[Python-Dev] For sandboxing: alternative to crippling file()

[Ka-Ping Yee]

On Fri, 30 Jun 2006, Brett Cannon wrote:
> On 6/30/06, Armin Rigo <arigo at tunes.org> wrote:
> >     >>> object.__subclasses__()
> >     [..., <type 'file'>]
> >
> > Maybe this one won't work if __subclasses__ is forbidden, but in general
> > I think there *will* be a way to find this object.
>
> Yeah, that's been my (what I thought was paranoid) feeling.  Glad I am not
> the only one who thinks that hiding file() is near impossible.

If you want to do this right, it should be about *making* hiding
possible.  If you can't hide things, it will be hard to get very far.

I realize that may be difficult for Python 2.x, but hiding is pretty
essential for security.  It would be really good to keep this in mind
for the design of Python 3k.  (It doesn't mean we can't have introspection,
just that we need to agree on some discipline for how to do it.)


-- ?!ng