword arg for constructor in (int, float, long, complex, str, unicode, - tuple, list, file): + tuple, list): try: constructor(bogus_keyword_arg=1) except TypeError: Modified: python/branches/bcannon-objcap/Modules/bz2module.c ============================================================================== --- python/branches/bcannon-objcap/Modules/bz2module.c (original) +++ python/branches/bcannon-objcap/Modules/bz2module.c Wed Aug 30 23:52:22 2006 @@ -1293,6 +1293,7 @@ static char *kwlist[] = {"filename", "mode", "buffering", "compresslevel", 0}; PyObject *name; + PyObject *file_open_args; char *mode = "r"; int buffering = -1; int compresslevel = 9; @@ -1353,8 +1354,10 @@ mode = (mode_char == 'r') ? "rb" : "wb"; - self->file = PyObject_CallFunction((PyObject*)&PyFile_Type, "(Osi)", - name, mode, buffering); + file_open_args = Py_BuildValue("Osi", name, mode, buffering); + if (!file_open_args) + goto error; + self->file = PyFile_UnsafeOpen(NULL, file_open_args, NULL); if (self->file == NULL) return -1; Modified: python/branches/bcannon-objcap/Objects/fileobject.c ============================================================================== --- python/branches/bcannon-objcap/Objects/fileobject.c (original) +++ python/branches/bcannon-objcap/Objects/fileobject.c Wed Aug 30 23:52:22 2006 @@ -273,6 +273,7 @@ return (PyObject *)f; } + PyObject * PyFile_FromFile(FILE *fp, char *name, char *mode, int (*close)(FILE *)) { @@ -1966,25 +1967,28 @@ return self; } -static int -file_init(PyObject *self, PyObject *args, PyObject *kwds) +/* + Open a file with no regards to whether it should be allowed. + + Used as the implementation of built-in open(). +*/ +PyObject * +PyFile_UnsafeOpen(PyObject *self, PyObject *args, PyObject *kwds) { - PyFileObject *foself = (PyFileObject *)self; - int ret = 0; + PyFileObject *foself; + PyObject *ret = NULL; static char *kwlist[] = {"name", "mode", "buffering", 0}; char *name = NULL; char *mode = "r"; int bufsize = -1; int wideargument = 0; + self = file_new(&PyFile_Type, args, kwds); + if (!self) + return NULL; + foself = (PyFileObject *)self; + assert(PyFile_Check(self)); - if (foself->f_fp != NULL) { - /* Have to close the existing file first. */ - PyObject *closeresult = file_close(foself); - if (closeresult == NULL) - return -1; - Py_DECREF(closeresult); - } #ifdef Py_WIN_WIDE_FILENAMES if (GetVersion() < 0x80000000) { /* On NT, so wide API available */ @@ -2010,13 +2014,13 @@ Py_FileSystemDefaultEncoding, &name, &mode, &bufsize)) - return -1; + return NULL; /* We parse again to get the name as a PyObject */ if (!PyArg_ParseTupleAndKeywords(args, kwds, "O|si:file", kwlist, &o_name, &mode, &bufsize)) - return -1; + return NULL; if (fill_file_fields(foself, NULL, o_name, mode, fclose) == NULL) @@ -2026,10 +2030,11 @@ goto Error; foself->f_setbuf = NULL; PyFile_SetBufSize(self, bufsize); + ret = self; goto Done; Error: - ret = -1; + ret = NULL; /* fall through */ Done: PyMem_Free(name); /* free the encoded string */ @@ -2096,7 +2101,7 @@ 0, /* tp_descr_get */ 0, /* tp_descr_set */ 0, /* tp_dictoffset */ - file_init, /* tp_init */ + 0, /* tp_init */ PyType_GenericAlloc, /* tp_alloc */ file_new, /* tp_new */ PyObject_Del, /* tp_free */ Modified: python/branches/bcannon-objcap/Python/bltinmodule.c ============================================================================== --- python/branches/bcannon-objcap/Python/bltinmodule.c (original) +++ python/branches/bcannon-objcap/Python/bltinmodule.c Wed Aug 30 23:52:22 2006 @@ -1341,16 +1341,29 @@ Return the octal representation of an integer or long integer."); -static PyObject * -builtin_open(PyObject *self, PyObject *args, PyObject *kwds) -{ - return PyObject_Call((PyObject*)&PyFile_Type, args, kwds); -} +/* PyFile_UnsafeOpen() used as open(). */ -PyDoc_STRVAR(open_doc, -"open(name[, mode[, buffering]]) -> file object\n\ -\n\ -Open a file using the file() type, returns a file object."); +PyDoc_VAR(open_doc) = +PyDoc_STR( +"file(name[, mode[, buffering]]) -> file object\n" +"\n" +"Open a file. The mode can be 'r', 'w' or 'a' for reading (default),\n" +"writing or appending. The file will be created if it doesn't exist\n" +"when opened for writing or appending; it will be truncated when\n" +"opened for writing. Add a 'b' to the mode for binary files.\n" +"Add a '+' to the mode to allow simultaneous reading and writing.\n" +"If the buffering argument is given, 0 means unbuffered, 1 means line\n" +"buffered, and larger numbers specify the buffer size.\n" +) +PyDoc_STR( +"Add a 'U' to mode to open the file for input with universal newline\n" +"support. Any line ending in the input file will be seen as a '\\n'\n" +"in Python. Also, a file so opened gains the attribute 'newlines';\n" +"the value for this attribute is one of None (no newline read yet),\n" +"'\\r', '\\n', '\\r\\n' or a tuple containing all the newline types seen.\n" +"\n" +"'U' cannot be combined with 'w' or '+' mode.\n" +); static PyObject * @@ -2259,7 +2272,7 @@ {"max", (PyCFunction)builtin_max, METH_VARARGS | METH_KEYWORDS, max_doc}, {"min", (PyCFunction)builtin_min, METH_VARARGS | METH_KEYWORDS, min_doc}, {"oct", builtin_oct, METH_O, oct_doc}, - {"open", (PyCFunction)builtin_open, METH_VARARGS | METH_KEYWORDS, open_doc}, + {"open", (PyCFunction)PyFile_UnsafeOpen, METH_VARARGS | METH_KEYWORDS, open_doc}, {"ord", builtin_ord, METH_O, ord_doc}, {"pow", builtin_pow, METH_VARARGS, pow_doc}, {"range", builtin_range, METH_VARARGS, range_doc},

