Bugs item #577530, was opened at 2002-07-04 15:01
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=577530&group_id=5470
Category: Python Interpreter Core
Group: Python 2.2.1
Status: Open
Resolution: None
>Priority: 4
Submitted By: Eric Jacobs (ejums)
Assigned to: Guido van Rossum (gvanrossum)
Summary: del __builtins__ breaks out of rexec
Initial Comment:
Executing the statement "del __builtins__" in a
restricted execution environment (say, the test shell
in rexec.py) causes all restrictions to be bypassed.
This is caused by the fact that restriction policies
are implemented by having the "__builtins__" key in the
globals dictionary. It is a design error to implement
restriction policies with an object that can be
modified by the restricted code!
A temporary workaround would involve a modification to
rexec.py:
*** rexec.py Sat Jun 22 22:57:46 2002
--- /home/eric/rexec.py Tue Jul 2 16:08:03 2002
***************
*** 241,249 ****
# Add a module -- return an existing module or
create one
def add_module(self, mname):
! if self.modules.has_key(mname):
! return self.modules[mname]
! self.modules[mname] = m =
self.hooks.new_module(mname)
m.__builtins__ = self.modules['__builtin__']
return m
--- 241,249 ----
# Add a module -- return an existing module or
create one
def add_module(self, mname):
! if not self.modules.has_key(mname):
! self.modules[mname] =
self.hooks.new_module(mname)
! m = self.modules[mname]
m.__builtins__ = self.modules['__builtin__']
return m
However, the restriction execution feature is prone to
this sort of programming error by design, and it should
probably be fixed by having the builtins module be
specified explicitly when executing restricted code, so
that it doesn't accidentally fall back to the
unrestricted builtins inherited from the parent frame.
----------------------------------------------------------------------
>Comment By: Guido van Rossum (gvanrossum)
Date: 2002-08-17 16:01
Message:
Logged In: YES
user_id=6380
I find it hard to believe that putting __builtins__ back
once per r_exec() call would be sufficient.
What if someone wrote "del __builtins__; import socket" ?
Backporting to 2.1 sounds like giving people a false sense
of security. If there's a message to be gotten out, it is
"don't trust rexec". This fix doesn't make me more confident
but less (even if applied).
----------------------------------------------------------------------
Comment By: Neal Norwitz (nnorwitz)
Date: 2002-08-17 12:14
Message:
Logged In: YES
user_id=33168
I have tested the patch attached and it seems to work. I
don't know if the approach is a good solution. Guido, if
you think this is acceptable, assign to me and I'll fix it.
Since this is a security problem should it be backported to
2.1?
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=105470&aid=577530&group_id=5470