2

I am trying to set up a Groovy Shell sandbox that can execute untrusted code. These untrusted codes are provided by the end users (developers) as behaviour configurations, e.g. how to determine if a person is high net worth. So, they really are part of the main program. I need to make sure that I am not vulnerable to any bad code [e.g. infinite loop]/hacks.

I understand that there are two things at play here:

  1. The Java VM that provides the runtime.
  2. The Groovy Shell that interprets and executes the code.

Are there best practices to sandbox a Groovy Shell?

Thanks

1
  • You mean somewhere in a database or a conf file, a user enters def isHighNetWorth(...) { ... } and you'd like to read that from the db/conf and execute it?
    – BahmanM
    Commented Feb 9, 2021 at 1:05

3 Answers 3

2

I ended up creating a Policy file. Something like this:

grant codeBase "file:/your jar file" {
  permission java.security.AllPermissions;
}

grant codeBase "file:/groovy/shell" {
}

grant codeBase "file:/groovy/script" {
}

When Groovy is executed in interpreted mode, the codeBase is either file:/groovy/shell or file:/groovy/script. You can grant specific permission(s) for either context. These permissions (or lack thereof) are independent to what you give to your main program.

In addition to the policy file, there are many other considerations too.

  1. What do you put into the evaluation context? If you put a 3rd party library, they may not even have the properly permission check in place.

  2. Some System calls, say System.out.println() doesn't have permission check either. So, maybe you also need a source code checker (Jenkins does that).

  3. To limit CPU, you may need to run the Groovy script in a separate thread.

  4. You probably want to limit what a Groovy script can import too. This can be achieved with a Groovy ImportCustomizer.

I wrote an article: Secure Groovy Script Execution in a Sandbox to summarize my findings. I hope it will help others too.

2
  • Limiting the imports is no use. You do not need to import a class to use it (neither in Java nor Groovy). Furthermore, Groovy provides some means of dynamically obtaining a reference, e.g., String.class.forName('sun.misc.Unsafe').
    – pxcv7r
    Commented Feb 16, 2022 at 11:06
  • Running the script in a separate thread makes sense in general, but there is no way to limit resources (neither CPU nor memory).
    – pxcv7r
    Commented Feb 17, 2022 at 7:55
1

Just relying on the Security Manager does not solve all the issues. There are multiple reasons why Security Manager is unsuited. Most importantly, it relies on the assumption that critical methods already incorporate the due permission checks. As already pointed out, this is not always the case. In the Java SE API alone, there are plenty of examples; expanding the scope to further 3rd party libraries, you will rarely see good implementations performing permission checks. This cannot be retrofitted. Security Manager was designed for protecting a desktop system; in contrast, on a multi-user system, you need additional protection against attacks on other users.

A working approach is what Jenkins does: intercept all method calls and member accesses and check against a configured whitelist. This is implemented in https://github.com/jenkinsci/script-security-plugin

A crucial thing here is how to maintain a usable whitelist. The Jenkins approach works with extensive lists of method signatures (plus blacklists). While this is a conservative approach, it's probably tedious to maintain. You should start with the smallest possible API subset that you want to offer. At best, there is a dedicated API for script users that hides all implementation details.

There are still some corner cases, in particular regarding resource exhaustion. Think for instance about the following script:

for( int x = 7; true; x *= x );

This infinite loop will keep the CPU busy while there is no method call or field assingment to be intercepted. IMHO, the best way to handle this would be to execute the script in a separate thread and stop it after a given timeout. Yes, I mean calling Thread.stop(), because interrupts will just be ignored. Finally, scripts may raise any Throwable, even checked ones whithout declaring them; you should always use catch Throwable around a script.

1
  • Thanks. I agree with your assessments too. Especially on the limitations of using a security managers. Commented Feb 19, 2022 at 20:44
0

A bit more context would have been helpful, but given what you described:

I'd strongly recommend running groovyshell inside a container - one container per user/instance.

You can tightly control disk access, and also set a cap for CPU and memory usage of the container.

And if you want to go to the extreme, you can easily run each container in a network of its own with no other nodes and no internet access.

With that, the bad code will be quite restricted to docker vulnerabilities which can be exploited from a JVM program.

1
  • Thanks for the response. I edited the question to give a bit more context: "...These untrusted codes are provided by the end users (developers) as behaviour configurations, e.g. how to determine if a person is high net worth. So, they really are part of the main program..." You have a point of running the GroovyShell inside a container. However, even so, I wouldn't want the container to be compromised. Commented Feb 6, 2021 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.