1 0

r51655 - python/branches/bcannon-objcap/securing_python.txt
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Wed Aug 30 23:49:19 2006 New Revision: 51655 Modified: python/branches/bcannon-objcap/securing_python.txt Log: Minor details in 'Status'. Modified: python/branches/bcannon-objcap/securing_python.txt ============================================================================== --- python/branches/bcannon-objcap/securing_python.txt (original) +++ python/branches/bcannon-objcap/securing_python.txt Wed Aug 30 23:49:19 2006 @@ -22,6 +22,7 @@ makes less of a performance-critical operation. + Might need to add some C code for easily accessing built-in objects. + * How to handle creating subclasses if open() only way? - code - ??? <go through Objects/*> + Sandboxed versions of built-ins (`Sanitizing Built-In Types`_)

1 0

r51654 - in sandbox/trunk/decimal-c: _decimal.c new_dt/power.decTest test_decimal.py
by mateusz.rukowicz 30 Aug '06

30 Aug '06

Author: mateusz.rukowicz Date: Wed Aug 30 22:30:34 2006 New Revision: 51654 Modified: sandbox/trunk/decimal-c/_decimal.c sandbox/trunk/decimal-c/new_dt/power.decTest sandbox/trunk/decimal-c/test_decimal.py Log: Added special case to power functions. Upated test_decimal.py. Now *decTest are very the same to Cowlish except two tests that are 'extra feature'. Modified: sandbox/trunk/decimal-c/_decimal.c ============================================================================== --- sandbox/trunk/decimal-c/_decimal.c (original) +++ sandbox/trunk/decimal-c/_decimal.c Wed Aug 30 22:30:34 2006 @@ -5960,8 +5960,85 @@ if (use_exp) { decimalobject *tmp; contextobject *ctx2; + + /* check context */ if (!check_ctx(self, ctx)) return handle_InvalidContext(self->ob_type, ctx, NULL); + + /* now check operands */ + if (decimal_nonzero(self) && ( + self->ob_size > MAX_MATH || + exp_g_i(exp_add_i(self->exp, self->ob_size), MAX_MATH + 1) || + exp_l_i(exp_add_i(self->exp, self->ob_size), 2 * (1 - MAX_MATH)))) + return handle_InvalidOperation(self->ob_type, ctx, "Operand range violation", NULL); + + if (decimal_nonzero(other) && ( + other->ob_size > MAX_MATH || + exp_g_i(exp_add_i(other->exp, other->ob_size), MAX_MATH + 1) || + exp_l_i(exp_add_i(other->exp, other->ob_size), 2 * (1 - MAX_MATH)))) + return handle_InvalidOperation(other->ob_type, ctx, "Operand range violation", NULL); + + /* special cases */ + { + int i; + int special = 1; + if (!exp_eq_i(ADJUSTED(self), -1)) + special = 0; + if (special) + for (i = 0 ; i < ctx->prec; i ++) { + if (_limb_get_digit(self->limbs, self->ob_size, i) != 9) { + special = 0; + break; + } + } + + /* self is 0.999...99 */ + if (special) { + /* 0 < other < 1 */ + if (!