I'm writing an application where users can enter a python script and execute it in a sandbox. I need a way to prevent the exec'ed code from importing certain modules, so malicious code won't be as much of a problem. Is there a way to do this in Python?
6 Answers
If you put None in sys.modules for a module name, in won't be importable...
>>> import sys
>>> import os
>>> del os
>>> sys.modules['os']=None
>>> import os
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
ImportError: No module named os
>>>
-
-
6
-
5This does not make the
os
module inaccessible. Modules may still be available from other sources. For example,subprocess.os
is theos
module. Commented Jun 3, 2020 at 20:55 -
1Yes. For example,
import matplotlib
(an innocuous module) makesos
available asmatplotlib.os
– LucaCommented Aug 9, 2023 at 20:05
Have you checked the python.org article on SandboxedPython, and the linked article?
Both of those pages have links to other resources.
Specifically, PyPi's RestrictedPython lets you define exactly what is available, and has a few 'safe' defaults to choose from.
-
I should have mentioned, my app runs on Google App Engine. So, on one hand I have a lot of sandboxing already in place, but OTOH I'm not sure I can use RestrictedPython. I will certainly give it a try, thanks!– NirCommented Aug 29, 2009 at 23:53
8 years, yeesh, and nobody has figured this one out? :/
You can override the import
statement or aka the __import__
function.
This is just a tested scribble-code because I couldn't find any legit reference:
import importlib
def secure_importer(name, globals=None, locals=None, fromlist=(), level=0):
if name != 'C': print(name, fromlist, level)
# not exactly a good verification layer
frommodule = globals['__name__'] if globals else None
if name == 'B' and frommodule != 'C':
raise ImportError("module '%s' is restricted."%name)
return importlib.__import__(name, globals, locals, fromlist, level)
__builtins__.__dict__['__import__'] = secure_importer
import C
and here's the tests for that code:
Python 3.4.3 |Anaconda 2.3.0 (32-bit)| (default, Mar 6 2015, 12:08:17) [MSC v.1600 32 bit (Intel)] on win32
Type "copyright", "credits" or "license()" for more information.
>>> ================================ RESTART ================================
>>>
B ('f',) 0
imported secure module
>>> from B import f
B ('f',) 0
linecache None 0
encodings.utf_8 ['*'] 0
Traceback (most recent call last):
File "<pyshell#0>", line 1, in <module>
from B import f
File "\home\tcll\Projects\python\test\restricted imports\main.py", line 11, in secure_importer
raise ImportError("module '%s' is restricted."%name)
ImportError: module 'B' is restricted.
>>> import C
>>>
Please do not comment about me using Python34, I have my reasons, and it's my primary interpreter on Linux specifically for testing things (like the above code) for my primary project.
Google App Engine's open source SDK has a detailed and solid implementation of mechanics to stop the importing of unwanted modules (to help detect code trying to import modules that aren't made available in the production instances of App Engine), though even that could be subverted if the user code was evil rather than just mistaken (production instances obviously have more layers of defense, such as simply not having those modules around at all;-).
So it all depends on how in-depth your defense needs to be. At one extreme you just stash the builtin __import__
somewhere else and replace it with your function that does all the checks you want before delegating to the __builtin__
; that's maybe 20 lines of code, 30 minutes to implement and test thoroughly... but it might not protect you for long if somebody credibly offered me a million bucks to break into your system (and, hypothetically, I wasn't the goody-two-shoes kind of guy I actually AM, of course;-). At the other extreme you deploy an in-depth series of layers of defense that might take thousands of lines and weeks of implementation and testing work -- given that kind of resource budget I could surely implement something I would be unable to penetrate (but there's always the risk that somebody ELSE is smarter and more Python-savvy than I am, of course!).
So, how deep do you want to go, or rather, how deep can you AFFORD to go...?
