tav’s jail¶

http://tav.espians.com/a-challenge-to-break-python-security.html

• Remove evil attributes like frame.f_globals or object.[subclasses]

• Remove evil builtins like compile(), import() or reload()

Zope security¶

http://svn.zope.org/zope.security/trunk/src/zope/security/

• Sandboxing

• Object proxies

Taint mode¶

Nicole King at one point wrote a taint mode for CPython 3.0, but the site (http://www.cats-muvva.net/software/) is no longer functioning.

Problems:

• amaury: The patch is indeed huge!

• fijall: it seems that every function that returns a PyObject must be modified

• fijall: need to patch (…) all places that might modify anything. (All side effects)

=> ncoghlan: PyPy is still a *much* better platform for that kind of experimentation than CPython

See also the presentation: Securing Python: Controlling the abilities of the interpreter, PyCon US 2007, Brett Cannon and Eric Wohlstadter

Related issue: Taint a la Perl?.

Python Security Response Team¶

Some members:

• Brett Cannon

Email: security AT python.org

Controlling Access to Resources Within The Python Interpreter¶

• URL: Python security paper online

• Paper: Controlling Access to Resources Within The Python Interpreter, Brett Cannon and Eric Wohlstadter, University of British Columbia

Sandboxing¶

• PyPy project: PyPy’s sandboxing features.

• CapPython is an object-capability subset of Python, inspired by Joe-E and Caja/Cajita, which are object-capability subsets of Java and Javascript respectively.

• SandboxedPython

• How can I run an untrusted Python script safely (i.e. Sandbox)

• CPython in the web browser under Native Client

Unsafe modules¶

• os.kill(), os.chown(), os.unlink(), …

• imageop: many bugs

  • CVE-2007-4965: Integer overflow in imageop module (2007-09 .. 2008-08)

  • Buffer overflow in imageop module (rgb2rgb8): fixed in Python 2.6.1 and Python 3.0

Fuzzing¶

Victor Stinner wrote a fuzzer called Fusil to test Python. It already helped to fix many bugs. fusil-python works on Python 2.4 .. 3.0.

Fusil was also used on PyPy (Finding Bugs in PyPy with a Fuzzer).