(other->sign&1) && exp_le_i(ADJUSTED(other), -1) && decimal_nonzero(other)) { + + /* if round up then return 1 */ + if (ctx->rounding == ROUND_UP || ctx->rounding == ROUND_CEILING) { + long limb = ctx->prec / LOG; + long mul = (ctx->prec % LOG) - 1; + + if (handle_Inexact(ctx, NULL)) + return NULL; + + if (handle_Rounded(ctx, NULL)) + return NULL; + + ret = _NEW_decimalobj(ctx->prec, 0, exp_from_i(1 - ctx->prec)); + + if (!ret) + return NULL; + + for (i=0 ; i < ret->limb_count ;i ++) + ret->limbs[i] = 0; + + ret->limbs[limb] = 1; + + for (i = 0 ; i < mul ; i ++) + ret->limbs[limb] *= 10; + + return ret; + } + + /* if round down then return self */ + else if (ctx->rounding == ROUND_DOWN || ctx->rounding == ROUND_FLOOR){ + if (handle_Inexact(ctx, NULL)) + return NULL; + + if (handle_Rounded(ctx, NULL)) + return NULL; + + return _decimal_get_copy(self); + } + } + } + } + + ctx2 = context_shallow_copy(ctx); if (!ctx2) return NULL; @@ -5971,11 +6048,10 @@ ctx2->clamp = 0; ctx2->rounding = ctx->rounding; ctx2->rounding_dec = ALWAYS_ROUND; - /* we take context precision or size of self if greater - * and add some constant */ + /* we take context precision or size of self if greater and + * add some constant */ ctx2->prec = ctx->prec > self->ob_size ? ctx->prec : self->ob_size; ctx2->prec += 14; - ret = _do_decimal__ln(self, ctx2); if (!ret) { Py_DECREF(ctx2); Modified: sandbox/trunk/decimal-c/new_dt/power.decTest ============================================================================== --- sandbox/trunk/decimal-c/new_dt/power.decTest (original) +++ sandbox/trunk/decimal-c/new_dt/power.decTest Wed Aug 30 22:30:34 2006 @@ -689,6 +689,10 @@ powx1065 power '10' '999999997' -> '1.00000000E+999999997' Rounded powx1066 power '10' '333333333' -> '1.00000000E+333333333' Rounded -- next two are integer-out-of range +powx1183 power '7' '1000000000' -> NaN Invalid_context +powx1184 power '7' '1000000001' -> NaN Invalid_context +-- powx1186 power '7' '-1000000001' -> 1.38243630E-845098041 Inexact Rounded +-- powx1187 power '7' '-1000000000' -> 9.67705411E-845098041 Inexact Rounded -- out-of-range edge cases powx1118 power '10' '-333333333' -> 1E-333333333 @@ -1463,13 +1467,13 @@ -- operand range violations powx4007 power 1 1.1E+999999 -> 1 --- powx4008 power 1 1.1E+1000000 -> NaN Invalid_operation +powx4008 power 1 1.1E+1000000 -> NaN Invalid_operation powx4009 power 1.1E+999999 1.1 -> Infinity Overflow Inexact Rounded --- powx4010 power 1.1E+1000000 1.1 -> NaN Invalid_operation +powx4010 power 1.1E+1000000 1.1 -> NaN Invalid_operation powx4011 power 1 1.1E-1999997 -> 1.00000000 Inexact Rounded --- powx4012 power 1 1.1E-1999998 -> NaN Invalid_operation +powx4012 power 1 1.1E-1999998 -> NaN Invalid_operation powx4013 power 1.1E-1999997 1.1 -> 0E-1000006 Underflow Inexact Rounded Clamped Subnormal --- powx4014 