-
1I'm far from NSA level requirements/budget, so I suppose I'll opt for overriding import and if hires the author of The Python Cookbook a million dollars to break the protection, will just bear the consequences.. Any pointers to how to go about doing that? Being relatively new to Python I can't seem to find a simple solution. Thanks!– NirCommented Aug 29, 2009 at 23:49
-
Production instances of App Engine are solidly protected, as I said with many layers of defense: I wouldn't know how to break into THOSE (if I did, I'd of course communicate it privately to my employer, or my many friends who work in the App Engine team, so the leak would be fixed immediately after I figured it out;-). Just do consider that just like your code can override builtin
__import__
, so may the code you're importing, so, defend against THAT, too; AND, use a "default deny" stance, where only specific modules are allowed, rather than specific ones being forbidden!-) Commented Aug 30, 2009 at 0:00 -
1Assuming that the questionable code is added to the running program as a string that the program will "exec", wouldn't it be impossible for this code to import new modules if it the program was bundled in pyinstaller, and therefore doesn't actually have access to the modules that are not imported by the main program because the files are not included in the executable? Commented May 19, 2014 at 18:33
Unfortunately, I think that what you're trying to do is fundamentally impossible. If users can execute arbitrary code in your application then they can do whatever they want. Even if you were able to prevent them from importing certain modules there would be nothing stopping them from writing equivalent functionality themselves (from scratch or using some of the modules that are available).
I don't really know the specifics of implementing a sandbox in Python, but I would imagine it's something that needs to be done at the interpreter level and is far from easy!
-
what he's trying to do is extremely difficult, but far from impossible. If you design well enough around what you're doing, you can bottleneck access to your backend and cap it off, giving access only to what is allowed to be seen, and restricting access to hacky implementations python allows. (there are many areas of restriction that need to be covered, from private backend namespaces, to restricted variable operation)– TcllCommented Dec 17, 2017 at 13:43
You can register a custom MetaPathFinder
as the first element of sys.meta_path
. This finder can maintain a list of forbidden modules and only return None
if the import is acceptable, in order to delegate to other finders; otherwise, it can raise an ImportError
to indicate that the import is illegal.
from importlib.abc import MetaPathFinder
import sys
class ForbiddenModules(MetaPathFinder):
def __init__(self, modules):
super().__init__()
self.modules = modules
def find_spec(self, fullname, path, target=None):
if fullname in self.modules:
raise ImportError(fullname)
sys.meta_path.insert(0, ForbiddenModules({'typing'}))
import math # works
import typing # raises ImportError
However, at interpreter startup already a bunch of modules are automatically imported. You can check this by using the -v
flag, e.g. python -vc ""
(it's a long list, so I won't copy it here).
So you also need to remove those modules from sys.modules
: sys.modules.clear()
.
Also note that the list of forbidden modules must include sys
itself, because otherwise user code could simply remove the custom finder via sys.meta_path.pop(0)
and then continue with importing forbidden modules. This implies that any module which depends on sys
(i.e. imports sys
) will be forbidden, too.
So this is the full code:
from importlib.abc import MetaPathFinder
import sys
class ForbiddenModules(MetaPathFinder):
def __init__(self, modules):
super().__init__()
self.modules = modules
def find_spec(self, fullname, path, target=None):
if fullname in self.modules:
raise ImportError(fullname)
sys.meta_path.insert(0, ForbiddenModules({'sys', ...}))
sys.modules.clear()
del MetaPathFinder, ForbiddenModules, sys
-
after trying to implement this approach I ask myself if a blacklist wouldnt be easier. As an example, these modules are needed to import/implement
json
in your script:'json','_io','json.decoder','re','enum','sys','types','sre_compile', '_sre','sre_parse','sre_constants', 'functools','abc','_py_abc', '_weakrefset','_weakref', 'collections','_collections_abc', 'itertools','keyword','operator', 'builtins','reprlib','_thread', 'copyreg','json.scanner','json.encoder', 'codecs','_codecs'
Commented Jun 19, 2022 at 10:55 -
Also note that the most crucial one ´builtins` is also required. Dont think the strategy is doable, but still have learned something. Thanks at this point. Commented Jun 19, 2022 at 11:02
-
@Thingamabobs You are right and it also seems to be more closely related to what the OP asked for. So I updated my answer to use a list of forbidden modules instead.– a_guestCommented Jun 19, 2022 at 18:59