power 1.1E-1999998 1.1 -> NaN Invalid_operation +powx4014 power 1.1E-1999998 1.1 -> NaN Invalid_operation -- rounding modes -- power is sensitive precision: 7 @@ -1579,3 +1583,35 @@ powx4328 power 1.000001 0.9999999 -> 1.000000 Inexact Rounded powx4329 power 1.000001 1.000000 -> 1.000001 +-- For x=prevfp(1)=0.99..99 (where the number of 9s is precision) +-- power(x,y)=x when the rounding is down for any y in (0,1]. +rounding: floor +powx4341 power 0.9999999 0 -> 1 +powx4342 power 0.9999999 1e-101 -> 0.9999999 Inexact Rounded +powx4343 power 0.9999999 1e-95 -> 0.9999999 Inexact Rounded +powx4344 power 0.9999999 1e-10 -> 0.9999999 Inexact Rounded +powx4345 power 0.9999999 0.1 -> 0.9999999 Inexact Rounded +powx4346 power 0.9999999 0.1234567 -> 0.9999999 Inexact Rounded +powx4347 power 0.9999999 0.7 -> 0.9999999 Inexact Rounded +powx4348 power 0.9999999 0.9999999 -> 0.9999999 Inexact Rounded +powx4349 power 0.9999999 1.000000 -> 0.9999999 +-- power(x,y)=1 when the rounding is up for any y in (0,1]. +rounding: ceiling +powx4361 power 0.9999999 0 -> 1 +powx4362 power 0.9999999 1e-101 -> 1.000000 Inexact Rounded +powx4363 power 0.9999999 1e-95 -> 1.000000 Inexact Rounded +powx4364 power 0.9999999 1e-10 -> 1.000000 Inexact Rounded +powx4365 power 0.9999999 0.1 -> 1.000000 Inexact Rounded +powx4366 power 0.9999999 0.1234567 -> 1.000000 Inexact Rounded +powx4367 power 0.9999999 0.7 -> 1.000000 Inexact Rounded +powx4368 power 0.9999999 0.9999999 -> 1.000000 Inexact Rounded +powx4369 power 0.9999999 1.000000 -> 0.9999999 + +-- For x=nextfp(0) +-- power(x,y)=0 when the rounding is down for any y larger than 1. +rounding: floor +powx4382 power 1e-101 0 -> 1 +powx4383 power 1e-101 0.9999999 -> 1E-101 Underflow Subnormal Inexact Rounded +powx4384 power 1e-101 1.000000 -> 1E-101 Subnormal +powx4385 power 1e-101 1.000001 -> 0E-101 Underflow Subnormal Inexact Rounded Clamped +powx4386 power 1e-101 2.000000 -> 0E-101 Underflow Subnormal Inexact Rounded Clamped Modified: sandbox/trunk/decimal-c/test_decimal.py ============================================================================== --- sandbox/trunk/decimal-c/test_decimal.py (original) +++ sandbox/trunk/decimal-c/test_decimal.py Wed Aug 30 22:30:34 2006 @@ -50,7 +50,7 @@ DefaultContext.traps = dict.fromkeys(Signals, 0) setcontext(DefaultContext) -TESTDATADIR = 'decimaltestdata' +TESTDATADIR = 'new_dt' if __name__ == '__main__': file = sys.argv[0] else: @@ -1048,7 +1048,7 @@ c = Context() e = pickle.loads(pickle.dumps(c)) for k in ("prec", "Emin", "Emax", "capitals", "rounding",\ - "_rounding_decision", "_clamp", "flags", "traps", "_ignored"): + "_rounding_decision", "_clamp", "flags", "traps", "_ignored_flags"): #v1 = vars(c)[k] v1 = c.__getattribute__(k) #v2 = vars(e)[k]

1 0

r51653 - python/branches/bcannon-objcap/securing_python.txt
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Wed Aug 30 21:03:44 2006 New Revision: 51653 Modified: python/branches/bcannon-objcap/securing_python.txt Log: Add references in 'Status' to parts in 'Implementation'. Modified: python/branches/bcannon-objcap/securing_python.txt ============================================================================== --- python/branches/bcannon-objcap/securing_python.txt (original) +++ python/branches/bcannon-objcap/securing_python.txt Wed Aug 30 21:03:44 2006 @@ -4,8 +4,8 @@ Status /////////////////////////////////////// -+ Remove object.__subclasses__ [done] -+ Dangerous constructors ++ Remove object.__subclasses__ (`Mutable Shared State`_) [done] ++ Dangerous constructors (`Constructors`_) - file * Create PyFile_InsecureOpen() * Switch current C-level uses of 'file' constructor to @@ -24,14 +24,15 @@ built-in objects. - code - ??? <go through Objects/*> -+ Sandboxed versions of built-ins ++ Sandboxed versions of built-ins (`Sanitizing Built-In Types`_) - open() - - __import__() / PEP 302 importer + - __import__() / PEP 302 importer (`Imports`_) - ??? <go through built-ins> -+ Filesystem path hiding ++ Filesystem path hiding (`Filesystem Information`_) + Tweaked stdlib modules - - mini 'sys' module + - mini 'sys' module (`Making the ``sys`` Module Safe`_) - genericpath module (for os.path when C modules blocked) + - socket (`Safe Networking`_) + Create sandboxed interpreter stdlib module - Be able to specify built-ins - Set 'sys' module settings

1 0

r51652 - python/branches/bcannon-objcap/securing_python.txt
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Wed Aug 30 20:58:44 2006 New Revision: 51652 Modified: python/branches/bcannon-objcap/securing_python.txt Log: Clean up 'import' section of 'Implementation'. Modified: python/branches/bcannon-objcap/securing_python.txt ============================================================================== --- python/branches/bcannon-objcap/securing_python.txt (original) +++ python/branches/bcannon-objcap/securing_python.txt Wed Aug 30 20:58:44 2006 @@ -430,9 +430,7 @@ be imported. All .py files will be imported. XXX perhaps augment 'sys' so that you list the extension of files that -can be used for importing? Thought this was controlled somewhere -already but can't find it. It is returned by ``imp.get_suffixes()``, -but I can't find where to set it from Python code. +can be used for importing? It is returned by ``imp.get_suffixes()``. It must be warned that importing any C extension module is dangerous. Not only are they able to circumvent security measures by executing C @@ -470,6 +468,9 @@ function create a new import function based on an interpreter passed in, etc.). +One can also implement a PEP 302 import object that takes the proper +precautions of not exposing power needlessly. + Sanitizing Built-In Types -------------------------

1 0

r51651 - python/branches/bcannon-objcap/securing_python.txt
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Wed Aug 30 20:56:20 2006 New Revision: 51651 Modified: python/branches/bcannon-objcap/securing_python.txt Log: Clean up memory cap section. Modified: python/branches/bcannon-objcap/securing_python.txt ============================================================================== --- python/branches/bcannon-objcap/securing_python.txt (original) +++ python/branches/bcannon-objcap/securing_python.txt Wed Aug 30 20:56:20 2006 @@ -709,32 +709,15 @@ any form of exposure at the Python level, this feature can be safely implemented separately from the rest of the security model. -Existing APIs to protect are: +Existing APIs to protect are (as declared in Include/pymem.h and +Include/objimpl.h; both header files must be thoroughly checked for +public API and macros): -- _PyObject_New() : PyObject_New() -- _PyObject_NewVar() : PyObject_NewVar() -- _PyObject_Del() - remove macro that uses PyObject_Free() and protect directly -- PyObject_Del() - redefine macro to use _PyObject_Del() instead of PyObject_Free() -- PyMem_Malloc() : PyMem_New() -- PyMem_Realloc() : PyMem_Resize() -- PyMem_Free() : PyMem_Del() -- PyMem_MALLOC() : PyMem_NEW() - redefine macro to use PyMem_Malloc() -- PyMem_REALLOC() : PyMem_RESIZE() - redefine macro to use PyMem_Realloc() -- PyMem_FREE() : PyMem_DEL() - redefine macro to use PyMem_Free() -- PyObject_Malloc() - XXX -- PyObject_Realloc() - XXX -- PyObject_Free() - XXX -- PyObject_MALLOC() - XXX -- PyObject_REALLOC() - XXX -- PyObject_FREE() - XXX +* PyObject_Malloc(), macros, & friends +* PyObject_New(), macros, & friends +* _PyObject_New(), & friends +* PyMem_Malloc(), macros, & friends +* PyObject_GC_New(), & friends + +An implementation is in Python's svn repository under the +bcannon-sandboxing branch.

1 0

r51650 - python/branches/bcannon-objcap/securing_python.txt
by brett.cannon 30 Aug '06

30 Aug '06

Author: brett.cannon Date: Wed Aug 30 20:47:31 2006 New Revision: 51650 Modified: python/branches/bcannon-objcap/securing_python.txt Log: Add plan on how to secure opening files; both open() and at the C level. Modified: python/branches/bcannon-objcap/securing_python.txt ============================================================================== --- python/branches/bcannon-objcap/securing_python.txt (original) +++ python/branches/bcannon-objcap/securing_python.txt Wed Aug 30 20:47:31 2006 @@ -7,13 +7,32 @@ + Remove object.__subclasses__ [done] + Dangerous constructors - file + * Create PyFile_InsecureOpen() + * Switch current C-level uses of 'file' constructor to + PyFile_InsecureOpen(). + + built-in open() + + bz2 module + * Create PyFile_Safe*() version of C API that goes through + open() built-in. + + Convert C strings to Python objects and do a direct + call. + + Since I/O-bound anyway going from C->Python->C should + not be a large performance penalty. + + Function also not called in a tight loop which also + makes less of a performance-critical operation. + + Might need to add some C code for easily accessing + built-in objects. - code -+ Sandboxed built-ins + - ??? <go through Objects/*> ++ Sandboxed versions of built-ins - open() - __import__() / PEP 302 importer + - ??? <go through built-ins> + Filesystem path hiding -+ mini 'sys' module -+ Create sandboxed interpreters ++ Tweaked stdlib modules + - mini 'sys' module + - genericpath module (for os.path when C modules blocked) ++ Create sandboxed interpreter stdlib module - Be able to specify built-ins - Set 'sys' module settings - API

1 0